Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

4/1/2020
10:00 AM
Avi Chesla
Avi Chesla
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

The SOC Emergency Room Faces Malware Pandemic

To keep users and networks healthy and secure, security teams need to mimic countries that have taken on COVID-19 with a rapid, disciplined approach.

To protect populations from COVID-19, countries are facing unforeseen circumstances and taking extreme measures in response. Everything is moving fast, but we can see that countries that took decisive measures early have slowed the virus's spread.

Security professionals can learn from the healthcare industry new ways to protect their own organizations from hackers, who are out in full force. 

We in the security arena are also inundated with finding increasing and more severe vulnerabilities. To maintain business continuity in this quarantined era, organizations are allowing – or mandating – their employees to work from home and access the organization's business assets from afar. 

Attackers are exploiting the high volume of remote users logged into the organization, presenting a new, very distributed and volumetric, baseline of remote logins. This makes it very hard to identify unusual remote logins and makes it harder to detect credential theft cases; devices that are used to log in for the first time are no longer an anomaly, and so may not be identified. This is the new normal with user behavior and access patterns that have never been seen before, so most organizations are in the area of experiencing "unknown unknowns." They don’t even know what they don’t know.

Additionally, many employees are not security trained and can be attacked by quite simple social engineering methods as they work from home. Spear phishing (with weaponized emails), credit theft of remote user credentials, and phishing campaigns are on the rise.

And not only are doctors and nurses understaffed and overworked in hard-hit areas, so are SOC and IT teams. SOC rooms are now "distributed SOC rooms" and some SOC employees are ill or quarantined. Teams already strapped for staff are making do with even less and in difficult circumstances.

In the real world, countries which have successfully taken on COVID-19 have moved rapidly, identifying those who carry the virus and separating them form the healthy population quickly and effectively. In our IT organizations, we need to adopt the more disciplined, centralized approach. Steps we should take:

  • Act quickly. Identifying our vulnerabilities (vulnerable, untrained for security, employees working from home, stressed out SOC teams) and putting protections in place before attacks get out of control. Don't look backwards on what happened, but rather, look forward to prevent issues before they can occur.
  • Centralized, disciplined security monitoring and controls over distributed environments with focus on the sensitive assets and employees.
  • Find and isolate the infected hosts early – automated security investigation and response actions with focus on phishing, spear phishing, and other credential theft and account takeover activities. Quarantine and quick remediation prevent the spread and keep the majority of users healthy and happy.

In one area our cyber world has an advantage over real life emergency rooms – today it's possible to automate much of the work of security analysts. Imagine if we could provide doctors and nurses with robotic assistants who could take on some of the tasks of the ER team, without needing breaks or getting sick. Advanced AI such as natural language processing (NLP), which automates incident investigations, can lower the burden on our security teams and enable them to fight the big fight against cyber attackers triumphantly.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "What Should I Do If Someone Is Impersonating My Company in a Phishing Campaign?"

Avi Chesla is CEO and Founder of empow, developer of the i-SIEM. Prior to empow, Avi was CTO at Radware, where he was responsible for defining and leading the company's strategic technology roadmap and vision including the foundation and management of Radware's Security ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4719
PUBLISHED: 2020-09-24
The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
CVE-2020-15604
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-24560
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-25596
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. T...
CVE-2020-25597
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. Howeve...