UAE cybersecurity officials have urged organisations to stay vigilant as cyberattacks remain high amid the US-Iran conflict.
The UAE was forced to thwart thousands of missile and drone attacks from Tehran at the height of the conflict and it remains on high alert following the news that the country faced 640,000 cyber attacks in a single day last week.
Jans D’Hert, a cybersecurity expert and Sans Certified Instructor at the Sans Institute, said organisations must continue to prioritise cybersecurity and avoid repeating basic mistakes from a decade ago. He urged them to use past incidents to strengthen their systems, rather than just recovering and moving on.
“Being compliant doesn't mean that you're secure,” he told The National. “The attacks have increased.” Mr D'Hert linked the rise to broader regional activity and noted that such attacks often accompany those against physical infrastructure.
Dr Mohamed Al Kuwaiti, head of the UAE Cyber Security Council, said Iran remains “one of the main players” behind attacks on the country. He told CNN that the Islamic Revolutionary Guard Corps was behind many of the attacks.
The recent number was below the peak of almost 800,000 attacks recorded in April, but is still significantly higher than before the conflict escalated. Earlier this year, Dr Al Kuwaiti said the UAE's digital infrastructure faced about 200,000 to 600,000 attacks a day after the war began.
Pradeep Menon, chief AI and security officer at Paramount Assure, said that misreading a quiet period as an all-clear is the biggest risk. Attacks can sit dormant for long stretches before being activated, he said, so an apparent period of calm does not necessarily mean hostile activity has stopped.
Cyber resilience must be part of long-term planning regardless of the geopolitical situation, said Amer Sharaf, chief executive of the Cyber Security Systems and Services Sector at Dubai Electronic Security Centre.
“Everyone in the world knows how important it is to have cybersecurity as part of their agenda and resilience as part of their agenda, regardless of the times that they are in,” he said.
Critical information infrastructure at risk
Experts advised prioritising the protection of critical information infrastructure and industrial enterprises. It was also recommended that organisations conduct regular security audits, cybersecurity tests, and exercises.
Dr Al Kuwaiti said that the UAE had experienced attacks against energy, oil and gas, electricity, water, government systems and financial services. However, the UAE was able to detect the attacks proactively.
The UAE Cyber Security Council also said national teams detected and contained organised attacks on aviation, energy, and education systems in August, before they could disrupt essential services.
According to a recent study by the information security research company Positive Technologies, the UAE was the target in 35 per cent of all attacks in the region.
Government agencies were the most frequently attacked, followed by sector-agnostic attacks and the industrial sector. The pattern reflects the growing role cyber attacks play during geopolitical conflict.
“It's a new way of doing war,” Mr D’Hert said. He said critical infrastructure was often the most attractive target because disruption could have consequences beyond a single organisation.
“Oil, gas, electricity, internet potentially… I think those are the biggest threats,” he said. He included power stations, data centres and water management on the list.
AI accelerates attacks
Attackers are using AI to speed up techniques that previously had to be enacted manually, Mr Sharaf told The National.
“The entire world is awakening to this threat that is out there that's being used by adversaries, by attackers, hackers, etc, trying to speed up the process in which they did what they did before,” he said.
But he said AI was also strengthening the defensive side. Dubai Electronic Security Centre has been using AI to speed up its response to cyber incidents and last week unveiled Saraab, an AI-powered tool designed to identify deepfake videos.
Mr Menon said AI was becoming an increasingly important geopolitical tool because countries and attackers could use it to expand their capabilities.
“AI is basically a strategic asset for our countries,” he said. He said the technology could enable attacks on a scale that would previously have required far more people and time.
More than 85 per cent of cyber threats begin with an incorrect or unintended click by an ordinary user, Dr Al Kuwaiti said at the Arab Media Summit last week. “Awareness is the first line of defence,” he said.
