Operations

6/13/2018
10:15 AM
100%
0%

Cisco Talos Summit: Network Defenders Not Serious Enough About Attacks

Security is weak, and most companies are clueless, according to Immunity researcher Lurene Grenier, who kicked off the Cisco Talos Threat Research Summit on Sunday.

Your network is under attack, but you don't care. That was the message from Immunity researcher Lurene Grenier, who on Sunday kicked off the Cisco Talos Threat Research Summit, in Orlando, Fla.

"You are either not aware of what's going on or aren't taking all this seriously," she said.  

At the heart of Grenier's view of attackers is a set of three tiers:

  • Tier 1: Nation-state actors
  • Tier 2: Organized crime
  • Tier 3: lolsec and reverse hacktivism

She told the audience that dealing with tier 3 involves the kind of activity they're used to — pen testing, updating, and then continuing to pen test and update.

Tier 2 becomes more complex because many of the organized crime groups are either working on behalf of nation-states or reusing nation-state code. To have a chance of defending against tier 2 threats, Grenier said, your organization must do two things, one expensive and one difficult.

The expensive task is finding and hiring good security people. From there, give them time to understand your network, she said. "They need to know your network better than the attackers, and that's a tall order," Grenier explained.

Then comes the hard task: "Give them the clout to change what needs to be changed, and give them the resources to make the changes," Grenier said, noting that both involves a cultural shift for many organizations.

But that's easy compared with the shift required for coping with tier 1 attackers. Grenier hammered home the point that every organization must be prepared to deal with these most advanced threat actors.

"How can I convince you to care about this? This isn't a responsibility thing anymore — they won't tell you when they've owned you," Grenier said. "It's just that your IP will end up in another country."

Defending against this kind of attacker requires investment; Grenier offered a metric for how much a company should be prepared to invest. "How much do you pay your lawyers? You should be paying your security team at least as much," she said.

Then she recommended draconian segmentation. Most corporate computers, she said, have no business being on the Internet and should only be connected to an internal network without an internet gateway. What about the employees who need to update social media and check March Madness scores? "Give your employees an iPad," Grenier recommended.

One of the reasons Grenier's warnings seem so dire is that she has seen the layers of attacks that threat actors have at their disposal. "There are unpatchable bugs in everything you own and use. Every nation-state has multiple zero days on everything you own — probably three deep," she said.

Those vulnerabilities and exploits extend to mobile devices. The iPhone, Grenier said, is probably the most secure mobile device widely sold, and yet "there are probably 10 full iPhone [exploit] chains at any given time. And that's the most secure calling platform."

The real risk isn't in an attacker devastating your infrastructure, Grenier said, but in a nation-state-sponsored competitor beating you economically.

"What could you do, as someone negotiating a contract, if you had perfect knowledge of your competitor's plans, information, and projections?" she asked. "That's the situation everyone finds themselves in when they deal with a state capitalist."

Related Content:

 

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/13/2018 | 2:49:09 PM
Working in a real shop
I am honored to be working with a talented group of warfare professoinals at Fiserv - where we have a dedicated malware forensics and threat hunting group for the entire firm.  We are ACTIVE in finding incoming threats and monitoring over 11,000 systems for invasive anything, remediating and eliminating.  Almost unique in corporate America.  
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The State of IT and Cybersecurity
The State of IT and Cybersecurity
IT and security are often viewed as different disciplines - and different departments. Find out what our survey data revealed, read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.