On July 19, 2021, the Federal Bureau of Investigations issued a Private Industry Notification to service providers and “entities associated with the Tokyo 2020 Summer Olympics that cyber actors who wish to disrupt the event could use distributed denial of service (DDoS) attacks, ransomware, social engineering, phishing campaigns, or insider threats to block or disrupt live broadcasts of the event, steal and possibly hack and leak or hold hostage sensitive data, or impact public or private digital infrastructure supporting the Olympics.”
According to the Notification, “Malicious activity could disrupt multiple functions, including media broadcasting environments, hospitality, transit, ticketing, or security.”
The Notification points out that large events attract extra attention from cybercriminals and nation-state actors such as the attacks during the 2018 PyeongChang Winter Olympics. The FBI indicted Russian-based actors for intrusions during the Winter Olympics, including one that disrupted the Opening Ceremony.
The FBI encourages “service providers and other relevant partners to maintain business continuity plans to minimize essential service interruptions, as well as preemptively evaluate potential continuity and capability gaps…the FBI encourages regularly monitoring networks and employing best practices.” The Notification then provides details on what those best practices are.
Frankly, the list of best practices provided by the FBI are best practices for all companies, including those supporting the Tokyo Olympics.