エピソード

  • Attackers don’t hack in: They log in with your credentials

    Attackers don’t hack in: They log in with your credentials
    2021/12/08
    It is a truism: cyber attackers take the path of least resistance. While enterprises spend millions in malware signature detection and sandbox execution, endpoint detections, threat indicators, vulnerability assessments and scans, proxies and firewalls, none of these defend against the path of least resistance — compromised credential attacks. Why is this the path of least resistance? And how can we better protect this attack vector? The path of least resistance To the first question, excuses vary. Some say it’s a security training issue; others regard it as a “personal security hygiene” issue for employees. Still, others consider it an IT problem rather than ops (or vice versa). Moreover, sometimes senior leaders are permitted special password policy exceptions — even though they’re the most sought-after targets. The bottom line: no one wants to take responsibility for credential theft. And this patchwork of responses and philosophies offers attackers massive gaps to exploit via social engineering, like simple phishing, or other means, to acquire legitimate credentials to access a network, then move laterally to find and extract the information they want. This is exponentially easier than deploying a zero-day remote code execution (RCE), a vector existing tools can identify readily. We live in a world of ignored credential proliferation, and we’re paying the price. The 2020 Verizon Data Breach Investigation Report claims that over 80% of hacking-related data breaches involve brute force or the use of lost, stolen or compromised passwords. The FBI reported in 2020 that 41% of attacks in the financial sector involved credential-stuffing. Crowdstrike’s 2020 Global Threat Report reveals that most attacks don’t involve any malware and identified credential dumping as one of the most prevalent alternative attacks used. These attacks are challenging to identify and intercept reliably using vulnerability scanners, endpoint detections, SOAR, SIEM, BAS tools or most manual penetration tests. In a world where 61% of companies have over 500 accounts with non-expiring passwords and where 10 billion account details, along with 600 million passwords, are available online due to known breaches, it is clear that credential-based attacks are a favorite for malicious actors. Why? Quite simply, they’re easy to get and difficult to identify as a threat. So, what do we do to protect against this attack vector? Vulnerable does not equal exploitable I always say, “The hardest part of cybersecurity is knowing what not to do.” The key to this statement is an understanding that vulnerable does not equal exploitable. Security teams need to be able to identify the vulnerabilities that present the most risk. Scanners and other tools reveal an overwhelming number of vulnerabilities — more than can be patched by even the most active security team working around the clock. The key instead is to focus on those attack vectors relevant to an attacker. By focusing on the changing techniques an attacker uses with harvested credentials, technical misconfigurations and exploitable software vulnerabilities regardless of CVSS score, teams can evaluate attack vectors with operational context based on the adversary’s perspective. This approach allows security teams to identify vulnerabilities that are actual threats. You might be surprised to hear that the vast majority of vulnerabilities are unexploitable. According to Kenna, only 2.7% of identified vulnerabilities are exploitable, and only 0.4% of those have actually been exploited. Of course, the impact of those breaches can be massive. That’s why it’s crucial to focus on those areas that are operationally relevant to attackers themselves. While software vulnerabilities subsume most of the conversation in information security, only a tiny percentage of breaches ever leverage them, peaking at just 5% of breaches in 2017. More recent numbers indicate a rate reaching half that number. Traditional approaches of using...
    続きを読む 一部表示
    5 分
  • Red teaming: Is it the career for you?

    Red teaming: Is it the career for you?
    2021/09/09
    To best protect an organization from would-be-attackers, proactively probing their security measures is an approach fast growing in popularity. Simulating attacks is the job of red teams, and the goal is to find and fix weaknesses before hackers can exploit them. Red team members are ethical hackers hired by an organization to carry out real-world, advanced attacks. The work is worth considering if you’re a cybersecurity pro looking to make a distinct difference for organizations making a concerted effort to keep bad actors out. Red teaming includes “an element of breaking in and legally doing as much as you can under the radar, and that’s pretty fun,” says Curtis Brazzell, managing cybersecurity consultant with GuidePoint Security. What is red teaming? The National Institute of Standards and Technology (NIST) defines red teams as groups of people authorized and organized to emulate a potential adversary’s attack or exploitation capabilities against an enterprise’s security posture. Their objective is to improve enterprise cybersecurity by demonstrating the impacts of successful attacks. They often work together with blue teams, which are a separate group of incident responders charged with defending against the simulated attacks instituted by the red team in a way that represents the organization’s current security posture. Both teams hope to demonstrate how a hacker might get in, the impact and how well security defenses can withstand an attempted attack. In recent years, the concept of purple teams has also risen to the surface. A purple team can be a separate group of people, usually outside security consultants, who oversee red teams and blue teams. A single purple team might perform the functions of both red and blue teams or represent the need for integration between red team testing and blue team defenses. What does a red team member do? Most commonly, blue teams usually consist of security experts internal to the organization. On the other hand, red teams are hired as outside consultants who come in and conduct comprehensive security assessments using simulated cyberattacks. While their tactics likely include a penetration test, their work represents a broader scope that often addresses physical security considerations, employee understanding and network and endpoint vulnerabilities. Red team exercises are ideally done after initial pentests have already been conducted and applicable fixes applied. “A lot of guys on the team are lock pickers, or maybe you use RF (radio frequency) badge scanners,” Brazzell says of how their firm engages in red teaming. “Once inside, we see if maybe you can plug into an open port in a lobby, and then you analyze the wireless traffic. Maybe then we notice the local LAN isn’t segmented from the public, wireless LAN. Physical USB-type attacks, or Rubber Duckies as we like to call them, we’re still doing too, to see if we can’t compromise at least one workstation and then move laterally.” Critically crucial to every red team member is comprehensive security testing using tips and tricks they’ve learned over the years, along with buy-in and the necessary permissions from the organization’s upper management. Without permission, strategies become less ethical hacking and more criminal. With red teaming, “you really have to approach your objectives as an adversary would,” says Amyn Gilani, chief growth officer at Countercraft. “Of course, you also need to make sure you’re sponsored by the correct entities so you don’t get into trouble when you do break something or gain access to something that you shouldn’t have.” Another common component of red teaming is performing “tabletop exercises” together with the organization’s employees. In the exercise, a simulated cyberattack is executed, and then red team members can work with various areas of the organization on how to best handle the scenario. This includes the incident response team and designees from the organization’s legal, human resource...
    続きを読む 一部表示
    6 分
  • Cyber risks of digitizing legacy systems in healthcare environments

    Cyber risks of digitizing legacy systems in healthcare environments
    2021/09/06
    The news is full of reports of vulnerabilities discovered in medical devices. Many of them are quite terrifying. Who can forget the first time they heard that a pacemaker could be hacked — or of the data breaches resulting from these vulnerabilities or misconfigurations. Similarly, all processes involving healthcare data digitization are currently in play. Because the hospital is the playing field on which many of these processes come together, it’s the best place to start looking at some of the security implications for our secure medical data. Some of the more prevalent considerations follow. Processes that generate PHI data Many types of hospital processes generate a large amount of Protected Health Information, or PHI, data. The largest sources that generate and process PHI are Radiology, Patient Monitoring, Medication Management, Surgery, Diagnostics and (Electronic) Medical Records. Each process itself has many steps resulting in different outcomes depending on where the output of one process is used in the one that follows. Let’s look at this in a security-minded way. Mapping the flow of information between these processes can help us structure the network into compartments, noting the data handover points needed in between, such as IP addresses, ports and protocols. This will help to mitigate an attack propagated across different network sections. It also identifies the needed flows and makes sure that any further attacks can be shut down and prohibited. Assets and steps within the individual processes Here’s an example: Radiology uses a few different assets to generate medical images: Ultrasound, X-ray or MRT, and then uses a Picture Archiving and Communication System (PACS) server to store that imagery. Configuration of PACS servers is often the first trap to fall for from a security perspective. That’s because a full and secure configuration is not achieved when the asset is operating according to process requirements! Security is only achieved when all other configuration elements are checked and appropriately secured. One might think that using the PACS server to allow patients access to their medical imagery via web interface might sound like a good idea and a value-add for patients wanting to see their medical info personally. But when a PACS server connects directly to the public internet without any further configuration checks, the consequences can be severe, as recent cases have shown! In the same way, integrating an Electronic Medical Record (EMR) into self-service kiosks or websites in which patients input their data prior to a hospital visit often includes many details that are unrelated to the main operation. Also, the EMR system needs to be checked for vulnerabilities and updates regularly! An EMR can be seen as the central element of all data flows in a hospital, whether the internal flow between PACS and EMR, EMR and Medication Management or the external flow, used for insurance and billing purposes. Any and all of these connections need planning, scrutiny, and intensive monitoring. Putting things together to build a secure structure The promised benefits of digitization might benefit a single asset, a process or the hospital as a whole. Still, that promise also comes with an obligation to think through the implications of digitizing and storing health data and consider the entire security strategy and its contingencies. At the same time, we must remember the possible side effects and not stop thinking of these things when the first signs of “mission accomplished” are in sight. Even though the digitizing process works, that does not necessarily mean it is secured. Mapping out the data flow as well as checking and securing the settings of a device is a vitally important process around any mass digitization effort aimed at securing private and personal medical data. Augmenting that process with the tools needed to further tighten security will build a more secure structure able to be resilient agains...
    続きを読む 一部表示
    4 分
  • Incident responder careers: What’s it like to work in incident response?

    Incident responder careers: What’s it like to work in incident response?
    2021/09/02
    As the well-known saying goes, it’s not a matter of if you will be breached, but when. Cybercriminals are relentless in their pursuit to break into your organization’s systems, so to protect themselves, organizations must be at least equally as persistent with their defenses. When a breach occurs, it’s the job of incident responders to mitigate the security violation and restore defenses as quickly as possible. Incident responders are sometimes referred to as digital forensics incident responders or DFIR. The National Institute of Standards and Technology (NIST) defines digital forensics as the application of science to the identification, collection, examination and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data. (For more on this job title, see Digital forensics careers: Public vs. private sector.) But in fact, there are nuanced differences between an incident responder and someone who works as a DFIR. While a DFIR may be narrowly focused on the intricacies of a specific attack (similar but not the same as a malware analyst who works to reverse-engineer attacks), an incident responder is sometimes referred to as a cybersecurity first-responder. They are the first line of defense an organization relies on to mitigate a real-time attack and ensure a quick recovery. “Every incident is slightly different,” says Keatron Evans, a senior instructor at Infosec and managing consultant at KM Cyber Security, LLC. “I feel like I learn something every time. It’s a very exciting career to be in.” What does an incident responder do? NIST defines incident response as the mitigation of violations of security policies and recommended practices. Incident responders are first on the scene to assess what happened and then apply effective mitigation strategies that are both effective and efficient. Cyber incidents are costly, and the quicker the bleeding can be stopped, the better. On a more strategic level, incident responders are also responsible for designing and implementing an incident response plan. These plans will often look different from one organization to the next. However, their goal is the same: to identify, remediate and recover from cyber incidents. In the NIST Computer Security Incident Handling Guide, they recommend an incident response plan that contains four primary subject areas: Preparation, which includes the identification of preventative measures Detection and analysis, which includes areas such as indicators, required documentation and notification Containment, eradication and recovery, which includes choosing a containment strategy, gathering evidence and identifying attacking hosts Post-incident activity, which includes lessons learned and evidence retention policies Some incident responders work for a large company as part of an incident response team led by an incident manager. Others, like Evans, work as part of a consulting firm that provides incident response services, or they may work independently. As a consultant, Evans says he’s “worked with incident responders within an organization when they realize which skills they have on their team and which skills they don’t. They know to reach out and get [a team like his consultancy] involved.” What does it take to be an incident responder? Core to being a good incident responder are two common security positions: strong communication skills and problem-solving. “We think about incident response as more of a technical thing, and it is, but there’s a whole soft management side to it where you have to communicate details of the incident to the right people, at the right time,” Evans says. Communication and being calm are keys, Evans explains. One real-life example is the LinkedIn data breach from a few years ago when the company first announced 7 million records were hacked. Then, they had to come back out and say it was actually 117 million records. “The technical side is binary. Your techniq...
    続きを読む 一部表示
    6 分
  • Death rays, Death Stars and deathware?

    Death rays, Death Stars and deathware?
    2021/08/30
    The James Bond movies of the sixties introduced death rays that took out entire cities. In the late seventies, Star Wars brought us immense Death Stars that could destroy planets in seconds. And now analyst firm Gartner is scaring the bejeebies out of us with the concept of deathware — malware designed to actually kill people. According to Gartner®, “By 2025, cyber attackers will have weaponized operational technology (OT) environments to successfully harm or kill humans.” Further, Gartner states, “Attacks on OT – hardware and software that monitors or controls equipment, assets and processes – have become more common. They have also evolved from immediate process disruption such as shutting down a plant, to compromising the integrity of industrial environments with intent to create physical harm. Other recent events like the Colonial Pipeline ransomware attack have highlighted the need to have properly segmented networks for IT and OT.”¹ “In operational environments, security and risk management leaders should be more concerned about real-world hazards to humans and the environment, rather than information theft,” said Wam Voster, senior research director at Gartner.¹ According to Gartner, “security incidents in OT and other cyber-physical systems (CPS) have three main motivations: actual harm, commercial vandalism (reduced output) and reputational vandalism (making a manufacturer untrusted or unreliable).”¹ Gartner goes as far as predicting that “the financial impact of CPS attacks resulting in fatal casualties will reach over $50 billion by 2023. Even without taking the value of human life into account, the costs for organizations in terms of compensation, litigation, insurance, regulatory fines and reputation loss will be significant. Gartner also predicts that most CEOs will be personally liable for such incidents. As well as lives being lost, compensation, litigation, insurance, regulatory fines and reputation loss will mount up fast. To make matters worse, the analyst firm predicts that CEOs will be personally liable for these incidents.”¹ Sensational, but true Yes, an element of sensationalism is apparent in such pronouncements. But there is an element of truth woven into it. Consider the autonomous vehicle: Hackers can already scan and steal entry credentials from keyless entry systems with relative ease. There have also been instances of people managing to take over control of someone else’s vehicle remotely. Once autonomy enters into this landscape, it is conceivable that someone could create chaos by messing with driving algorithms. A handful of deaths have been reported from self-driving cars. Taking it a stage further, Greg Schulz, an analyst with StorageIO Group, noted that planes, trains and transit systems are becoming more and more automated. As that trend progresses, a successful hack opens up all sorts of opportunities for those with terror in their hearts. Schulz mentioned additional pathways to destruction that could be introduced via drones, Alexa or Google devices, smartphones, computers, garage door openers, home heating ventilation air conditioning (HVAC) and other building control systems such as elevators. Further, factory floor systems, warehouses and industrial facilities are getting increasingly populated by robots. Movies such as iRobot highlighted the consequences of robotic automation run amuck. How about using an infected robotic programming or a corrupted drone to bring about someone’s demise? “It could be possible to use a drone to kill somebody directly, but what’s more likely is a death due to operator error due to flying recklessly,” said Schulz. “Perhaps the most serious repercussions that could threaten life might be felt due to attacks on 911 dispatch, traffic lights or air traffic control. There is also the possibility of harm by infecting IoT and SCADA systems that control power, water and gas networks.” Water system poisoning incidents have already taken place. “The attack on th...
    続きを読む 一部表示
    7 分
  • How to become a Chief Information Security Officer (CISO)

    How to become a Chief Information Security Officer (CISO)
    2021/08/26
    As the cost of cybercrime rises, so does the sense of urgency most organizations have for cybersecurity programs. Operationalizing that understanding often translates to the hiring of a chief information security officer, or CISO. The total amount of data created, captured, copied and consumed globally is projected to grow to more than 180 zettabytes by 2025. While data grows in volume, it also grows in importance. Organizations rely on it to communicate and transact with customers, make better decisions, and develop smarter products. On the other hand, cybercriminals also seek to exploit it. In the middle of this data tsunami sits the CISO, whose job is to develop and implement strategies that safeguard an organization’s information. With more and more data to protect, an ever-expanding threat landscape to cover and a seemingly unending supply of savvy cybercriminals to block, CISOs have a big job, says Joshua Knight, a cybersecurity professional at Dimension Data. Throughout his 30 years of experience in the security field, he has learned that a CISO holds significant responsibilities within an organization — and it’s much broader than technology implementation. What does a CISO do? While the role of a CISO (or chief security officer, CSO, as some may call it) will likely look somewhat different from one organization to the next, most CISOs spend their days overseeing the strategic and operational aspects needed to protect data. They outline technology approaches, define policies and procedures and then implement them across all business areas. “Many of them will work up and through IT,” Knight says. CISO’s have distinct areas of data to secure, including applications, infrastructure, databases and digital, which often consists of a mixture of cloud, IoT, AI and the analytics engine. However, the key to success for CISOs isn’t exclusive to the technical knowledge needed for securing these areas. Consideration must also be given to data governance, compliance and physical touchpoints, like users. “There is bleed among all of that, but spelling it out across distinct towers shows how a security professional really thinks and how they address the new world.” In short, it comes down to effectively mitigating risk while also enabling business. Designing the technology approaches that best secure data are critically important, but so is the ability to work with other members of management. The CISO must continually advocate for security while also aligning protection approaches with business needs. Everyone is ultimately in the business of generating revenue, Knight says. Some CISOs choose to center their team structure on this goal by adding business information security officers (BISOs) to their org charts. These are security leaders within each business unit or division, usually for a large enterprise. (For more, read: What does a business information security officer (BISO) do?) “The CISO needs to be able to work with their management peers to develop a long-term security roadmap and how that aligns with the business. At the same time, they should treat their organization as a center of excellence and ensure they are easy to do business with,” Knight said. What does it take to be a CISO? CISOs are senior executives that typically report to a chief information officer (CIO) or chief technology officer (CTO). Their expertise must span a wide range of areas, and therefore the individual should have formal education and years of experience. A computer science degree of some type is usually preferred though not required, as is a number of years spent working with security technologies. For professionals early in their cybersecurity career who aspire to the CISO role, certain certifications are also helpful and offer a way to demonstrate their security chops. Some to consider working towards include: (ISC)² Certified Information Systems Security Professional (CISSP) is one of the most in-demand manager-level certifications. It va...
    続きを読む 一部表示
    6 分
  • Securing cloud endpoints: What you should know

    Securing cloud endpoints: What you should know
    2021/08/24
    What is endpoint security in the cloud? Endpoint security solutions, such as endpoint protection platforms (EPP) and endpoint detection and response (EDR), were once considered a separate discipline from cloud security. These technologies have since merged to create solutions for endpoint protection in the cloud. Traditional endpoint security was only sufficient when employees all worked on-premises, accessing workloads through company computers. However, changes to the market, including greater competition, the need for 24/7 accessibility, and rising IT costs, have led more organizations to embrace cloud computing to enable a more open and accessible IT environment. The cloud is accessible from any device, which is good for work flexibility but can complicate security. Challenges for cloud security include: Cloud systems introduce new types of endpoints, including SaaS applications, cloud storage buckets, managed databases and computer instances (such as EC2 instances or Azure VMs). Each of these is, for all intents and purposes, an endpoint that attackers can gain access to and compromise. The number and types of endpoints accessing the cloud are constantly growing, with devices ranging from laptops to smartphones and tablets. As the Internet of Things (IoT) grows, so does the list of devices and the associated vulnerabilities. External bring-your-own-device (BYOD) endpoints do not provide sufficient visibility into their state or contents. You cannot know what potential security threat may be hidden in a connected device. It is difficult to manage and monitor endpoint behavior and access. Even if your security policy stipulates a list of approved devices and installed apps, you need the right tools to monitor and enforce endpoint security. To ensure you are protected, you need to find a way to extend security to include monitoring remote endpoint access and behavior. Let’s take a closer look at security challenges affecting endpoints in public and private clouds. Public cloud endpoint security Public cloud resources are more vulnerable to attackers because they are outside the control of IT departments and typically have access to public networks. All public cloud providers use a shared responsibility model, in which the cloud provider secures cloud infrastructure, while cloud users must secure their workloads and data and are responsible for secure configuration. Many organizations use multiple computing models, including public Infrastructure-as-a-Service (IaaS) such as Amazon EC2, Platform-as-a-Service (PaaS) such as Amazon Lambda and Software-as-a-Service (SaaS) such as SalesForce and Microsoft Office 365. It can be challenging to identify endpoints, understand access controls and establish secure configurations, as these can work differently for each cloud provider. You cannot centrally view and control all your public cloud branches without specialized tools, and you have to find them one by one across multiple cloud environments. Another dimension of cloud security, which is unique to the public cloud, is that attacks can not only compromise sensitive resources but also increase cloud costs as attackers leverage cloud infrastructure to create their own, malicious resources. Private cloud endpoint security The private cloud may seem more secure because it is fully controlled by the organization and runs in a local data center. However, private clouds are also vulnerable to attack. Security issues that can impact private clouds include: Insider attacks — a malicious employee or attacker who holds or compromises a legitimate account within the private cloud, can use it to wage an attack. Endpoints are usually connected to other resources and networks, which can lead to lateral movements by malicious insiders. Phishing — social engineering is a common way to compromise endpoints. For example, in a spearphishing attack, hackers investigate victim behavior in your organization, send a crafted and trusted email and trick...
    続きを読む 一部表示
    10 分
  • Beginner’s guide to the basics of data encryption

    Beginner’s guide to the basics of data encryption
    2021/08/20
    To understand what data encryption means, we first need to know what data is. Data refers to any piece of information that has been translated into a binary digital format that makes it easy to be moved or processed. The increase in smartphone usage and fast internet connectivity has led to a surge in the creation of digital data. Examples of data include text, video information, web and log activity records and audio. The proliferation of data in governments, organizations and agencies has placed increased emphasis on data quality and integrity. As a result, individuals and organizations are now faced with the heavy task of ensuring data quality and guaranteeing that the records in use are the most accurate. Data breaches have become rampant these days, which is why data integrity and quality are in question. According to Statista, the number of data breaches in the U.S. has grown from 157 in 2005 to over 1,000 each of the past five years. Is there something that can be done to control the situation? What is data encryption? Data encryption is one solution to mitigating the menace of data breaches that are ravaging the internet streets. Data encryption refers to the procedure or process of scrambling plaintext data into a complex undecipherable format known as ciphertext. Data encryption renders data unreadable to unauthorized parties who do not have the decryption keys. Robust data encryption tools, combined with competent key management, can go a long way toward safeguarding data from modification, data disclosures and theft. Data encryption is thus one of the most significant elements of a cybersecurity strategy. How does data encryption work? Data encryption algorithms in use today go beyond simply concealing data from unauthorized parties. Data encryption ensures that the data’s origin can be authenticated and maintains its integrity throughout its transmission stage. Encryption works by scrambling data and information into a sequence of a random and unrecognizable characters. The scrambled information is then transmitted to the receiver, who holds the decryption key to turn the ciphertext into plain text. You can see the figure below to understand more about how encryption works. Source: ClickSSL For example, the phrase “Nice Meeting You” can be encrypted to a ciphertext that appears like 4596 9012 11884. For the receiver to get back the “Nice Meeting You” text, they need a decryption key. Data encryption techniques There are several data encryption techniques. However, three approaches appear to be more popular. These are symmetric encryption, asymmetric encryption and hashing. We will have a look at them to see how they work. Symmetric encryption Symmetric encryption is the most straightforward data encryption that involves a single secret key for encryption and decryption of data. The private key could be in the form of a number, letter or a string of random numbers and letters. The secret key combines with the data in plain text to transform the contents of the information in a particular manner. Both the sender and recipient of the information must know the secret key. One of the major drawbacks of symmetric encryption is that the parties must exchange the private keys before the data can be decrypted. Asymmetric encryption (public key) Popularly referred to as public-key cryptography, asymmetric encryption is a relatively novel technique compared to symmetric encryption. This data encryption method uses two keys (private key and public keys) to convert plain text data into ciphertext. In public keys, two keys are used. The public key will encrypt data, while the private key will decrypt data. It is referred to as a public key because anyone can use the key to encrypt data. No hacker can read, interpret or decipher the original information once encrypted using a public key. The private key will be used to decrypt the data. Usually, details about the private key will be shared between the party sending the inform...
    続きを読む 一部表示
    8 分