Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/20/2016
01:30 PM
Danelle Au
Danelle Au
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Hacking 'Forward’ With Weaponized Intelligence

Instead of hacking back and taking the fight to your adversary, what if your organization hacked forward by unearthing breach scenarios before the hackers do?

It is a transformational time in IT security. Advances in technologies associated with cloud computing, artificial intelligence and threat intelligence have sparked a new wave of innovation to counter threats against the enterprise and high value data.

The problem is the hackers are innovating too. And they are motivated. As people and organizations rush to adopt new technologies, the bad guys are rushing to find and exploit new vulnerabilities before they are patched. It’s a headlong cyber arms race that has frustrated more than a few business leaders. “If the hackers can attack us,” they wonder, “why can’t we hack them back?”

It’s a reasonable question. However, for those of us who prefer to stay on the right side of the law, the idea of hacking back at the enemy is fraught with legal and ethical risk. There are laws that establish boundaries and consequences for going on the offensive, and while they exist primarily to protect legitimate companies, the rule of equal protection—and concerns that cyber vigilantism would turn the Net into the Wild West—is helping to keep things from descending into total chaos.

Besides, turning the good guys loose on the criminal element would do little to stem the tide of aggressive cyber attacks on any enterprise with digital assets of value to the hacker community.

But what if, instead of hacking back and taking the fight to your adversary, your organization hacked forward and took the fight away? In other words, beat the hacker to the punch by unearthing the breach scenarios in your environment before they do.

In order to accomplish this, industry and the IT security community must work together to do a better job of collecting threat intelligence on the hacker community. That means not only capturing data on their strategies, tools, targets and methods, but to understand the context for each so that organizations can better apply that intelligence to their specific circumstances.

As Dark Reading has covered before, context is vital to the success of threat intelligence. All the information in the world isn’t going to help if you don’t know what it means. When correlated to your circumstances, however, you can apply the insights as a way to more effectively mitigate threats.

With that level of understanding CISOs can then weaponize their threat intelligence; not for the purpose of going on the offensive but to anticipate and blunt attacks in advance. This approach includes investment in new technology, yes. But it also requires a re-examination of the recalcitrance companies have traditionally had when it comes to sharing security information.

For industry as a whole, and specific segments, the key to overcoming the challenges of effective use of threat intelligence consists of three elements:

  1. Sharing: There must be a way for organizations to share meaningful threat intelligence using a common format that makes things easy to understand and correlate based on common factors such as industry, but that does not reveal the contributor's confidential information. If there is no trust within the system, it simply will not succeed.
  2. Processing: As inbound volumes of threat intelligence increase there’s a real risk of being overwhelmed by big data, meaning users of threat intelligence will be right back where they started, ignoring signals because of an abundance of false positives. Making threat intelligence actionable means processing the data in more practical ways, including tracking indicators of compromise to see not just how they start, but to understand how they play out using new methods like breach simulations.
  3. Responding: The true value of actionable threat intelligence is not simply in distinguishing real threats from false positives, but in speeding incident response time. The longer a threat goes undisrupted, the greater the chance for damage; once a hacker reaches the target, the more damage they can do. Security teams must learn to act, but automation must be a part of the solution in order to cut response times from days and months down to minutes and seconds.

As we become more adept at sharing and processing larger data sets and at making relevant correlations and responding to threats, it behooves us to take full advantage of the opportunity. The benefits will extend broadly and within industries so that banks, for example, aren’t spending time and resources on preventing attacks that are unlikely to affect them. Instead, organizations can direct their attention to what we know are the latest attacks targeting them.

Indeed this is already happening to some extent. The ISAO tracks industry organizations that have formed to collect and analyze industry-specific threat intelligence. Though the effort is in its nascent stages, there are examples of progress. Recently the National Credit Union Information Sharing and Analysis Organization (NCU-ISAO) began operations in Florida.

Such initiatives can only succeed through broadbased cooperation and participation that includes all stakeholders, from enterprises to technology developers, law enforcement and other governmental agencies and think tanks working together to identify best practices, provide education and awareness and encourage further innovation.

As organized threat intelligence sharing yields its desired results, we can envision a turning of the tides that may not eliminate security threats, but that will certainly diminish the hackers’ chances of success and drive up their costs of doing business. Wouldn’t that be a refreshing change? 

Related Content:

Danelle is vice president of strategy at SafeBreach. She has more than 15 years of experience bringing new technologies to market. Prior to SafeBreach, Danelle led strategy and marketing at Adallom, a cloud security company acquired by Microsoft. She was also responsible for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jcavery
50%
50%
jcavery,
User Rank: Moderator
9/21/2016 | 4:51:12 PM
Re: Red Teams
Yes, and bug bounties.....
SecretSquirrel96
50%
50%
SecretSquirrel96,
User Rank: Apprentice
9/21/2016 | 1:33:07 PM
Red Teams
Isn't this what Red Teams are already doing?

Replicating Adversary Threats and testing their systems for vulnerabilities.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industry’s conventional wisdom. Here’s a look at what they’re thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.
CVE-2019-6659
PUBLISHED: 2019-11-15
On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.
CVE-2019-6660
PUBLISHED: 2019-11-15
On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.
CVE-2019-6661
PUBLISHED: 2019-11-15
When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.