🌍 General Cybersecurity & Geopolitics FAQs

What is cybersecurity in the context of geopolitics?

Cybersecurity in geopolitics refers to how nations, non-state actors, and corporations use (or defend against) digital tools to influence global power dynamics. This includes espionage, sabotage, disinformation, and economic coercion conducted through cyber means.

Why has cybersecurity become a geopolitical issue?

Because cyber operations allow nations to project power without kinetic warfare. They enable:

✔ Espionage (stealing secrets, intellectual property)

✔ Sabotage (disrupting critical infrastructure)

✔ Influence operations (manipulating elections, public opinion)

✔ Economic coercion (using ransomware or sanctions evasion)

✔ Military support (hybrid warfare, as seen in Ukraine)

How do cyberattacks compare to traditional warfare?

What are the most common types of state-sponsored cyberattacks?

State actors typically use:

• Espionage (e.g., China’s APT10 stealing intellectual property)
• Sabotage (e.g., Russia’s NotPetya wiper malware)
• Disinformation (e.g., Russia’s IRA troll farms)
• Critical Infrastructure Attacks (e.g., Iran’s attack on Israeli water systems)
• Supply Chain Attacks (e.g., SolarWinds hack by Russia’s SVR)
• Ransomware (as a proxy) (e.g., North Korea’s Lazarus Group funding missile programs)

Which countries are the biggest cyber threats?

Based on capabilities, frequency, and impact, the top state actors in 2026 are:

• China: Their main focus is on espionage, Intellectual Property theft, and AI/quantum dominance. Key actors include APT10, Volt Typhoon, APT41. Main targets are US, EU, Japan, Australia
• Russia: Their main focus is on hybrid warfare, disinformation, energy sector disruption and election interference. Key actors include Sandworm, APT29 (Cozy Bear), Turla. Key targets include Ukraine, NATO, US, UK and EU elections
• Iran: Their main focus is on asymmetric retaliation, chiefly targeting critical infrastructure in countries they perceive as adversaries. Their main actors include APT35 (Charming Kitten), APT34 (OilRig), chiefly targeting Israel, Saudi Arabia, US and her Gulf allies.
• North Korea: Their main focus is on financial cybercrime, and sanctions evasion. Key actors include the Lazarus Group, and APT38, who chiefly target banks and cryptocurrency exchanges.
• United States: Their main focus is on offensive cyber operations, and critical infrastructure defence. Key actors include the NSA’s Tailored Access Operations (TAO) and Cyber Command, with the main focus being on China, Russia, Iran, and North Korea, and increasingly NATO allies.
• Israel’s main focus is on offensive cyber capabilities and intelligence gathering. Their main actor is the Israel Defence Force’s Unit 8200, chiefly targetting Iran, Syria, and Hamas and nations opposed to their actions in Palestine, Syria and Lebanon.

How do non-state actors (e.g., hacktivists, cybercriminals) influence geopolitics?

• Hacktivists (e.g., Anonymous, Killnet) disrupt governments and corporations for political or ideological reasons.
• Cybercriminals (e.g., LockBit, Conti) steal data and extort money, sometimes with tacit state support (e.g., Russia’s tolerance of ransomware groups).
• Cyber mercenaries (e.g., NSO Group, DarkMatter) sell hacking tools to governments, enabling surveillance and oppression.

What is hybrid warfare, and how does cyber fit in?

Hybrid warfare blends conventional military tactics with cyberattacks, disinformation, economic coercion, and political subversion. Cyber operations play a critical role by:

• Disrupting communications (e.g., Viasat hack in Ukraine, 2022)
• Spreading disinformation (e.g., fake surrender videos in Ukraine)
• Sabotaging infrastructure (e.g., Ukrainian power grid attacks, 2015 & 2022)
• Stealing intelligence (e.g., Russian hacking of NATO documents)

Example: Russia’s invasion of Ukraine (2022–present) has seen cyberattacks, drone strikes, and propaganda used simultaneously.

🛡️ Cybersecurity Threats & Defences FAQs

What is an Advanced Persistent Threat (APT)?

An APT is a sophisticated, long-term cyberattack typically sponsored by a nation-state or organised criminal networks. Unlike opportunistic hackers, APT groups:

✔ Infiltrate networks stealthily (often via phishing or zero-day exploits)

✔ Remain undetected for months/years (using living-off-the-land techniques)

✔ Exfiltrate data or sabotage systems (e.g., intellectual property, military secrets) Examples: China’s APT10, Russia’s APT29 (Cozy Bear), Iran’s APT35.

How do ransomware attacks work, and why are they so effective?

Ransomware attack lifecycle:

1. Initial Access (e.g., phishing email, unpatched vulnerability)
2. Lateral Movement (spreading through the network)
3. Data Exfiltration (stealing sensitive files for double extortion)
4. Encryption (locking files with AES-256 or RSA encryption)
5. Ransom Demand (typically in Bitcoin or Monero)
6. Negotiation/Payment (or data leak if unpaid)

Why they’re effective:

• Low risk, high reward (attackers can extort millions with minimal investment)
• Difficult to trace (cryptocurrency payments are pseudonymous)
• Double extortion (threatening to leak stolen data if ransom isn’t paid)

Notable Examples:

• WannaCry (2017) – £4 billion in damages, attributed to North Korea’s Lazarus Group.
• Colonial Pipeline (2021) – £4.4 million ransom paid to DarkSide group.
• Kaseya (2021) – REvil ransomware infected 1,500+ businesses via a supply chain attack.

What is a zero-day exploit, and why is it so dangerous?

A zero-day exploit is a cyberattack that targets a previously unknown vulnerability in software. Since the vendor has zero daysto patch it, these attacks are highly effective and difficult to detect.

Why they’re dangerous:

• No defence exists (until a patch is released).
• Highly valuable (sold on the dark web for £100,000–£1M+).
• Used by nation-states (e.g., NSA’s EternalBlue, China’s exploitation of Microsoft Exchange).

Famous Zero-Days:

• EternalBlue (used in WannaCry & NotPetya)
• Log4j (2021) – One of the most severe vulnerabilities ever, affecting millions of systems.
• Follina (2022) – Microsoft Office zero-day used by Chinese APT groups.

What is a supply chain attack, and how can businesses protect against it?

A supply chain attack targets a third-party vendor or supplier to infiltrate a primary target’s network.

How it works:

1. Attacker compromises a trusted vendor (e.g., software provider, cloud service).
2. Malicious code is inserted into updates or services.
3. Primary target downloads/installs the compromised software, giving attackers access.

Notable Examples:

• SolarWinds (2020) – Russian SVR hackers inserted malware into SolarWinds’ Orion software, affecting 18,000+ customers, including US government agencies.
• Kaseya (2021) – REvil ransomware spread via a Kaseya VSA software update.
• 3CX (2023) – North Korean hackers compromised a VoIP software update, targeting cryptocurrency firms.

How to Protect Against Supply Chain Attacks:

✔ Vet third-party vendors for security practices.

✔ Monitor for unusual activity in vendor networks.

✔ Use multi-factor authentication (MFA) for all external access.

✔ Implement network segmentation to limit lateral movement.

✔ Regularly audit and update all third-party software.

How does AI impact cybersecurity, both offensively and defensively?

AI in Cybersecurity: Offensive vs. Defensive Applications

Why AI is a Game-Changer:

• Speed & Scale: AI can analyse millions of data points per second, enabling faster attacks and defences.
• Adaptability: AI-powered threats evolve in real-time, making them harder to detect.
• Human-Like Interaction: Deepfakes and AI chatbots can trick even trained professionals.

Real-World Examples:

• Offensive: 2025 AI-Powered Phishing Campaign – A deepfake of a UK bank CEO tricked employees into transferring £15 million (BBC, 2025).
• Defensive: Google’s AI Cyber Defence – Uses machine learning to block 99.9% of phishing emails before they reach users.

What is quantum computing, and how will it affect cybersecurity?

Quantum computing uses quantum bits (qubits) to perform complex calculations exponentially faster than classical computers.

Impact on Cybersecurity:

✅ Breaking Encryption:

• Shor’s Algorithm can crack RSA and ECC encryption (used in HTTPS, VPNs, Bitcoin).
• Estimate: A fault-tolerant quantum computer could break 2048-bit RSA in ~8 hours (NIST, 2026).

✅ Quantum-Resistant Cryptography (PQC):

• NIST’s Post-Quantum Cryptography Standardization (2024–2027) is developing new encryption methods (e.g., Lattice-based, Hash-based, Code-based cryptography).
• Migration Challenge: Upgrading global infrastructure to PQC will take years, leaving a vulnerability gap.

✅ Quantum Key Distribution (QKD):

• Unbreakable communication (e.g., China’s Micius satellite).
• Limitation: Expensive and limited range (currently ~100–500 km).

Timeline for Quantum Threats:

What Should Organizations Do?

✔ Monitor NIST’s PQC standards and begin migration planning.

✔ Inventory cryptographic systems to identify vulnerable encryption.

✔ Adopt hybrid encryption (classical + post-quantum) for critical data.

What is the Internet of Things (IoT), and why is it a cybersecurity risk?

IoT refers to physical devices connected to the internet (e.g., smart thermostats, industrial sensors, medical devices).

Why IoT is a Cybersecurity Risk:

• Weak Default Security: Many IoT devices ship with default passwords (e.g., “admin/admin”).
• Lack of Updates: Few IoT devices receive security patches (e.g., 2023: 75% of IoT devices had unpatched vulnerabilities IoT Security Foundation).
• Botnet Recruitment: Hackers hijack IoT devices to create botnets (e.g., Mirai botnet, which took down Twitter and Netflix in 2016).
• Critical Infrastructure Exposure: Smart grids, water systems, and healthcare IoT are prime targets for state-sponsored attacks.

Notable IoT Cyberattacks:

• Mirai Botnet (2016) – 600,000+ IoT devices used in a DDoS attack on Dyn DNS, causing major internet outages.
• St. Jude Medical Pacemakers (2017) – Vulnerabilities allowed hackers to remotely control pacemakers.
• Colonial Pipeline (2021) – Compromised IoT sensors helped attackers gain network access.

How to Secure IoT Devices:

✔ Change default passwords to strong, unique credentials.

✔ Segment IoT networks from each other and from critical business systems.

✔ Disable unnecessary features (e.g., remote access, UPnP).

✔ Regularly update firmware (if possible).

✔ Use IoT-specific security solutions (e.g., Zingbox, Nozomi Networks).

What is zero-trust architecture, and why is it important?

Zero-trust architecture is a security model that assumes every access request is a potential threat and verifies identity and permissions before granting access.

Core Principles of Zero Trust:

1. Never Trust, Always Verify – No implicit trust, even for users inside the network.
2. Least Privilege Access – Users get only the access they need (e.g., no admin rights for non-IT staff).
3. Micro-Segmentation – Divide networks into small, isolated segments to limit lateral movement.
4. Continuous Authentication – Re-authenticate users based on behaviour, location, and device health.
5. Assume Breach – Monitor for anomalies as if the network is already compromised.

Why Zero Trust Matters:

• Traditional perimeter-based security (firewalls, VPNs) is obsolete in the cloud and remote work era.
• 90% of breaches involve stolen credentials (Mandiant, 2026) – Zero-trust stops attackers from moving laterally.
• Compliance Requirements: NIS2, CISA, and GDPR now recommend or mandate zero-trust models.

Real-World Adoption:

• Google’s BeyondCorp – Eliminated VPNs in favour of zero-trust access.
• US Government’s Zero Trust Strategy (2024) – All federal agencies must adopt zero-trust by 2027.
• Microsoft’s Zero Trust Framework – Used by 80% of Fortune 500 companies.

What are the biggest cybersecurity threats to critical infrastructure?

Top 5 Threats to Critical Infrastructure (CI) in 2026:

Most Targeted Critical Infrastructure Sectors (2026):

1. Energy (Electric Grids, Oil & Gas) – #1 target for state-sponsored attacks.
2. Healthcare – Ransomware attacks disrupting hospitals (e.g., 2025 NHS cyberattack).
3. Financial Services – SWIFT hacks, cryptocurrency theft (e.g., Bangladesh Bank heist, 2016).
4. Transportation – Ports, airlines, railways (e.g., 2024 Maersk ransomware attack).
5. Water & Wastewater – SCADA system attacks (e.g., 2021 Florida water treatment hack).

Why Critical Infrastructure is a Prime Target:

• High Impact: Disrupting power, water, or healthcare can cause panic and economic damage.
• Legacy Systems: Many CI systems run on outdated software (e.g., Windows XP in power plants).
• Lack of Cybersecurity Investment: Only 10% of CI operators have dedicated cybersecurity teams (SANS Institute, 2026).

How do international laws and treaties address cybersecurity?

Key International Cybersecurity Frameworks:

Why Alliances Matter in Cybersecurity:

Deterrence: Collective defence (e.g., NATO Article 5) discourages large-scale cyberattacks.

Threat Intelligence Sharing: Real-time data on attacks helps prevent or mitigate breaches.

Offensive Capabilities: Coordinated cyber operations (e.g., Stuxnet, 2010) can disrupt adversary activities.

Norm Setting: Alliances push for global standards (e.g., NATO’s cyber norms).

Limitations:

Sovereignty Concerns: Some nations (e.g., France, Germany) resist full NATO cyber integration.

Asymmetric Threats: Adding cyber capability to traditional warfare has a “more than the sum of the parts” quality to aggression as it can be used to distract from, or enhance the impact of kinetic attacks.

Resource Disparities: Smaller alliance members lack the cyber capabilities of larger nations (e.g., Luxembourg vs. US Cyber Command).