Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/20/2018
10:30 AM
Paul Kurtz
Paul Kurtz
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

The Case for Integrating Physical Security & Cybersecurity

Aggregating threat intel from external data sources is no longer enough. You must look inside and outside your traditional knowledge base for the best way to defend against attacks.

Early last year in "Grizzly Steppe and Carbanak: The Dangers of Miscalculation in Cyberspace," TruSTAR researchers outlined the overlap of tactics, techniques, and procedures (TTP) between Russian state organizations and criminal organizations like the Carbanak hacking group. We found that Carbanak and attacks attributed to Russian state security agencies were utilizing some the same infrastructure to launch attacks. CrowdStrike's new 2018 Threat Report expands the aperture beyond Russia to include to North Korea, China, and Iran. There's evidence hacktivists borrow these TTPs too.

The overlap of TTP raises serious questions for defenders of corporate and government networks, and poses a danger of miscalculation for government in responding to attacks. Overlapping TTP also drives home the need to change our security strategy at the organizational level to a unified security data model that can help organizations better defend themselves and collaborate with other companies, sharing organizations, and even government agencies.

Too often, security teams silo event data into multiple categories like fraud, phishing, malware, DDoS, insider threats, and physical breaches, just to name a few. These are often handled by separate teams requiring different skills sets, which is understandable. But it's also surprising that we separate the data around these events and fail to correlate it in a common repository to identify trends and patterns in TTP.

Take spear phishing, for example. We know spear phishing campaigns often insert malware strains that can lead to advanced persistent threats through command-and-control servers. DDoS obviously disrupts networks, but it is also used as a means to establish a persistent presence. Physical breaches lead to malware implants. Our failure to fuse this data leaves us vulnerable to adversaries, creating dangerous inefficiency for security operators. Without a comprehensive understanding of event data across an entire organization, we place ourselves at a permanent disadvantage.

Where Collaboration Is Already Happening
Several large companies in finance, cloud services, insurance, health, and retail are now integrating their event data associated with fraud, malware, DDoS, and phishing. (Physical breach data is a laggard.) For example, Rackspace Chief Security Officer (CSO) and TruSTAR adviser Brian Kelly recently broke down his decision to combine physical security and cybersecurity in The Wall Street Journal. Kelly argued that in the case of executive protection, the number of spear phishing and spoofing attacks against top executives clearly mark this area as both a physical and cyber problem.

Progressive security teams are also integrating relevant data associated with the protection of their own infrastructure as well as that of their customers. This data model does not rely on adoption of a particular data format or protocol such as STIX. Companies using this approach can leverage internal resources including security information and event management (SIEM) systems, case management, endpoint detection, and vulnerability data with relevant external data feeds including everything from threat intelligence to insights from information sharing analysis centers (ISACs) to government insights.

The key component to a unified security data model relies on a centralized common knowledge repository. A common knowledge repository of security-related events can align teams and make working together more effective. Security teams can then visualize relationships in real time and exchange notes to streamline responses and save time. This approach also creates a historical reference point, which can expedite a forensic investigation when a breach or disruption occurs.

This framework extends beyond individual organizations. Like-minded organizations can easily leverage insights from others using cloud-based technology. Machine learning can identify trending TTPs in real time, enabling others to proactively defend themselves by ingesting insights and modifying their SIEM and firewall profiles accordingly.

Adoption of a unified security data model is a step beyond a traditional threat intelligence platform. Aggregating data from external sources is no longer enough. You must look at your entire organizational knowledge to accurately to determine relevance, context, and priority.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX and learn from the industry’s most knowledgeable IT security experts. Check out the Interop ITX 2018 security track here. Save $200 off your conference pass with Promo Code DR200.

Paul Kurtz is the CEO and cofounder of TruSTAR Technology. Prior to TruSTAR, Paul was the CISO and chief strategy officer for CyberPoint International LLC where he built the US government and international business verticals. Prior to CyberPoint, Paul was the managing partner ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/22/2018 | 10:44:26 AM
Physical security and social engineering
It's crazy to me that this isn't basic stuff yet. Post-It notes on the screen, anyone?

Not to mention how often social engineering is successfully used as a vector for attack, including socially engineering oneself onto the premises. 
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/21/2018 | 1:14:40 PM
True story
2 weeks ago my wife, daughter and her 3 year old daughter, came to visit my office which is very tightly controlled with badge cards and readers.  We ate lunch in the cafeteria and visited my colleagues.  All were delighted to meet little Cariana.   But at the end of their visit, little 3 year old Cariana takes all the cards and said "they have to be returned" and with them in hand, walked across the lobby to security and handed them in.  The woman in the office was enchanted!!!!   A 3 YEAR OLD understands the concept of perimeter security BETTER than most adults!
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Microsoft Patches Windows Vuln Discovered by the NSA
Kelly Sheridan, Staff Editor, Dark Reading,  1/14/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5397
PUBLISHED: 2020-01-17
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not incl...
CVE-2019-17635
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted inde...
CVE-2019-19339
PUBLISHED: 2020-01-17
It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries...
CVE-2007-6070
PUBLISHED: 2020-01-17
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-1382. Reason: This candidate is a reservation duplicate of CVE-2008-1382. Notes: All CVE users should reference CVE-2008-1382 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...
CVE-2019-17634
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could...