How do you prepare for truly unknown cyberattacks or threats to physical security?

It’s a question that we all have to ask in the aftermath of the missile strikes exchanged with Iran. As many are (rightly) concerned with the possibility of a traditional war starting in the Middle East, it is likely that retaliation will happen over cyberspace, putting all our networks and infrastructure at risk.

What’s most worrisome about these initial strikes is the lack of transparency. Most members of Congress had no idea the attack was imminent, and when they were briefed, many complained that their questions went unanswered.

If Congress isn’t being told what is happening, you can be sure the CISOs of major corporations aren’t being told or aware of any incidents that could have life-altering physical and cyber consequences. So with no possible coordination, how can you possibly be prepared?

Anticipating from the already known

The easy answer is to always be prepared for anything. But an act of cyberwar requires a higher-than-usual state of alertness, one that many organizations may not be able to afford in both human, or financial resources.

The next best thing is to use historical data as the base-level of preparedness. We already know that Iran is one of the top nation-states in cyber expertise in hacking proficiency. Iran’s digital fingerprints are on past attacks against critical infrastructures, such as a dam in New York State and more recently, Iranian malware discovered on a Saudi Arabian oil company’s network. They also launched physical attacks on Saudi oil fields. These are attacks they’ve conducted without major provocation.