In addition to large-scale infrastructures such as power plants, electrical networks and data centers, smart devices in homes, cooling systems in markets and computers in automobiles can also become targets of cyber attacks.
The cyber attack targeting the cooling systems of many supermarkets belonging to the Intermarche, Netto and Cooperative U chains in France has revived concerns about the security of internet-connected devices and the risks posed by old systems.
As a result of the attack, a lot of fresh and frozen food was destroyed due to the temperatures in the cooling systems rising up to 50 degrees, and a fire broke out in some stores.
The incident demonstrated that cyber attacks against large-scale critical infrastructures as well as smaller systems used in daily life can cause serious physical and economic damage.
The incident in France also revealed the damage that cyber attacks that can be used within the scope of hybrid threats can cause in daily life.
"With the proliferation of connected devices, the importance of cyber security increases"
Özyeğin University Faculty of Engineering and Natural Sciences Head of Computer Engineering Department Prof. Dr. Selim Akyokuş told the AA correspondent that cyber security means protecting computer systems, networks, software, data or digital infrastructures such as data centers against unauthorized access, attacks, damaging attempts and data theft.
Referring to the spread of connected devices within the scope of the Internet of Things (IoT), Akyokuş said, "Nowadays, the importance of cyber security is increasing. One of the reasons for this is the increase in the number of connected devices. It is currently stated that the number of connected devices worldwide is approximately 21 billion." he said.
Akyokuş emphasized that when we look at the incident in France, it is seen that there are connected devices here as well, and that the refrigerators in the markets are managed through a central system, and said:
"Through this central system, the temperatures of the cabinets are monitored and controlled. However, some cyber security vulnerabilities may not have been taken into consideration when connecting these devices to the central system. Because in such systems, the focus is usually on whether the device is working or not. If the refrigerator is working, no intervention is needed. In fact, this approach is valid not only for refrigerators, but also for many electronic devices and machines. As long as the device is working, the system is not touched. In addition, the lifespan of the devices is different from each other. Large industrial cooling systems can be used for 10-15 years. This "Although the systems are managed centrally, there may be various cyber security vulnerabilities and vulnerabilities in the management infrastructures."
"Cyber attacks do not only target the virtual world"
Akyokuş stated that cyber attacks are not limited to events such as crashing a website or unauthorized access to a banking system, but can also be carried out against physical systems.
Underlining that there is a computer in a smart thermostat at home, a robot vacuum cleaner, a machine or a cooling system in a production facility connected to the internet, Akyokuş said, "When we think of a normal computer, it has hardware, operating system and internet connection. Connected devices also have the same features. Therefore, connected devices with vulnerabilities in their operating systems or encryption mechanisms are no different from a normal computer when exposed to cyber attacks." he said.
Akyokuş explained that in cyber attacks, one person can damage a system remotely, but many people must work to repair this damage.
Stating that perhaps millions of dollars of damage may have occurred in the attack in France, Akyokuş said:
"In addition, the attack may have affected not only the relevant companies but also the citizens directly. When people go to the markets, they may not be able to find some products for a few days due to problems in the cooling systems. Therefore, here we see that the cyber attack has physical consequences and affects people's daily lives.
When we evaluate the incident in France from this perspective, we can also think that the purpose of the attack may have been to create a social impact. It may even be aimed to shake the public's trust in the state or the current system. However, we do not know how planned this attack was or what kind of organization was behind it. Therefore, it is necessary to take these possibilities into consideration."
"There may not always be intelligence sharing in cyber security"
Pointing out that certain intelligence sharing is possible between friendly countries in cyber security, Akyokuş said that if a security vulnerability affects everyone, countries can act in line with common interests, but when interests conflict, a country may not share the security vulnerability that affects itself with other countries.
Stating that there is a defense and an attack dimension in cyber security, Akyokuş concluded his words as follows:
"There is a principle called reciprocity in international relations. Therefore, you need to have the skills to respond in case of a cyber attack. In other words, just having defense systems may not be enough. It is important that you have teams and technical capacity to carry out attacks when necessary. Because you may need to show that you have similar abilities in order to deter the other party.
We can compare this to military deterrence. The stronger you are militarily, the more you can deter the other side. A similar situation exists in cyber security. "Having the capacity to respond to an attack against you can be a deterrent factor in preventing the other party from continuing its attacks."
