Guest Editorial by Will Plummer, Military Veteran and Chief Security Officer at RaySecur

As businesses across the globe have grown in their reliance on digital infrastructure, so too has the number of criminal attacks on that infrastructure, creating an unprecedented amount of cybercriminal activity.

Consequently, companies have had to step up their vigilance and proactive defenses to fend off possible attacks. Companies of all stripes—particularly those in the oil, gas, and nuclear energy industries—have enacted extensive measures to bolster cybersecurity.

However, the threats to digital systems are no longer exclusively digital. A new cyber threat has emerged with the ability to infiltrate an organization’s wireless network under the guise of a seemingly innocuous package in the mail.

Known as “phygital” attacks, these tactics capitalize on lapses in physical security that frequently stem from a lack of collaboration between CISOs and CSOs.

Without a united effort from both parties, cybercriminals can bypass standard cyber defenses before releasing malicious code or stealing confidential information.

What is a Phygital Attack?

The word “phygital” is a portmanteau of “physical” and “digital,” which is apt since these attacks typically involve a physical device that wreaks digital havoc.

One of the most popular types of phygital attacks is “warshipping,” in which the attacker sends a digital device through the mail.

Warshipping can involve a USB drive, a Wi-Fi adapter, or a  mini-computer, such as a Raspberry Pi, small enough to fit in a modestly sized cardboard package. What makes warshipping particularly dangerous is the low cost: for less than $100, a cybercriminal can acquire and assemble the components of a war shipping device.

Once the item reaches its destination, a modem transmits GPS coordinates to the attacker and scans the organization’s network for entry points. That scenario represents a nightmare for virtually any company.

After gaining access to the organization’s network, cybercriminals can uncover more vulnerabilities and essentially create an ongoing back door for further attacks. At that point, the cybercriminal could launch a full-scale ransomware attack and cause massive disruption.

These attacks are particularly worrisome in today’s climate of remote and hybrid work since packages tend to sit in mailrooms or on top of employees’ desks for days or even weeks.

Companies related to critical infrastructure, including utilities, oil and gas, and nuclear energy industries, have been a primary target for cybercriminals for years. For example, in 2021, a ransomware attack famously triggered a temporary shutdown of the Colonial Pipeline.

Despite the ongoing threat of cyberattacks, the public utilities sector in particular remains vulnerable to phygital attacks, particularly warshipping.

Mitigation Strategies for Phygital Attacks

Thankfully, there are multiple ways to effectively mitigate the risk of a phygital attack.

The first step is educating your employees about warshipping and other phygital tactics. This way, they won’t be caught off-guard when you introduce a series of new policies regarding company mail.

1.   Process Incoming Mail Immediately

Organizations must treat all incoming packages as they would visitors to their workplace. Would you let a stranger walk straight up to the desk of your CISO? To prevent potentially dangerous materials from entering secure areas or sitting in your office for several days, process all incoming packages immediately and inspect them for unsolicited devices.

The fewer incoming packages your office receives, the less vulnerable you are to phygital attacks. For this reason, you may consider introducing a policy against employees receiving personal mail at work. Unsolicited packages will become apparent very quickly.

Likewise, let’s say a package arrives that simply looks sketchy. Maybe it’s addressed to someone who doesn’t work there and has never worked there, or the sender appears unfamiliar or dubious. These are both signs that you return the package immediately to the sender.

2.   Safeguard Your Wi-Fi

Warshipping operates under the notion that the package will be left inside your mailroom, where the hidden device will have plenty of time to hack into your Wi-Fi and intercept your data.

So, you must protect your Wi-Fi with WPA2 authentication along with a virtual private network (VPN) and multi-factor authentication (MFA) for your employees. Realistically speaking, WPA2 authentication cannot give you 100% protection from warshipping.

However, it can give you additional time to identify and dispose of phygital devices while cybercriminals try to find their way around these additional security barriers.

Even with Wi-Fi protection in place, organizations must still monitor their networks for suspicious devices and activity. Fortunately, network discovery software can detect suspicious traffic and new devices when they connect to your network.

(Get an understanding of the world’s most cost-effective cyber security Ai with a revealing interview from guardDog AI founder Peter Bookman. Courtesy of F1 FibreFast and YouTube.)

Network discovery software can help you identify warshipping devices well before cybercriminals have obtained any sensitive data.

3.   Scan Mail for Phygital Devices

Again, incoming mail deserves the same security protocols as new visitors to your building. With this in mind, organizations would be wise to implement scanning measures for incoming mail as soon as they receive it.

3D mail scanners, for example, can detect electronic devices in packages as well as hazardous powders or liquids without the use of harmful X-rays.

(See this interview with Will Plummer, RaySecur CSO at ISC West 2022 where by Chuck Harold asks, “what’s different about RaySecur and the scanning technology that is used?” Courtesy of RaySecur and YouTube.)

Organizations in the oil, gas, and nuclear energy industries and related critical infrastructure have harnessed scanning technology to monitor personnel for many years. With this in mind, it’s not unreasonable to consider implementing a similar process in your company’s mailroom.

Bridging the Gap

As digital integration sweeps the globe, cybercriminals will take further advantage of the physical blind spots that naturally result from this monumental shift.

It’s up to CISOs and CSOs to work together and collectively neutralize both digital and physical points of entry.

Before implementing such initiatives, both parties must commit to fully understanding the threat of phygital attacks. In the meantime, cybercriminals will continue exploiting the widespread lack of phygital knowledge to carry out their nefarious schemes.

About the Author

Will Plummer is 25-year veteran of the US Army, where he earned a Bronze Star with Valor as a Master Explosive Ordnance Disposal (EOD) Technician, and commanded multiple Special Operations units with multiple combat deployments.

He has an MA from the Naval War College and a BA from the University of California at Chico. Currently, Will serves as the Chief Security Officer for next-generation mail screening technology provider RaySecur.

Plummer leads the company’s physical security efforts, overseeing a team of EOD professionals, and managing clients’ threat mitigation efforts.

Related Technology…

guardDog .AI a Triple Platinum Winner in the 2022 ‘ASTORS’ Homeland Security Awards

American Security Today’s Annual ‘ASTORS’ Awards is the preeminent U.S. Homeland Security Awards Program, and now entering it’s Eighth Year, continues to recognize industry leaders of Physical and Border Security, Cybersecurity, Emergency Preparedness – Management and Response, Law Enforcement, First Responders, as well as federal, state and municipal government agencies in the acknowledgment of their outstanding efforts to Keep our Nation Secure.

guardDog .AI (First of Three)

Best Vulnerability Management Solution

• guardDog AI-Powered Autonomous Detection and Response

• For the first time, guardDog ai has provided the world with a cybersecurity system that is accessible to virtually everyone. It can see the risks device management solutions don’t cover and can thwart the attempted exploits it detects in less than 2 milliseconds.

• guardDog.ai is a cloud-based software service plus a companion device that works together to simplify network security.

• The solution exposes invisible threats on networks in ‘edge territory,’ and the devices attached to them, with patented technology to address and prevent cybersecurity threats before they compromise network environments.

• guardDog’s Protective Cloud Services (PCS) is an AI-powered network security solution that doesn’t require cyber security expertise to operate.

• Once activated, users’ Fido device goes to work by detecting threats and vulnerabilities on your network.

• From there, the users’ cloud dashboard displays incidents by threat level and shows them information on how to resolve the issues before they become a problem.

(Learn More. Edge Territory is the invisible space between networks. For example connecting to a hotel or cafe Wi-Fi, or working from home can leave your sensitive or private data vulnerable. Any device on a network can also create openings for danger, such as a webcam or digital doorbell. guardDog makes the blind space visible. Combined with their AI-powered cloud solution, your guardDog device is always up to date, protecting you against the latest threats. With guardDog you can see the invisible threat and do something to stop it. Courtesy of Good Day Orange County and YouTube.)

guardDog Solutions (Second of Three)

Best Cyber Analytics Solution

• guardDog AI-Powered Autonomous Detection and Response

• No Cybersecurity Experience Required! guardDog.ai installation is a snap, and protection is a power light away.

• Secure a home, a small office, a large enterprise, or any other organization with a cyber security management solution made easy that offers services to match the user’s needs.

• How it Works:  Unbox your Fido device, connect to your network, and register. From the moment the power light appears, protection begins. Fido gets to know your network and your devices.

• It recognizes intruders and defends your network and devices. When someone attacks, it deploys automated countermeasures. User’s networks and devices are scanned vigilantly to protect against the known, and the unknown.

guardDog Solutions (Third of Three)

Best Threat Intelligence Solution

• guardDog AI-Powered Autonomous Detection and Response

• Coverage for “edge territory.” guardDog.ai make sit possible to detect and proactively thwart cybersecurity risks that device management can’t see – the threats in the edge territory that require an overlay that’s as simple as “plug and protect” for consumers and businesses.

• It uses a cloud AI database to see and thwart attempted exploits before they can enter the network and succeed in planting virus, phishware or ransomware attempts.

• The ability to thwart attempted exploits in less than 2 milliseconds. Every business, government, healthcare institution, home consumer, or other organization, is grappling to find security solutions that are adapt to this changing world. guardDog.ai is pioneering innovations that can truly meet these new and perpetual challenges.

• Last year alone, there were over 12,000 new vulnerability exploits that emerged, and no human could really keep up with that.

• guardDog’s ai-powered service learns about these attacks and keeps users’ Fido devices up to date.

• The training never stops to prevent a crisis before it happens.

• guardDog.ai has developed a cloud-based software service with a companion device that works together to simplify network security.

• The solution exposes invisible threats on networks, and the devices attached to them, with patented technology to address and prevent cybersecurity threats before they compromise network environments. 

• *AST is delighted to welcome guardDog.ai, a 2021 ‘ASTORS’ Awards Champion, as a New Premier Awards Sponsor in the 2022 ‘ASTORS’ Homeland Security Awards Program.

 

American Security Today’s Annual ‘ASTORS’ Awards is the preeminent U.S. Homeland Security Awards Program, and now entering it’s Eighth Year, continues to recognize industry leaders of Physical and Border Security, Cybersecurity, Emergency Preparedness – Management and Response, Law Enforcement, First Responders, as well as federal, state and municipal government agencies in the acknowledgment of their outstanding efforts to Keep our Nation Secure.

AST strives to meet a 3 STAR trustworthiness rating, based on the following criteria:

• Provides named sources
• Reported by more than one notable outlet
• Includes supporting video, direct statements, or photos

Subscribe to the AST Daily News Alert Here.