The Blended Threat: Physical and Cyber security

When the term Cyber is used, most people immediately think of companies losing data, ransomware attacks, or online services being lost. In other words, the Digital impact.  

But that’s not always the intent of the attack being made. We live in a world where our personal and business lives coexist online, and physical and digital overlap and intersect. 

It should be no surprise therefore, that physical, digital, and cyber security constantly intersect and are as connected as never before. 

The aim of a cyber-attack can be to enable a subsequent breach in physical or personnel security, resulting in a contagion effect of vulnerabilities for companies, their staff, and also high net worth individuals. 

This blending of the threat landscape that results from our lives being lived online, requires an equally blended security strategy to formulate a defence.
‍

Comprehending the Cyber-Physical Blended Threat

The nature of the blended threat means that the cyber and physical elements are interwoven, a physical breach of access to your offices, or the stealing of equipment. 

Equally, a cyberattack can disable physical security controls, opening the gates for physical breaches. This cycle is self-perpetuating, enabling and supporting follow on attacks. 

These threats require a convergence of security measures to continuously tackle both fronts simultaneously.

‍

Business Travel Scenario  - Example Case Study 

Your company takes the security of your Board members and key management personnel seriously, including on business trips abroad. 

Indeed, your Board recently took out Kidnap and Ransom (K&R) insurance for these high profile individuals, which included some free risk advisory consultancy paid for by the insurer. 

Alongside this, your company has contracted with a Physical security consultancy to provide Personnel security services to this core team. 

Separately, your company has a Cyber Security team, inhouse or outsourced, which coordinates the company’s cyber security management for your firm.

However, the blended Cyber-Physical threat is not in a “silo” and will target the most vulnerable and often overlooked parts of your company’s security and the individuals within it. 

If we take the example of Director X, a high profile member of the core management team, and a frequent business traveller to visit clients throughout South East Asia. 

Director X is considered a potential kidnap target and so is covered under the K&R policy. As part of the reconnaissance for a potential kidnapping Director X may well be followed to an airport to try and intercept his / her communications and so steal useful security credentials. 

Equally, the potential victims home router may be identified and malware installed, or home wifi credentials stolen using an attack via social media on a family member. 

That access is then easily used to ascertain calendar and travel arrangements. 

‍

Break Down Cyber and Physical Security Silos

Companies have historically managed physical security and cybersecurity in their own silos. 

However, in recent years as technology has evolved, with internet connected devices having doubled in the past five years and likely to do so again by 2030, the siloed approach to security is no longer viable. 

Fostering an integrated security strategy, protects against blended cyber-physical threats, establishing integrated defence in depth over time. As the digital eco system, companies, and technology evolves, the convergence of security threats requires a blended response in the delivery of resilient security practices. 

Learn more about Building a Cyber-Resilient Business.

Integrated security is not just locks and doors, devices and firewalls, it is about understanding what you have that the attacker wants, and how they can combine physical and cyber tools to achieve that. 

A comprehensive and cohesive system of defences is needed if you are going to confidently protect the people that work for your company, as well as its assets, reputation, and revenue generation.

To effectively address these evolving threats, adopting a threat-led approach is essential, as discussed in A Threat-Led Approach to Cyber Defence.

Digital Oversight via its CONSULT service can assist your firm to break down the silos and adopt an integrated physical and cyber security approach.

If you're ready to take a proactive stance against blended threats and strengthen your security posture, get in touch with us today to learn how our CONSULT service can help.