For all nations attending the Russia World Cup, the risk of hooliganism isn’t the only issue that they face. The World Cup is a hacker’s gold mine, with recent news reporting that the FA is to beef up cybersecurity if England qualifies for Russia World Cup 2018. Given the profile and asset class of the people and teams there—including the USA, France and Spain—who have been burnt by previous cyber-attacks, it will be vital for attending nations to secure their networks.

Whereas other World Cup events have caused concern about the physical safety of players, staff, and spectators, Russia’s World Cup has raised considerable concern about online threats. The football industry is facing huge challenges in defending networks in the build-up to such a global event, and organizations need to have a complete programme of preparedness in the event of a breach.

Preparing for the worst

Events like the World Cup entice criminals, including online hackers and cybercriminals. When it comes to the Russian World Cup, football associations are worried about a specific hacker group, Fancy Bears (which has targeted the FA and Olympics in the past), but the risk is not limited to a single group of cybercriminals.

Football federations around the world have already begun planning for the World Cup, and this year preparing to protect against cybersecurity risks is an essential part of the overall planning process. Some plans have already put in place, including installing anti-hacking software on the phones of players, and ensuring staff and players use the FA Wi-Fi. The US government has banned the use of Kaspersky—a Russian cyber-security software—and it may not be long before other countries or officials follow suit.

Risky behaviour

So, what could cybercriminals take if they successfully hacked into data at the event? Valuable personal data will be accessible, with players’ personal details, medical records, and performance data, among others, stored online. If these assets are stolen, important information will be at risk of being shared or sold.

However, it isn’t just the players’ confidential data at risk. Spectators and staff are also being advised not to use open Wi-Fi while in Russia, as these networks could put their personal data in jeopardy. The team hotels are now known—although those details are not yet public—so cybercriminals can already begin to plan and set-up cyber traps.

With some guidelines and advice already in place for both players and spectators, federations need to educate themselves on how to safeguard their data, including early warning signs of what to look out for, and how to minimise the impact of an attack if one is detected. Football federations must learn from past scandals, including WADA and IAAF, and introduce technology and skills to reach faster and more certain conclusions when investigating and potential threats or incidents.

Recently, the credit scoring company Equifax revealed it had been the victim of a dramatic breach,
potentially putting the data of up to 143 million US customers at risk. As we watched the story
unfold, things quickly turned from bad to worse. Days after the incident was announced, we learned
of the Apache Struts vulnerability and a huge configuration error in Argentina, and late last week we
discovered that up to 400,000 UK-based customers could be affected: key details behind this are yet
to be made clear.

The Equifax breach was not the biggest incident of its kind in recent years – but it’s certainly one of
the most dangerous. Millions of customers’ sensitive, personal data (including Social Security
numbers) is now at the whim of fraudsters seeking to steal identities. Even more frighteningly, it
took two months for the organisation to confess, meaning individuals were totally oblivious to being
at risk.

With just over eight months to go until new European personal data regulations come into force,
organisations can look to incidents, such as the Equifax breach, to learn some valuable lessons.

Compliance is key

With GDPR legislation in place from 25 th May 2018, keepers of personal data will no longer have the
luxury of taking months to craft a self-serving response to notify customers of a breach. In a GDPR
world, companies will need to provide notification of an incident within 72 hours. Failing to do this,
businesses risk being fined 4% of their global revenue – not to mention multiple, hefty fraud
penalties often demanded by the FCA.

Additionally, Equifax should be a lesson in awareness for all organisations who have become data
businesses. For several years, the limits of IT departments all over Europe have been tested due to
dealing with an overload of regulations, in addition to the constant pressure to ensure networks are
over achieving to meet increasingly high customer experience expectations.

Further complexity equates to further vulnerability. Compliance and performance are now at the top
of operational agendas, but security is still significantly falling behind the increased performance
mandate. As businesses begin to consolidate data centres, or move to the cloud in some instances,
the complexity of their enterprise networks will grow.

It’s crucial that as networks increase in complexity, visibility improves to aid management and
troubleshooting. For example, you wouldn’t shift to dense 10Gb Ethernet or higher network speeds
in order to deal with elevated network demand without making sure you had visibility of the
increased flow of information, would you?

The message for organisations is clear: increased complexity must be approached with increased
security and transparency as to the daily, internal happenings of a network. This does not exclude
third parties: cyber risk underwriters do not necessarily assign a lower score to companies that use
outsourced providers and other third parties to manage infrastructure and take care of, for example,
patching.

Attitudes towards security can often be gauged from the way a company handles third parties and
the quality of this relationship. However, it’s essential that the processes surrounding dealing with
third parties are correctly defined and understood in the first place.

Prepare now, or pay later

GDPR demands that data handlers must implement “security by design and by default”. This means
that systems must be designed from the outset to deliver the right levels of resilience and security.
In this respect, there won’t be any room for maneuver.

The harsh reality is that it’s likely every business will experience a data breach at some point, if they
haven’t already. So when the inevitable happens, in order to be compliant, organisations will need to
know, understand and communicate the breach within the 72 hour ‘critical period’. For this to
happen, they will need to be able to have a transparent view of network activity in real-time, with
the ability to identify the cause of issues quickly and prevent them from escalating further.