It’s not often you get the opportunity to chat with the CISO of a security firm, but when I got Mike Beck from Darktrace in a (virtual) room, the topic of sport came up, given we have back-to-back grand finals on the Australian calendar and not much else to think about during lockdown in Sydney. But what has a sporting event in Australia got to do with cybersecurity? Not much, except that it’s a prime opportunity for cybercriminals to do some decent damage.
Sport Has Always Been A Magnet For Cybercrime
According to Beck, campaigns to phish people are very often built around sporting events, particular the likes of the Olympics where there’s broad international interest.
“When we look back at times where the Russians were called out for kind of widespread doping by the International Olympic Committee – you see a retaliation in cyber… targeting WADA [the World Anti-Doping Agency] and going after the doping agencies to dump out other athlete information,” he recalled.
“And you see that in cyber now across all kind of geopolitical spectrums.”
[related_content first=”978246″]
Cybercrime is a mechanism for actors to retaliate and flex their muscles.
“You’re now preparing to protect [the Olympics] from state actors who might want to cause problems; you weren’t really doing that a couple of games ago,” Beck said.
But there’s also an activist layer – individuals or organisations that just want to make a name for themselves or promote their cause.
Yeah, But Not An AFL Or NRL Grand Final, Right?
If something is happening in the geopolitical sphere that a country doesn’t like, one of their main actions, Beck said, is to use cyber in retaliation.
“We see that in a number of places, but I think sport is increasingly becoming dragged into that space. Because it’s international and has global appeal,” he said.
Australia is splashed all over the global news right now, and a certain nuclear submarine deal might be to blame.
“You’ve got the three heads, they’re standing up and talking about a program to deliver nuclear-powered subs into the region. And there’s that massive geopolitical backdrop to that,” Beck said. “All sorts of people are preparing responses to that across the region.
“Cyber is absolutely one of the tools that could be used, and will be an option for many, many states in terms of how they want to respond to that.”
So while it might seem like the AFL and NRL grand finals are very localised, Beck would argue that in a connected, global world, sport is absolutely seen as a target in terms of retaliation and a sweet spot for cybercrime.
If We Ever Make It Back To A Stadium
That app that allows you to skip a bar line and order beer from your phone? That’s a whole other vulnerability vector itself.
“Sporting events are pop-up in their nature – there might be a couple of big events a year or they’re held at different stadiums,” Beck said.
Stadiums haven’t exactly nailed getting the beers out quickly, because they don’t do it too often, but it shouldn’t be hard, right? You just pour some ready to go. The same applies in the IT and security stack, but they’re not as well drilled.
“Technology goes in very quickly… sporting events are slightly more exposed than other businesses that have a dedicated team day in, day out,” Beck said.
The threat landscape is changing, and nothing is immune from cybercrime, even Aussie sport.