Saudi Arabia has learned its lessons in cybersecurity. After a series of attacks over the last five years, believed to be mainly from Iranian sources, the Emirate has upped its guard. As a result, it is now considered only the second country, after the United States, in the world with the most advanced cybersecurity systems and policies in place.
It has introduced the Essential Cybersecurity Controls, which have been evolved by the National Cyber Security Authority and are mandatory for the country’s manufacturing and petrochemical units and other organizations.
These laws prevent any information technology (IT) or operational technology (OT) attacks on the country’s critical systems. However, as the Emirate is one of the region’s largest manufacturing and crude oil producing hubs, it has been the target of vicious attacks, which have come in waves over the years. It is believed that Iran, which is a rival of Saudi Arabia, has developed three versions of the malware, Shamoon, and has used it to attack critical installations.
The severity can be gauged by the fact that Saudi Arabia suffered 9.7 million cyberattacks in 2021, which is just 3% shy of the record 10 million attacks in 2020. But it was a massive 14% jump from cyber hits in the pre-pandemic years before 2019.
A report assessed the damages from such attacks worldwide at $6 trillion in 2021. And that would be the third-biggest economy in the world, next only to the US and China. The report also warned that the losses would amount to $10.5 trillion by 2025.
The Different Stages of Modern Cybersecurity Attacks
The number of attacks increased under work-from-home during the Covid pandemic as companies had to lower their security firewalls to allow their employees to access systems remotely. This allowed hackers to get access to critical resources through the gateways opened by companies’ staff.
A security expert pointed out that the number of cyber attacks rises the moment there is political tension in the region. Also, since attackers have realized the damage such targeted hits could cause, they have increased investments too on their infrastructure to make these attacks more effective, he pointed out.
• Some of the top attacks in the country were on Dalil, the popular caller ID app, which over 5 million people have downloaded.
• Attackers also targeted hacking of user-related data from Virgin Mobile which has 20,000 points of sale in the Kingdom of Saudi Arabia.
• Stealing of records from the healthcare benefits management company GlobeMed Saudi took place a year ago.
• The Shamoon attack on the Saudi Arabian Monetary Agency that monitors the currency has been one of the most sensitive attacks.
• The $50 million ransomware demand from Saudi Aramco, which is the world’s biggest oil company, was the one which shook the cybersecurity system of the country.
• A near-disastrous attack on the Saudi petrochemical plant in 2017 that was avoided only because of a small error in the malware code was one of the major attacks.
• Hacking the website of Davos in the Desert, a significant economic conclave in the region, and attacks on 11 IT firms in the country in 2019 are some of the other significant reported incidents.
Saudi Arabia Taking Significant Steps
To counter such attacks, Saudi Arabia, in July 2022, signed a strategic agreement with the world’s leading cybersecurity solutions provider Kaspersky at @Hack Infosec Conference 2021.
A top official from Kaspersky said that as the Emirate has been adopting advanced digital, Internet of Things, Artificial Intelligence, and blockchain technologies across private and public spheres, it will see increased attacks on its critical systems. He added that Kaspersky would provide reliable security to companies and individuals from increasingly sophisticated and scurrilous attacks.
The Essential Cybersecurity Controls (ECC), which are part of the Emirate’s Vision 2030, are aimed at securing government and government-affiliated organizations against cyberattacks. These set minimum cybersecurity requirements for companies and organizations and all organizations are encouraged to implement all the standards in ECC. In contrast, all national organizations must put in place all necessary measures.
To be ready to counter any such threats, the Emirate has formed six axes – Integration (concerned with the integration of all components of cybersecurity), Organization (identifying sensitive infrastructure and managing cyber risks), Emphasis (ensuring the protection of cyberspace), Defense (to protect all defense-related installations), Cooperation (to build mechanisms for appropriate partnerships) and Construction (for the existence of a strong national base).
