Even a centuries old tradition like the Olympics cannot stave off the effects of digital transformation.

As athletes, teams, businesses and visitors from around the world gather in Pyeongchang this month, technology will be playing a greater role than ever in the games, from the personal devices augmenting viewers' experience to IoT devices integrating into sporting events.

But the ease afforded by technology comes with a tradeoff: a sharp increase in cyberthreats.

The increase in digital endpoints and attack sophistication, coupled with geopolitical tensions swirling around South Korea and the games, has led to virtually unprecedented levels of digital threats.

Olympics of Things

The International Olympic Committee is in the midst of its own digital transformation and currently using a hybrid cloud model to support the games. In January, the IOC named Alibaba Group its official partner for cloud and e-commerce platform services through 2028.

This year, all critical IT systems will be hosted on Atos's cloud, and this will continue through the 2024 Games in Paris, said Marta Sanfeliu, Atos COO for the Olympics and major events, in a company webinar. Atos is a worldwide IT partner for the Olympic Games.

IT operations has a lot of moving parts in the Olympics, from analyzing and delivering real-time results to program and systems management to cybersecurity, and these parts have been steadily shifting over time. The IOC and its partners are working to integrate modern IoT, Big Data, AI, 5G and cloud technologies into front- and back-end systems.

The Winter Olympics will have about 2,000 technology staff — most of which will only come on board within the three months prior to the games kicking off, said Sanfeliu. This presents a distinct challenge for the IOC in ensuring all tech workers are hired, trained and up to speed in time.

But security is complicated by the fact that the IOC does not oversee a unified technology network at the games. The host committee, IOC partners and sponsors and various logistics, support and service groups may each deploy their networks and send a contingent of IT workers to Pyeongchang, creating a complex quilt of digital infrastructure.

As with any big event, 90% of the work should be done beforehand and not during, according to Ben Carr, VP of strategy at Cyberbit, in an interview with CIO Dive. These businesses and groups have been preparing for Pyeongchang for years, but it remains to be seen if it was enough. 

Countries are competing for more than just medals

Security researchers have already pinpointed the execution of sophisticated malware attacks on organizations tied to the games.

The nature of the recently discovered malware suggests a well-funded and well-organized group, and the complexity and rapid deployment of the campaign are hallmarks of a nation-state actor, said Ryan Sherstobitoff, senior analyst of major campaigns at McAfee, in an interview with CIO Dive. McAfee discovered the December malware campaign.

But the direct attribution of the discovered attack, as well as subsequent ones, will be fairly difficult and require concerted effort from intelligence and law enforcement groups as well as the private sector, said Sherstobitoff. This process can take months or even years to be successful.

There may never be confirmation that this was a state-sponsored event, but the worry of nation-state actors behind cybercrime campaigns has been a hot topic this season.

In addition to the tense relationship on the Korean peninsula, many experts have identified Russia as a potential threat as a result of the Olympic ban on the country's athletes. Russia is displeased with the ban and would like to expose other athletes that have twisted rules but are still competing, said Travis Farral, director of security strategy at Anomali, in an interview with CIO Dive.

Nation-state attacks could take many forms, including trying to embarrass South Korea as it hosts the Olympics, trying to give an athlete an edge or targeting another country's representatives at the games, according to Carr.

The growth of IoT devices behind-the-scenes and in sporting events has created a larger attack surface for countries to help their athletes. Events are more instrumented than ever, with IoT devices used to measure every part of an athlete's performance and time.

Interfering with operational equipment, such as shaving a few hundredths of a second off of a timer, has a huge reward factor for nation-state actors looking to shine on the international stage, according to Carr.

Add to these threats smaller malicious actors and hacktivists and the Winter Olympics is a veritable hub for cybercrime.

Beware the cyber pickpocket

The majority of threats are not tied to actors trying to shut down the games as a political statement or cause an international scene, but rather trying to infiltrate networks and systems with a low profile, said Mark Orlando, CTO of cyber services at Raytheon, in an interview with CIO Dive.

And many of these breaches will go unnoticed during the games. It is after individuals with compromised passwords, devices and networks return home that these attacks will be detected, because most threat actors will simply be trying to gain access, avoid detection and extend access past the games, according to Orlando.

There will be a lot of temporary infrastructure in Pyeongchang, and organizations need to ensure networks are properly segmented, said Orlando. If a hacker gets into the public Wi-Fi and it is connected to point of sale systems, the problems will avalanche.

Security best practices, such as encrypting devices, not bringing corporate devices and not connecting to public Wi-Fi, will be very important for all groups attending the games. High-profile business and political visitors will probably face more targeted attacks, but they also need to be wary of what Farral described as "cyber pickpockets" at the games.

These attackers manage to take advantage of people in the wrong place at the wrong time and use weak infrastructure or protocols to steal whatever they can, from passwords to digital wallets. Monitored Wi-Fi networks, spearfishing campaigns and seemingly innocuous devices like a USB could end up compromising both the bumbling tourist and, by a stroke of luck, the visiting dignitaries and businesspeople too.