Rob Fitzsimons, Field Application Engineer at Telesoft Engineering, talks to us about the importance of cybersecurity when planning and executing the Qatar 2022 World Cup.
INTRODUCTION
Expectations run high during international tournaments such as the FIFA World Cup. Every team is under intense pressure to perform in front of a global audience. But this pressure is nothing next to that felt by the host nation which, for four weeks, will have the eyes of the world on its stadia and wider infrastructure.
In addition to delivering a fair and enjoyable competition, the host must ensure the safety of fans, players and staff. And in today’s digital age, where large groups of people are connected to the world via smartphones, tablets and laptops, there are endless opportunities for determined cyber attackers to wreak havoc, destabilise or even bring disgrace to the beautiful game.
With so many people descending on one country from all over the globe, the World Cup itself is at risk from a wealth of potential threats. What’s more, the location of the next World Cup – Qatar – brings with it a number of additional political and industrial factors to consider. Cybersecurity at such a prestigious event must be considered as much a priority as physical security.
HUGE ATTACK SURFACE
Qatar is expecting in the region of 1.5 million visitors to arrive in the country for the 2022 FIFA World Cup. Numbers of this size represent a huge attack surface, however, and – given the relatively high costs of travelling to, staying in, and generally making the most of what the country has to offer – attackers are likely to see these visitors as high value targets.
It’s highly likely, therefore, that criminals will carry out personal attacks on visiting football fans via their digital devices. By using techniques such as phishing and social engineering, they will attempt to steal personal or financial information which can either be used again to carry out subsequent attacks or sold on the black market for a profit. Unsecured open Wi-Fi connections can be “spoofed”, tricking users into connecting to them using their personal details. Alternatively, clicking on malicious links in fraudulent World Cup-related promotional emails can send fans to specially created websites where, once again, they may unknowingly hand their personal information over to criminals.
Events on the scale of the World Cup are also subject to more disruptive attacks, focused more on destabilising the event itself as opposed to impacting individual targets. Its importance as an oil and gas producer, as well as ongoing political tensions with its neighbours – Saudi Arabia, Bahrain and the UAE – means Qatar could be vulnerable to state attacks, carried out for political reasons to destabilise or embarrass the country’s ruling regime. Overwhelming significant parts of the country’s internet with a distributed denial of service (DDoS) attack, for example, could prove hugely awkward at a time when most of the world is watching.
INTELLIGENCE AND INSIGHT
Qatar is taking cybersecurity very seriously. Although the next FIFA World Cup is still three years away, measures are already being put in place to protect visitors and national infrastructure against cyber-attacks.
In March, the country’s Supreme Committee for Delivery and Legacy hosted a summit of cybersecurity experts from around the globe with a view to exploring the range of cyber threats faced by large sporting events. This builds on the Ministry of Transport and Communications’ launch, a month earlier, of the National Information Security Standards Framework, aimed at standardising the cyber security capabilities of software, systems and services provided by international suppliers.
Underpinning all of this is Interpol’s Project Stadia, a 10-year initiative aimed at enhancing policing and security for the 2022 World Cup. The project brings together insights and intelligence from experts on everything from the internet of things and industrial control systems, to national cyber security capabilities, cyber security risk management, and cybersecurity operations for venues. According to Falah Al Dosari, senior project manager at Project Stadia, “better understanding the global threat environment and its implications is vital for nations hosting future major events.”
Indeed, a continuous flow of real-time threat intelligence in advance of and throughout the tournament will provide a greater understanding of the potential threats, and enable security professionals to better defend against them. Recognising where vulnerabilities lie, and addressing these accordingly, will allow better protection of mobile networks, and help protect against targeted attacks. This way, unsuspecting users are less likely to be caught out by hackers intent on stealing their personal information. And, by monitoring and controlling the flow of information across these networks, it’s possible to reduce the likelihood of more widescale attacks.
An event the size and scale of a World Cup represents rich pickings for the criminally inclined, with millions of visitors seen as millions of potential victims. It is the responsibility of the host nation to ensure the safety and security of its guests – both physically and digitally. Fortunately, Qatar is ahead of the game. The wealth of intelligence, insight and expertise the country is tapping into will go a long way in ensuring security at the 2022 World Cup is no match for cyber-criminals.
