Lessons learned about cyber resilience from a visit to Ukraine – Source: www.csoonline.com

During a visit to the recent Kyiv International Cyber Resilience Forum 2025 in Ukraine, I encountered a recurring theme across a plethora of speakers: always be flexible and keep your options open and active.

The context for these discussions was drawn from both the kinetic and cyber wars being fought in Ukraine against the invading Russia.

For example, one panel discussion highlighted that international cooperation is key to waging a cyber war, and expounded upon how Ukraine has been successful in repelling Russia’s cyberattacks due to the assistance and collaboration from private entities in the United States and Europe. And I’d argue that this is a fundamental tenet of modern cyber warfare — the threats are global, and it takes a coordinated international response to defend against them.

It has been widely documented how various nation-state entities from within Russia, the GRU (military intelligence), the SVR (foreign intelligence), and the FSB (state security) are engaged in cyber operations targeting Ukraine, Europe, and the United States.

In addition, proxies from the Russian criminal world have joined the melee, not because Russia requires deniability and would hide behind a third-party aggressor, but rather because encouraging these entities enhances its attack capabilities. In addition, these criminal entities provide a means for gathering stolen credentials to be leveraged in the battle.

Russia’s expertise in social engineering is not up for debate; they are good at it and they are effective wielding it like a weapon. They take an all-of-government approach to their efforts, and while the three security services may compete against one another for resources, they do collaborate and cooperate. Ukraine has seen evidence of this in a concerted effort to compromise mobile devices and garner access to Signal (a commercial secure communications application) groups.

The Russians’ modus operandi, shared during the forum, is to send QR codes to targets from a compromised device, inviting the individual to install Signal on their device or join an already-existing Signal group. While Signal may indeed be downloaded, following the QR code’s link ensures that a malicious payload from the Russian actor comes along for the ride.

In mid-February 2025, Google’s Threat Intelligence Group published a comprehensive report on Russia’s targeting of Signal, which discusses the methodology at length.

What to do when your partner in a fight disappears

What was evident at the conference was the reliability of Ukraine’s European partners and the very evident and self-declared step back taken by the United States. Indeed, it was repeatedly stated by the SBU (Ukrainian intelligence) that Signal had inexplicably stopped working with the Ukrainian government in addressing the Russian social engineering and manipulation of Signal users, much to the chagrin of the Ukrainian teams attempting to counter Russia’s actions.

And here’s where the necessity of flexibility as a core support for resilience was evident: The panel discussion stressed the importance of having options and alternatives when political dynamics change reality on the ground.

Satellite imagery or communications, for example, might be available one day, gone the next. The harsh reality is that commercial entities (and governments) may change their level of cooperation and provision of goods and services with the political wind. Volodymyr Karastelyov, acting head of the SBU Cyber Security Department, noted that one of Ukraine’s major realizations has been that it needs to find alternatives to commercially provided systems.

The key takeaway from this discussion was that when your partner stops being your partner, as in the case of Ukraine, it serves to help the aggressor.

In addition, the Second Additional Protocol to the Cybercrime Convention was crafted to address the challenges of transnational cybercrime, be it by a criminal or state entity. The protocol, signed by 78 countries, is a light at the end of the tunnel. It is designed to speed up the prosecution pipeline — as it currently stands, cybercrime may take three minutes to conduct and years to prosecute, which is not much of a deterrent.

Resilience is critically important to cybersecurity

Resilience is more than just a word; it is a way of thinking. The adage, don’t put all your eggs in one basket holds true today for cybersecurity as it did for the child on the farm walking with their eggs back to the kitchen from the coop.

Mikko Hypponen, chief research officer at WithSecure shared during a remote address to the forum how Europe has the resources to address the cyberthreats in its work with Ukraine and “need not look to a far-off land” for cybersecurity solutions. And therein is the crux of the takeaway for CISOs: resources may exist where you least expect them and are figuratively speaking in the backyard in the case of Ukraine.

Conversely, a service may disappear at any time, and resilience requires that an alternative capability be available. I have shared previously how in my younger days, I was engaged in telecommunications and always had multiple levels of communication available to me and my customers, with the final level being Morse Code transmissions.

Planning for one’s worst-case scenarios (service provider failure, catastrophic event, an insider threat becoming reality, etc.) and then never having to use that plan is not a defeatist mentality; it is a prudent one, as evidenced by the Ukrainian resilience over the course of the past decade.