For the most part, experts agree that the cost of maintaining a cyber warfare operation will go down as time goes on. Where they begin to disagree is in whether these costs will drop to a degree that would allow non-state actors like ISIS to get in on the act. With that said there are a few key factors to consider when talking about the cost involved in maintaining an ongoing cyberattack.
Like in most industries, the most obvious cost is labor and like with any task the more you do it the more efficient you become. Hackers learn from each attack and learn from their mistakes. This means that as time goes on those fewer mistakes in their coding and increased efficiency is time not wasted. For example, when the Iranian Shamoon virus was launched and wiped out 30,000 of Saudi Aramco’s computers in 2012, there were at least 4 glaring and fatally significant coding errors. Subsequent Iranian malware attacks lack these mistakes and are overall more carefully designed.
One of the things that has begun to emerge in malware development is a sort of standardization of exploits and toolkits that work in a module-like system. This allows an attacker to take the tools they need and tailor them for a specific job. This allows there to be 133 different teams working under US Cyber Command with the ability to perform specialized tasks. Consequently, this ease of use also means that it’s easier to reuse hacking tools that work and modify those that don’t. If you’re a cyberterrorist group that means you get more out of the time and money you put into each attack. Russia used very similar techniques when invading the Ukraine.
For a group (state-sponsored or otherwise) to have an effective cyber warfare plan, it involves constantly updating their weapons. With the more traditional tools of war their effectiveness tends to slowly go down with time as other technologies are developed. Cyber weapons tend to lose their effectiveness immediately. Patching vulnerabilities means one minute it works and the next it doesn’t. To be consistently effective an attacker needs to be able to constantly produce tools and techniques so that once one becomes obsolete, the next is immediately ready for launch. That sort of production can take up a significant amount of time and resources.
Unfortunately, most breaches could be avoided by having patched the system. The good news is that companies and organizations are beginning to realize the threat cyberwarfare plays, so even the increase we’re seeing in patching and companies installing firewalls is something. The use of two-factor authentication is even becoming more common. Additionally, this awareness not only means that IT security professionals are sharing information among themselves, but it’s spreading to other areas with management getting involved as well.