Vulnerabilities / Threats
9/14/2011
12:42 PM
Connect Directly
RSS
E-Mail
50%
50%

Social Engineering Leads APT Attack Vectors

Combat advanced persistent threats with more adaptive user training and by acknowledging that networks today exist in a state of constant compromise, say experts.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The number-one advanced persistent threat (APT) attack vector is now not technology, but social engineering. Furthermore, security is no longer about trying to keep all intruders outside of the network perimeter, but rather acknowledging that security today involves living in a state of constant compromise.

Those are some key findings that came out of a summit held in Washington last week by RSA, the security division of EMC, as well as TechAmerica, a technology trade association. The summit involved about 100 "c-level" managers--CIOs, CTOs, and a few CEOs--plus senior lawyers, all drawn from large, well-known businesses and government agencies, who were gathered to discuss the best way to combat APTs.

"It wasn't some vendor-driven thing," said Eddie Schwartz, CSO of RSA, in an interview. Rather, he said, it was aimed at updating current approaches to security, in light of the types of advanced--and oftentimes, persistent and hard-to-detect--threats that have successfully exploited numerous organizations, including RSA.

One of the summit's major findings is that social engineering attacks are now the primary threat vector used to compromise businesses and government agencies. But as employees have become much more of a risk, what hasn't changed, said Schwartz, is "the degree to which anything had been done about it, or investments shifted, or program emphasis shifted, versus just spending money on perimeter security technologies."

Another interesting finding from the summit was that many businesses and government agencies said that while pursuing a "zero breach tolerance" approach was nice in theory, it's now unrealistic. "A more realistic [approach] would be accepting the fact that you live in a world of compromise, and understanding that you have to work in that world, and work in a mode of triage, instead of constantly trying to push back hordes at the gate," said Schwartz.

One driver for that more pragmatic worldview has been the emergence of targeted malware that is, in some cases, just hours old. Combating this type of APT can be incredibly difficult, because all it takes is one employee to open a seemingly innocuous--yet really malicious--attachment, and the business can be compromised.

Attackers' ability to hit big businesses and government agencies with never-before-seen malware implies that attackers often benefit from significant resources. "This increased agility on the part of attackers shows a very high level of resources available to them, where they can have people who are very responsive to the defenses of large organization ... and be able to work around those organizations on a case by case basis," said Schwartz. "So they're highly focused, and very agile to what the target is trying to do to defend itself."

What can be done to deal with these types of attacks? Given the threat posed by social engineering, Schwartz said that one of the more innovative--and adaptive--approaches described was wargaming, in which employees face real-world tests, such as their ability to avoid a spear-phishing attack. Fail the test, and they're called into a room to see, as a group, what the consequences of that attack would have been--both for them, and their employer.

Another strategy that could help organizations better resist APTs would be some form of information sharing, such as crowdsourcing attack data. "Today's attackers are better at real-time intelligence sharing than we, the targets are. In other words, they're better at gathering open source intelligence about us, organizing the data, and collaborating with each other, than we are at defending ourselves," said Schwartz.

Unfortunately, sharing information between defenders faces numerous hurdles, including the need for indemnification against liability, some sort of underlying technical infrastructure, as well as the current lack of "a standard set of nouns, verbs, and adjectives" to describe security attacks, said Schwartz. "Really, there aren't these types of lexicons today for communicating at machine speed about these types of problems."

Security professionals often view compliance as a burden, but it doesn't have to be that way. In this report, we show the security team how to partner with the compliance pros. Download the report here. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
JuneSanchez
50%
50%
JuneSanchez,
User Rank: Apprentice
10/8/2011 | 8:16:06 PM
re: Social Engineering Leads APT Attack Vectors
Great Article. After watching the social engineering experts from Ioactive Mike Ridpath (@ridpath) and Matias Brutti (@freedomcoder) talk on Social Engineering myself and few others within my company are in the process of creating more adaptive user training.

Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.