In this article, Operations Officer, KSA at Obrela Security Industries, Matthaios Zervos (former security manager for the Athens Olympics in 2004) discusses how security attacks on the Olympic events have evolved today.
The Olympics are one of the most widely watched global sporting events, so naturally, they present a huge opportunity for cybercriminals. Cybercriminals are like ‘big game hunters’ searching for a trophy and if they are able to destroy or interrupt the operations of the Olympic Games, this is going to be one of the most visible and noteworthy attacks in cyber history, gaining them significant notoriety and huge bragging rights among their communities.
I worked on the information security team for the Olympic Games in Athens in 2004 as the quality and information security manager. During this time the threat of an attack on our IT systems was a danger we were all prepared for an anticipated daily, but things have changed a lot since then. Back then the term cyber security didn’t really exist, so our biggest concern were information security risks.
Fast-forward to 2021
The Tokyo Olympics have one of the largest attack surfaces ever created and it will have increased 100-fold since the last games. As the world has become more connected and our dependence on technology has increased, avenues to attack the Olympics have also grown significantly. Back then I was on high alert, sleeping on my office floor three or four hours a day, if I was lucky. But times have changed a lot since then and I doubt the new Olympics cyber security team are getting any sleep at all.
The main objective of any attack during the Olympic Games is to damage the image of the Organising Committee through either obtaining access to confidential records (e.g. medical, accommodation, travel, etc), or through manipulation of results, or even just to create a chaotic situation. This without taking into account the cyber-attacks which may have a terrorist attack objective.
In 2004, the biggest threats were cyber-attacks on any of our key systems, including the Games Management System, Information Diffusion System, Timing and Scoring Results System, or our Admin network at the A2004 HQ, or indeed any cyber-attack on a combination of these. Due to the design of the networks and the measures that were taken, we did not encounter any real threats, except for one attack which we experienced during the very first day. However, it was immediately identified and remediated through our Technology Operations Centre and dealt with in real time.
Today however cybercriminals are becoming more sophisticated, and threats have therefore become far more challenging. The technology nevertheless is also evolving and therefore it is of crucial importance that the current Organising Committee of the Olympic Games perform regular Risk Assessments of its systems, people and facilities. In addition to this, making sure that all systems and devices connected to the Olympic Network are patched and up to date with the latest software is also vital. Any unmonitored system or device is a potential entry point for a cybercriminal.
While people might be under the assumption that because the Olympics have no in-person spectators, attacks could decrease, but this isn’t necessarily the case. If the objective of the cybercriminals is damaging the image of the Organising Committee, I cannot foresee any reduction. From a terrorist perspective this could be the case, nevertheless, given the low number of spectators, such an attack may become even easier should security and safety measures are relaxed.
Think BIG to secure BIG
When it comes to securing the Olympics, organisers really need to think big and scale to meet the size of the event. Things have changed a lot since 2004, the online world has grown and the attack surface has also expanded. This has created more opportunities for cyber criminals to succeed and unfortunately more opportunities for Olympic Games organisers to fail. Because of the size and openness of the target, the Olympics makes a very complex target to protect, but it is definitely not impossible.
The most important issue is to understand the different types of attacks that could impact the Olympics and prioritise security according to which poses the greatest risk. Security hygiene best practices are also very important as this will ensure the Olympic network is up to date with the latest patches and software. However, because attacks are inevitable today, having a remediation plan on how to act when one does take place is also essential.
The Olympic Games will always be a high-value target for cybercriminals and as the event relies more heavily on technology, we make it easier for attackers. However, by thinking big and scaling to meet the events needs as it grows, we can remain one step ahead.
