The rise of state-sponsored cyber attacks

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.scmagazineuk.com/the-rise-of-state-sponsored-cyber-attacks/article/441423/

Whether in the public or private sector, most organisations today store
valuable intellectual property, customer or citizen information and other
sensitive data that is useful in itself, or when combined with other
information. As a result, all organisations that deal with sensitive
information are at risk of being targeted by state-sponsored actors looking
to inflict damage and these attacks are becoming increasingly commonplace.

Indeed, a pattern is starting to emerge with foreign-based cyber-attackers
collecting vast troves of information on government employees and other
citizens. From medical and financial records, to security clearance
information and airline travel history, attackers are gathering
intelligence that could collectively be used in any number of criminal
activities – including fraud, bribery and phishing attacks.

In many ways, these attacks are arguably growing in number because
organisations are not doing enough to protect themselves.

Privileged accounts: the keys to the kingdom

In terms of the methodologies employed in state-sponsored attacks, while
the motivation behind cyber attacks may differ, the tactical approach is
often the same. In order to breach networks, attackers typically employ an
unsophisticated phishing-type attack to breach perimeter defences and
install malware inside the network. Once inside, the attackers move
laterally attempting to steal credentials for privileged and administrative
accounts.

The act of stealing and exploiting privileged accounts is the common link
in nearly all recent data breaches and cyber attacks. These accounts, which
include administrative accounts, default and hardcoded passwords,
application backdoors, and more, effectively deliver the ‘keys to the IT
kingdom', enabling widespread access to the most sensitive data held within
an enterprise network.

Once the attackers succeed in compromising privileged accounts, they can
elevate privileges to new levels of access to move laterally inside the
network and begin to lay the groundwork for a hostile takeover of the
targeted network – virtually undetected.

Breaches such as those at the German parliament, US Office of Personnel
Management, Sony Pictures and others were devastating not just because of
the loss of data, but because each organisation completely lost control of
their infrastructure and networks through compromised privileged accounts.

In many cases, breached organisations are forced to rebuild significant
portions of their infrastructure to regain IT trust and operation.

Stopping an attack in its tracks

Companies of all sizes are now faced with the significant challenge of
ensuring they can detect and protect against serious threats, like
state-sponsored attacks. Critical to this is taking charge of powerful
privileged accounts – knowing where they are and how to protect and monitor
them.

Organisations must now assume that attackers are already on the inside of
the network and focus on putting in place robust controls around privileged
accounts to mitigate the risks of these sensitive credentials being
hijacked.

The first step is understanding how many privileged accounts exist and
where – this is often grossly underestimated by the business. These
accounts can then be reviewed to ensure that the right policies are in
place – including who can use them and for what role, and that users have
appropriate levels of access – no more and no less. It's important to note
that privileged accounts aren't just users, they also include credentials
needed for application-to-application or application-to-system
communication.

Central controls and continuous monitoring then need to be put in place to
ensure that the business always has a handle on the privileged accounts.
For example, it is essential that all activity is logged and recorded in
real time.

The use of behavioural analytics can indicate where irregular or risky
activities are taking place. The ability to flag and analyse these
anomalous activities, as well as to isolate users from sensitive target
assets, is critical to stopping the impact of an attack in progress and
limiting damage.

No business should be foolish enough to assume that it can catch all
attacks at the perimeter alone. To protect against increasingly threatening
attacks, it is critical that organisations adopt the mindset that they have
already been breached and put in appropriate controls to mitigate risk.

The failure to robustly defend privileged accounts can ultimately enable
attackers, whether state-sponsored or financially motivated cyber-thieves,
to move around a network virtually undetected for months, if not years.

The cyber-threat landscape is evolving rapidly and organisations must move
fast and smart in order to keep pace.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!