Βy Spyros Evagorou*
It is undeniable that digital technologies are the main pillar supporting the state’s essential services, offering unprecedented progress and efficiency through innovation. However, it’s not a matter of “if,” but “when” a cyberattack will succeed, exposing vital sectors to significant vulnerabilities. Sectors such as energy, water, health, transportation, telecommunications, and government services. The impacts of a successful attack on these critical infrastructures could be devastating, disrupting basic state services, endangering public safety and privacy, and paralyzing economic activities.
The Immediate Threat
From state entities to criminal groups, actors driven by various motives, engage in cyberattacks. Motives include political and military influence, financial gain, or even ideological agendas. Recent incidents should be taken as a significant warning for every state. Through their analysis, it becomes apparent which critical vulnerabilities can be exposed within these infrastructures and maliciously exploited.
An example of critical and prolonged incident is the cyberattacks on Ukraine’s power grid, which has repeatedly been targeted, with the most notable incident being in 2015 that caused widespread power outages and is considered the first publicly recognized “digital weapon” attack that hit a power grid. Since then, cyberattacks on this network often coincide with periods of tension, and the current war reveals a worrying combination of cyberattacks and physical attacks causing significant disruptions to daily life, economic damage, and humanitarian concerns in the country.
Notable was the successful ransomware attack on the Colonial pipeline in May 2021, which paralyzed fuel supplies in the United States, causing major economic losses and public panic. This event served as a warning to the US. The awakening came, and many significant steps have been taken since then for cyber defence, but the threats have not stopped.
These events are merely indicative and represent a small part of the reported incidents that show the constantly evolving threats posed by malicious entities.
Why Cyprus Faces Unique Challenges
For a small island state like Cyprus, the risk is exceptionally high. With a limited resource base and heavy reliance on service sectors and imported goods, any disruption to critical systems could quickly escalate into a national crisis. Cyprus’s strategic position as a regional centre for stability, business, trade, and tourism makes it an attractive target for cybercriminals aiming to destabilize or blackmail key sectors.
As highlighted, Cyprus’s economy heavily relies on several industries vulnerable to cyber threats. At the top of this list is the tourism industry, a key driver of the economy. It depends on reliable and uninterrupted telecommunications, transportation, and hospitality services. A cyberattack disrupting reservation systems, tourism infrastructure, financial services, or accommodation services can lead to significant economic losses and damage the country’s reputation as a tourist destination.
Cyber Threats to Shipping and Aviation – Cyprus’s Critical Role in Humanitarian Efforts
Undoubtedly, the island’s geographical location makes it a vital hub for maritime activities. Moreover, Cyprus, recognizing the role of aviation, considers it vital to enhance the country’s regional role and increase its air connectivity.
Beyond the economic importance of the above, Cyprus plays a crucial role in humanitarian missions. The island serves as a vital space with the implementation of the national “ESTIA” plan, the Ministry of Foreign Affairs’ emergency plan that allows for the safe evacuation of citizens from nearby crisis zones (especially in the Middle East) through Cyprus in times of emergency or crisis. Additionally, Cyprus is the initiator and has a leading role in establishing the “Amalthea” initiative, which has created a safe sea route for providing aid to Gaza from Cyprus. This joint effort by various countries allows for the delivery of vital supplies by sea.
Disruptions caused by cyberattacks on critical infrastructure, such as airports and ports, can cause problems in maritime and air transport, affecting both state and regional economies. It also significantly hinders Cyprus’s ability to fulfil its obligations in humanitarian aid sectors. Most importantly, this could leave citizens stranded in conflict zones or jeopardize their safety and well-being.
The Chain Reactions of an Attack
Cyprus is now particularly vulnerable to the chain reactions of cyberattacks. This is because the interoperability of digital technologies in the aforementioned sectors increases the impact of such incidents, as a successful attack will hardly remain isolated. It would have chain reactions to all other sectors, disrupting essential services, paralyzing businesses, and endangering public safety.
Enhancing the Island’s Cyber Resilience
To reduce these risks and increase the security of critical infrastructure, cooperation from all stakeholders is primarily required. The first step is adopting a cybersecurity culture. Implementing basic security rules according to international standards, access controls, encryption, and continuous monitoring for anomalies. There must be backups and alternative solutions for the operation of information systems to ensure resilience and business continuity. As mentioned earlier, even the implementation of basic rules requires cooperation between government agencies, private companies, and citizens, because awareness of cyber threats and best practices are the first line of defence. Public-private partnerships can provide the impetus and encourage a common approach to cyber defence. By creating reliable channels for sharing threat information and coordinated incident response, it can significantly enhance national resilience to cyberattacks.
An important step is staff training. Human error remains the biggest cause of breaches. Regular security awareness training for employees operating in critical sectors can significantly reduce the risk of human error. Employees must be equipped with the knowledge and tools to identify and respond appropriately to suspicious activities, phishing attempts, and social engineering tactics.
Towards this direction, the Cypriot government has made great progress with significant steps to enhance cybersecurity. The National Cybersecurity Coordination Center (NCC-CY) serves as the national point of contact for the Cybersecurity Community in Cyprus. It coordinates relevant activities, promotes cooperation between the public and private sectors, and offers services to help organizations protect themselves from cyberattacks. NCC officials called on Cyprus organizations to utilize the Center’s services, emphasizing that the state will continue to prioritize cybersecurity.
It is also important to note that as part of this collaborative approach and to strengthen and shield the island’s cybersecurity, the NCC collaborates with international organizations and allies, such as the European Cybersecurity Competence Centre (ECCC) and the European Union Agency for Cybersecurity (ENISA), for information and resource sharing. This role is crucial for achieving the EU’s ambitious cybersecurity goals, particularly through funding provision via the Digital Europe and Horizon Europe programs. Through knowledge sharing, capacity building, and awareness raising, this cooperation is key to enhancing trust in the connected economy and increasing the resilience of Cyprus and Europe’s infrastructures.
Another significant step for the island towards resilience is the establishment of the National Cybersecurity Certification Authority (NCCA) in January 2024, aiming to promote cybersecurity certifications for products and services used by critical sectors such as information and communication technologies. The NCCA solidifies Cyprus’s position as a regional hub for Cybersecurity services. It can certify European or third-country products and services within the European market, grant licenses, oversee conformity assessment organizations, monitor markets for certified products and manufacturers, collaborate with national and international entities, and represent Cyprus in European cybersecurity bodies. This authority emphasizes the aforementioned approach of cooperation between critical organizations to enhance cybersecurity both in Cyprus and throughout Europe.
Steps Forward
The security of the island’s critical infrastructure is not just a technological challenge but a strategic necessity. Organizations operating in these sectors must prioritize robust cybersecurity frameworks, allocate adequate resources, and promote public-private partnerships to protect these vital systems from cyber threats. As Cyprus progresses technologically and becomes increasingly digital, in order to provide better services to its people, the consequences of a successful cyberattack on critical infrastructure could be catastrophic.
A secure digital state is feasible, but it requires a shared commitment to cybersecurity for a more resilient state, capable of withstanding the evolving cyber threats of the era. Let’s prioritize and invest in cybersecurity, cultivating a culture that defends our critical infrastructure and our way of life.
*Cybersecurity Analyst
