Nation states: patient, well funded, and usually not after you directly

What they want

• Espionage: government and defence information, negotiating positions, research.
• Intellectual property: designs, formulas, pricing, anything that saves their own industries years of work.
• Pre-positioning: quiet access to critical infrastructure (power, water, telecommunications, ports) that could be used for disruption later.
• Influence: information leaked or altered at a politically useful moment.

Why a small business is on their map

Nation states rarely need to attack their real target head-on. They go through the supply chain: the smaller organisations that have access to the big one.

The clearest example is SolarWinds (2020). Attackers compromised the build process of a widely used network-management product, so that a legitimate software update carried their backdoor into thousands of organisations, including US government agencies. The US government attributed the operation to Russia's foreign intelligence service.

In 2020 the Australian government publicly warned that a state-based actor was targeting Australian organisations across government, industry, education, health and critical infrastructure. The advice that followed was not exotic: patch promptly and use multi-factor authentication, because that was how the attacker was getting in.

If you supply, service or hold data for a government agency, a defence contractor, a utility, a hospital or a large company, you are part of that target's attack surface, whether or not anyone has told you.

How they operate

• They research their targets and their suppliers thoroughly.
• They "live off the land": they use the legitimate administration tools already on your network, so nothing looks like malware.
• They stay quiet. The aim is long-term access, not a ransom note.
• They exploit newly published vulnerabilities fast, sometimes within days of a patch being released, because they know many organisations patch slowly.

Effort to defend: very high, so aim for the right goal

A determined nation state with your name on a list is very hard to stop. But that is rarely the situation. The realistic goal for most organisations is to not be the easy stepping stone into a client or partner.

That comes down to the same basics, done consistently:

• Patch internet-facing systems quickly.
• MFA everywhere, especially on remote access and email.
• Know what you hold: which clients' data, logins or remote access you have, and remove what you no longer need.
• Keep logs, and keep them long enough to look back months, not days.
• Separate your access to clients' systems from everyday accounts.
• Ask the same of your own suppliers.

In Australia, the ASD's Essential Eight is the baseline, and its higher maturity levels are aimed at more capable adversaries like these.