Accountants of a certain age will remember the 1983 movie War Games, in which a pre-Ferris Bueller Matthew Broderick and his classmate, played by fellow generational icon Ally Sheedy, narrowly avert nuclear war by playing tic-tac-toe with a military computer.
The key to the whole thing (40-year-old spoiler alert!) turns out not to be beating the computer at tic-tac-toe but repeatedly drawing with it, which ultimately convinces the machine that there are no winners in war.
Four decades later, the situation isn’t much different. OK, nuclear war isn’t on the line this time, but computers run by nation-states are wreaking havoc, this time by launching cyberattacks and stealing data from government and private organizations alike. And just as there were no winners in 1983, the challenge for accounting firms and other businesses in 2023 isn’t so much to win cybersecurity battles against foreign governments but not to lose them.
The new landscape of global cybersecurity
Back in 2011, Wired ran a long story about a town in Romania that had become “cybercrime central,” in part because people there liked it that way. Cyberattackers brought lots of illicit money into the town, spending it on cars and other luxuries and effectively trickling it down to townspeople who weren’t cybercriminals but did benefit from them financially.
As a result, Romanian authorities didn’t work too hard to catch cybercriminals. In the decade since the story ran, the situation in Romania seems to have tilted back toward law and order, at least a little bit. Romanian police, in conjunction with international law enforcement, have arrested members of cybercrime rings, and some arrests have led to convictions. In fact, the European Cybersecurity Competence Centre, founded in 2021, is located in Bucharest.
So, everything is clear on the international front, right? Well, no. In fact, the global cybersecurity situation has become much, much worse since 2011. Sure, rogue cyberattackers are likely still operating in Romanian towns, but a bigger problem now is that governments themselves are carrying out attacks. Where once government indifference toward cybercrime was a major problem, now nations committing full-blown cyberattacks is an even bigger issue.
Romania isn’t at the epicenter this time. Russia, China, Iran and North Korea are the major offenders, and the attacks they regularly launch are among the most dangerous, costing victims more than $1 million per incident. From 2017-2020, cyberattacks launched by nation-states increased by 100%. They’re only going to increase in the future, too.
The problem with nation-states and data collection
There is one major difference between government-backed cyberattacks and attacks launched by unattached criminals. While the average cyberattacker wants money for stolen data, nation-states generally want the data itself for spying purposes.
On the one hand, that means that if a foreign government hits your firm, you might not have to pay a ransom to get your data back. On the other hand, you’ll never have the chance to get your data back since the thief wants the information and not the money a firm might pay to retrieve it—although many standard ransomware attacks result in ransom paid and data never returned, anyway. On top of that, most experts represented in one study said they believe nation-states are making money from cyberattacks.
You might think that a nation-state would be unlikely to attack a small accounting firm, and it’s true that most government-backed attacks go after sectors other than finance. But you don’t want to be the victim of a foreign attack. Whether you lose money directly from an attack or not, your data will be exposed to foreign actors who don’t have good intentions for it.
Convictions of cyberattackers are relatively rare, but they’re almost impossible to obtain when a foreign government is involved. So, if you get hit by a nation-state, there’s really nothing you can do about it. Plus, your clients might be at greater risk than you might think.
Do your clients work with foreign governments at all? The link doesn’t have to be as blatant as supplying arms to Ukraine. It can involve any foreign business activity. More to the point, if your clients have any sort of government contract or are themselves government or quasi-governmental entities, opening them up to spying by enemy foreign nation-states could put them in grave danger and maybe even get your firm into high-level trouble. You almost assuredly don’t want to add international intrigue to your to-do list. You’re busy enough as it is.
A cybersecurity battle not to lose
The threat of nation-state cyberattacks to firms like yours is real. So, what can you do to mitigate it? If you don’t have a cybersecurity plan in place, develop one. If you have one now, reevaluate and reinforce it. As a foundation for a plan, you should:
- Host your accounting applications in the cloud, where professionals keep them secure, rather than on a server in your office.
- Adopt technology to secure your firm’s individual laptops and other devices, not just your server-level technology.
- Train your employees to recognize and avoid cyberattacks—phishing scams from nation-states become more sophisticated all the time.
- Work with a security partner that can neutralize the impact of an attack in case you do get hit.
You don’t have to “beat” nation-states at cybersecurity. The key is not to lose to them.
Matthew Broderick and Ally Sheedy saved the fictional world by not losing to a computer at tic-tac-toe in 1983. Unfortunately, avoiding government-backed cyberattacks in 2023 is a bit more complicated. But with the right strategy and partner, you don’t have to do it alone.