Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/4/2013
11:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Using The Human Perimeter To Detect Outside Attacks

The right training and reporting mechanisms can make it possible to crowdsource human observation of suspicious emails and potential attacks for faster detection

While automated technology, network sensors, and behavioral analysis are crucial to helping security professionals detect attacks against their network resources, sometimes nothing can beat good old-fashioned human observation. Security team members can only do so much to personally observe aberrant behavior, but fortunately, they may have a ready source of eyes and ears in what some jaded pros might consider an unlikely pool of candidates: end users.

The fact is that end users are at the front lines of attacks—most outside incursions to the network usually involve some form of social networking or another. Instead of simply putting up posters and sending out multiple-choice questions once a year about how to avoid phishing dangers altogether, social engineering experts say organizations should seek a more realistic and robust training goal. They should be teaching employees to spot suspicious activity and report it without fear of recrimination, whether they fell for a ploy or not. Ultimately, the goal is to turn employees into a sort of human perimeter to help the security team detect attacks more quickly.

"There are many more human sensors on a network than any intrusion detection system can ever hope to have, because every employee can be one," says Rohyt Belani, CEO of PhishMe. "If you look at the way security responders work today, they're picking leads off of either their IDS systems or their network logs and then they are going through a similar process to find suspicious behavior. Given the right mechanisms or right sorts of tools, the humans who are resilient to these attacks actually become great reporters."

The fact is that security has always been a game of reducing the odds of exposure rather than eliminating it. And yet, when it comes to the human element of security too many security pros are quick to disparage all end users as stupid because attacks continue to get through, says Mike Murray, managing partner for MAD Security. But that's like saying any other piece of detection technology is worthless because it doesn't work 100 percent of the time.

"A really motivated attacker is always going to get in—if you've got a skilled person, they're going to find a way into the network. The key is quick detection and good response capabilities at that point," Murray says. "Your IPS doesn't stop everything, but it should tell us something that gives the SOC operator an idea about where to follow up on something. If we can get our users doing that as well, that detective capability will allow us to respond much more quickly that we can naturally."

In many cases, human intuition may not kick in fast enough to prevent someone from falling for a phishing ploy or a malicious link altogether, but it usually happens pretty soon after the first strike, says Lance Spitzner, training director for SANS Securing The Human Program.

"When somebody gets hacked, they usually figure it out. Either their system crashes or a document looks a little weird or a particular website makes the browser act funny," he says. "When they report it, they improve organizational resilience."

Unfortunately, many organizations have a difficult time developing that resilience through a human perimeter because they simply don't have the mechanisms in place to support it. According to Chris Hadnagy, chief human hacker for Social-Engineer, Inc., one of the biggest impediments to the process is a fear by employees that telling someone about a problem may get them fired. The other is not having any procedure for properly reporting it.

"One of the things we find all too often when working with companies is that they don't have reporting agencies within their organizations," he says. "When something bad occurs, there's no place for the employee to say, 'Hey, I think I just clicked a link that was bad.'"

[Apple, General Motors, Home Depot, Johnson & Johnson, Chevron, Boeing, and other major corporations easily fall to social engineers in recent contest, a new report shows. See Social Engineers Pwn The 'Human Network' In Major Firms .]

On the back end, the organization needs to have enough manpower to handle these reports, Hadnagy says, explaining that for a Fortune 500 company with thousands of employees, "this is not a one-person job."

Not only should this team be working to sift through these reports and triangulating them with logs and other detection technology output, but it also needs to establish solid and positive communication with the employees that send the reports to encourage future cooperation.

"If they feel like they're going to be chewed out or punished, we create an atmosphere of fear," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15570
PUBLISHED: 2020-07-06
The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file.
CVE-2020-15569
PUBLISHED: 2020-07-06
PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
CVE-2020-7690
PUBLISHED: 2020-07-06
It's possible to inject JavaScript code via the html method.
CVE-2020-7691
PUBLISHED: 2020-07-06
It's possible to use <<script>script> in order to go over the filtering regex.
CVE-2020-15562
PUBLISHED: 2020-07-06
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.