The historical approach to cybersecurity has been to maintain a robust risk posture and patiently wait for cyber-criminals to reveal just how effective an organisation’s cyber defenses are.
While this has proven to be an effective strategy for the unscathed, companies impacted by cyber incidents may feel otherwise.
Some argue that maintaining a defensive position is an overly passive stance that can leave companies vulnerable to hackers—and that behaving actively is the key to neutralising threat actors. What is the current attitude towards beating hackers at their own game? Is it even legal? Is it something that companies are actively exploring, or has it been considered and abandoned?
Cyber war rooms
A classic ‘war room’ is a space where key stakeholders across a company can gather to work through major incidents. Large-scale hacks have given rise to war rooms specifically designed for resolving IT-related incidents.
Cyber war rooms are most prominent in the banking sector. Fusion centers, inspired by the Department of Homeland Security, have been established by banks like MasterCard, Citigroup, and Wells Fargo to coordinate intelligence gathering and detect patterns in data. The financial sector has also implemented large-scale combat drills like the Securities Industry and Financial Markets Association’s Quantum Dawn to simulate catastrophic cyber strikes and test their response capabilities.
Despite fostering an aggressive cybersecurity culture, some organisations have grown sceptical about the overall effectiveness of cyber war rooms. Research by Dynatrace revealed that organisations are still playing the blame game with IT service providers after serious incidents, leading to strained relationships and ineffective incident response plans.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThe reliance on war rooms can cause burnout among IT professionals, with many considering career changes due to stress. To address these issues, businesses must prioritise psychological safety, trust, and collaboration within their teams and with third parties.
Hacking back with ACDC
In 2017 and 2019, a bill known as the Active Cyber Defense Certainty Act (ACDC) was introduced, colloquially known as the “hacking back bill”. The bill would allow US businesses to retaliate against cyberattacks under certain circumstances, potentially helping to identify threats and recover stolen data.
Concerns have been raised about the legal implications of such actions, as well as the potential for escalation and unintended consequences. The bill itself has also not developed or progressed since its inception. In response to the lack of progress on the ACDC Act, a bill was introduced in the summer of 2021 to instruct the Department of Homeland Security to study the potential benefits and risks of allowing private companies to hack back. The study aimed to explore questions around attribution, authorization, response options, and guard rails.
While the idea of ‘hacking back’ may seem an appealing way to deliver justice, there are also concerns around the legality of such actions, the complexity of cyber attribution, the potential for vigilantism, and the risk of escalating conflicts with cybercriminals and even nation-states. For the time being, it seems as if hacking back is largely on the back burner.
Hiring cyber criminals
The psychological biases and motivations of threat actors are fairly unique. Not all threat actors seek to steal data or money. Some would rather simply demonstrate that the cyber defences of a company or a nation-state aren’t sufficient and are willing to do whatever it takes to prove this. If this is the case, why aren’t organisations simply hiring cyber criminals to penetrate their cyber defences for robustness testing?
It is largely believed that many organisations hire what are known as “red hats”, or hackers who act as digital activists and use their knowledge to convey a message. However, most organisations will likely not admit this.
In response to the taboo culture around hiring hackers, the EU introduced the Threat Intelligence-Based Ethical Red Teaming for the European Union (TIBER-EU) in 2018. The TIBER-EU is a regulation that was jointly by the ECB and the EU’s national central banks, which outlines principles for ethical ‘red teaming’—a process designed to detect network and system vulnerabilities by taking an attacker-like approach to data access.
The EU’s Digital Operational Resilience Act, which came into force in January 2023, uses the principles of TIBER-EU for its penetration testing framework. While attacking hackers may seem like a natural step forward in the international cybersecurity equation, the frameworks for doing so are still immature and have seen limited progress since their inception. In any case, it is crucial that organisations maintain robust cyber defences, but are still open to incorporating active cyber strategies as and when they develop.
