Supreme Committee for Delivery & Legacy defends World Cup Qatar 2022 against cyberthreats with Palo Alto Networks Unit 42

Argentina’s nail-biting penalty shoot-out victory over France at the Lusail Stadium in December 2022 brought the curtain down on a phenomenally successful World Cup Qatar 2022. More than 1.5 million fans attended and five billion watched the showcase tournament in the Middle East.

The Supreme Committee for Delivery & Legacy was established by the State of Qatar in 2011 to deliver this global sporting event, which included provisioning and operating the event’s eight stadiums, infrastructure, accommodation, and transport.

That focus extended to the tournament stadiums’ state-of-the-art cybersecurity infrastructure, spanning everything from over 80,000 endpoints and stadium Wi-Fi, to internet of things (IoT), industrial control systems, and more. Supreme Committee for Delivery & Legacy’s primary goal was to set a new standard in World Cup infrastructure – at every level. And it was a goal the Supreme Committee for Delivery & Legacy embraced with enthusiasm.

The Supreme Committee for Delivery & Legacy took the early decision to standardise on the comprehensive, unified Palo Alto Networks portfolio to underpin stadium cybersecurity at World Cup Qatar 2022. The portfolio spanned network, endpoint, and cloud security to drive simple, automated, and intelligent cybersecurity.

The global scale of the event made it a high priority target for ransomware, state-sponsored attacks, and threat actors looking to disrupt the games. The Supreme Committee for Delivery & Legacy needed a trusted advisor to help assess and test these security controls and ensure the stadium security strategy adopted a threat-informed approach to be ready for any attempt to disrupt the experience. Moreover, in the unlikely event of an incident occurring during the tournament, to have cybersecurity experts ready and available to respond to any threat, in record time, and contain the incident.

“As the host of the World Cup Qatar 2022, this was a unique opportunity for Qatar to showcase innovative, integrated security technologies across our stadiums, to deliver a safe, smart, and exciting tournament,” says Niyas Abudlrahiman, Executive Director – Tournament ICT, Supreme Committee for Delivery & Legacy. “Our overriding priority was to partner with experts and respond with confidence should anything happen. Ultimately, we wanted to proactively manage and be prepared for every type of cyber risk and minimize that risk at our stadiums before it could disrupt the customer experience.”

The Supreme Committee for Delivery & Legacy partnered with Unit 42 to provide strategic analysis and guidance on its cybersecurity strategy and incident response plan. A team of Unit 42 threat researchers, incident responders, and security consultants worked collaboratively with the Supreme Committee for Delivery & Legacy to assess and test security controls across three dimensions.

• Unit 42 Compromise Assessment: A 15-strong Unit 42 team proactively searched for historical and ongoing indicators of compromise to discover if any previously undetected malicious activity had occurred. The collection and analysis of data at scale underpinned a deep dive into any impacted systems, with defences being strengthened where necessary.
• Unit 42 Security Program Design and Review: Unit 42 helped Supreme Committee for Delivery & Legacy assess, identify and prioritise their risks unique to the Games across the stadiums covering people, process and technology to build a strategic roadmap to guide security program goals, objectives and projects to discover potential compromises, understand the impact, and provide mitigation recommendations. Data mining, for example, was used to quantify sensitive data at risk as a result of a data breach, including personal health information (PHI), personally identifiable information (PII), payment card industry data (PCI) data.
• Incident Simulation and Testing: Unit 42 performed penetration testing and Purple Team exercises to simulate real-world attack scenarios unique to the World Cup Qatar 2022 stadiums. By mirroring the latest tools and tactics used by threat actors and Unit 42 Threat Research, the 15-strong team of experts was able to test, detect, and eliminate any existing vulnerabilities. This included IoT security cameras and digital stadium signage. Three types of penetration testing were typically performed: an external user with no footprint, a low privilege user, and a user with complete access attempting to compromise the systems. Purple Team Exercises were also undertaken to identify alerting gaps, tune defences, and enhance security operations best practices.
• Incident Response: Staying ahead of advanced threats required Supreme Committee for Delivery & Legacy to partner with an elite incident response team with access to world-class threat intelligence in the event of a cyber incident. Unit 42 Incident Response experts worked with the Supreme Committee for Delivery & Legacy team to be ready for and understand the nature of the attack and then quickly contain, remediate and eradicate it using a proven methodology and battle-tested tools developed from our real-world experience investigating thousands of incidents.

According to Kamran Shah, Manager, Information Security, Supreme Committee for Delivery & Legacy, “Threat intelligence is embedded throughout the Palo Alto Networks portfolio. The experienced team from Unit 42 worked as one to help design, build, and operate the World Cup Qatar 2022 stadium cybersecurity program. Palo Alto Networks experience, expertise, and technology played a vital role in the delivery of a robust and resilient security architecture and strategy across the stadiums to ensure a smooth delivery of tournament. Palo Alto Networks was one of the most important partners for World Cup Qatar 2022.”