Endpoint

4/20/2017
02:00 PM
Ofer Amitai
Ofer Amitai
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Kill Chain & the Internet of Things

IoT "things" such as security cameras, smart thermostats and wearables are particularly easy targets for kill chain intruders, but a layered approach to security can help thwart an attack.

The concept of a kill chain attack has been around for several years. The term originated from the military, but computer scientists at Lockheed-Martin Corporation were the first to use this term in the field of cybersecurity, describing a kill chain framework to defend computer networks in 2011. Its relevance has taken on new meaning in our current era of IoT devices and botnet attacks. IDC predicts that by 2020, 30 billion connected “things” will be a part of the digital infrastructure.

The  “kill chain” lays out the stages of a cyber-attack, starting from early reconnaissance to completion of the attack with the goal of data theft and enabling more attacks. These stages are:

1. Reconnaissance – The intruder selects its target device, researches it, and searches for vulnerabilities

2. Weaponization - Intruder uses a remote access malware weapon, such as a virus or worm, addressing a vulnerability  

3. Delivery - Intruder transmits weapon to the target device, whether through e-mail attachments, websites, USB drives, etc.

4. Exploitation - Malware weapons program code to triggers the attack. This then takes action on target network to exploit vulnerability.

5. Installation - Malware weapon installs access points for the intruder to use.

6. Command and Control – Malware then enables intruder to have "hands on the keyboard" persistent access to the target network, also enabling future attacks.

IoT devices, particularly items like security cameras, smart thermostats, wearables, and even coffee makers, are easy targets for kill chain intruders. They often have little or no security system, making step #2 of the kill chain rather easy.  For example, last year 80 Sony IP security camera models were found to have back doors, giving hackers easy access.

Don't Break the Kill Chain! Prevent it 
The best way to prevent a kill chain from infiltrating enterprise IoT security is to invest in a layered approach. There are four steps to this approach:

1. Assessment:  Start with a  network discovery process of all the existing IoT devices, including managed and partially managed devices. Understand what each type of device is, what operating system it is running on and which application and processes are installed on it.

2.  Segmentation:  IoT devices should not be in the same network segment as other devices, or within reach of the organization’s mission critical systems and data. Deploy firewalls between these segments to prevent “things”  from reaching the “crown jewels” of your network.

3. Detection:  Regularly analyze your network behavior to detect every IoT device which joins the network, and carefully examine if it behaves similarly to other typical devices. A compromised device or a fake device might look the same but behave differently.

4. Response:  Because manual alerts can take hours or even days to process, the best practice should involve some type of backup plan that will block or limit the access of a specific device within seconds.

This layered approach is designed to both prevent the likelihood of a kill chain attack, and also to break a live attack if one does occur. Once a vulnerability in the IoT device is detected and an attack is underway, breaking the final steps of the kill chain is most crucial, as it is often where the biggest gap lies in an organization’s advanced threat protection strategy. These last stages provide the best picture of who might be attacking and infecting your corporate network. They also require the least amount of time to remediate. For example, if a vulnerable security camera continues to communicate to an Internet forum, even after segmentation, it’s an easy call to block it entirely from the network. 

[Check out the two-day Dark Reading Cybersecurity Crash Course at Interop ITX, May 15 & 16, where Dark Reading editors and some of the industry's top cybersecurity experts will share the latest data security trends and best practices.]

Related Content:

 

Ofer Amitai is CEO and co-founder of Portnox, where he is responsible for day-to-day operations and setting the company's strategic direction. He has over 20 years' experience in network security, during which time he established the first IT security team in the Israeli Air ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...
CVE-2018-19829
PUBLISHED: 2018-12-18
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVE-2018-16884
PUBLISHED: 2018-12-18
A flaw was found in the Linux kernel in the NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel id and cause a use-after-free. Thus a malicious container user can cause a host kernel memory corruption and a system ...
CVE-2018-17777
PUBLISHED: 2018-12-18
An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have acc...
CVE-2018-18921
PUBLISHED: 2018-12-18
PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.