State-backed cyber attacks target governments, critical infrastructure and ordinary companies. No single tool stops them. Instead, countries and organizations combat cyber warfare with layers of law, cooperation, resilience and good security practice.
This guide explains what works at the national level, then gives practical defences that any organization can apply.
Is cyber warfare covered by law?
Yes, although the rules are still developing. Most states agree that international law, including the UN Charter and the law of armed conflict, applies in cyberspace. The UN has endorsed voluntary norms, such as not attacking critical infrastructure that serves the public. However, there is no binding cyber treaty, and enforcement is weak. Read more in cyberwarfare, law and ethics and cyber arms control.
What nations do
Strategy and institutions
Countries publish national cyber security strategies and create dedicated agencies. India, for example, has CERT-In for incident response, the National Critical Information Infrastructure Protection Centre (NCIIPC) for critical sectors and the Defence Cyber Agency for military cyber operations.
Protecting critical infrastructure
Power, telecom, finance, health and transport need extra protection. Governments set security requirements, run exercises and share threat information with operators.
Deterrence and attribution
States publicly attribute major attacks, impose sanctions and indict operators. As a result, attackers face diplomatic and economic costs.
International cooperation
Alliances share intelligence and coordinate responses. Exercises such as NATO’s Locked Shields test how countries defend together.
What organizations can do
Most businesses will never face a full state campaign directly. Even so, they often become collateral damage or stepping stones. These ten measures make attacks much harder:
- Know your assets. Keep an inventory of systems, data and internet-facing services.
- Patch fast. State groups exploit edge devices such as VPNs, firewalls and email gateways, often within days of disclosure.
- Use phishing-resistant MFA. Protect email, remote access and admin accounts, ideally with passkeys or security keys.
- Segment networks. Separate critical systems, especially operational technology, from office IT.
- Deploy EDR and central logging. Detect unusual behaviour early, and keep logs long enough to investigate.
- Keep offline, immutable backups. Wipers and ransomware cannot destroy what they cannot reach.
- Manage supplier risk. Review the security of critical vendors and software updates. The SolarWinds case study shows why.
- Use threat intelligence. Follow CERT-In and vendor advisories, and act on indicators relevant to your sector.
- Practise incident response. Run tabletop exercises for ransomware, data theft and destructive attacks.
- Train people. Teach staff to spot phishing, social engineering and disinformation.
Zero trust as a guiding principle
Zero trust assumes that attackers may already be inside. Therefore, every access request is verified, privileges stay minimal and activity is monitored continuously. This approach limits how far an intruder can move.
Measuring progress
Track metrics such as MFA coverage, time to patch critical flaws, backup restore success and mean time to detect incidents. Then report them to leadership regularly.
Related guides
Sources
Worried about targeted attacks on your business? Our VAPT services find weaknesses before attackers do, and our OSINT investigations show what is exposed about your organisation online. Contact us for a quote.
Pingback: Cyber Warfare Overview - Youngster Company