The Case for Integrating Physical Security & Cybersecurity

Early last year in "Grizzly Steppe and Carbanak: The Dangers of Miscalculation in Cyberspace," TruSTAR researchers outlined the overlap of tactics, techniques, and procedures (TTP) between Russian state organizations and criminal organizations like the Carbanak hacking group. We found that Carbanak and attacks attributed to Russian state security agencies were utilizing some the same infrastructure to launch attacks. CrowdStrike's new 2018 Threat Report expands the aperture beyond Russia to include to North Korea, China, and Iran. There's evidence hacktivists borrow these TTPs too.

The overlap of TTP raises serious questions for defenders of corporate and government networks, and poses a danger of miscalculation for government in responding to attacks. Overlapping TTP also drives home the need to change our security strategy at the organizational level to a unified security data model that can help organizations better defend themselves and collaborate with other companies, sharing organizations, and even government agencies.

Too often, security teams silo event data into multiple categories like fraud, phishing, malware, DDoS, insider threats, and physical breaches, just to name a few. These are often handled by separate teams requiring different skills sets, which is understandable. But it's also surprising that we separate the data around these events and fail to correlate it in a common repository to identify trends and patterns in TTP.

Take spear phishing, for example. We know spear phishing campaigns often insert malware strains that can lead to advanced persistent threats through command-and-control servers. DDoS obviously disrupts networks, but it is also used as a means to establish a persistent presence. Physical breaches lead to malware implants. Our failure to fuse this data leaves us vulnerable to adversaries, creating dangerous inefficiency for security operators. Without a comprehensive understanding of event data across an entire organization, we place ourselves at a permanent disadvantage.

Where Collaboration Is Already Happening
Several large companies in finance, cloud services, insurance, health, and retail are now integrating their event data associated with fraud, malware, DDoS, and phishing. (Physical breach data is a laggard.) For example, Rackspace Chief Security Officer (CSO) and TruSTAR adviser Brian Kelly recently broke down his decision to combine physical security and cybersecurity in The Wall Street Journal. Kelly argued that in the case of executive protection, the number of spear phishing and spoofing attacks against top executives clearly mark this area as both a physical and cyber problem.

Progressive security teams are also integrating relevant data associated with the protection of their own infrastructure as well as that of their customers. This data model does not rely on adoption of a particular data format or protocol such as STIX. Companies using this approach can leverage internal resources including security information and event management (SIEM) systems, case management, endpoint detection, and vulnerability data with relevant external data feeds including everything from threat intelligence to insights from information sharing analysis centers (ISACs) to government insights.

The key component to a unified security data model relies on a centralized common knowledge repository. A common knowledge repository of security-related events can align teams and make working together more effective. Security teams can then visualize relationships in real time and exchange notes to streamline responses and save time. This approach also creates a historical reference point, which can expedite a forensic investigation when a breach or disruption occurs.

This framework extends beyond individual organizations. Like-minded organizations can easily leverage insights from others using cloud-based technology. Machine learning can identify trending TTPs in real time, enabling others to proactively defend themselves by ingesting insights and modifying their SIEM and firewall profiles accordingly.

Adoption of a unified security data model is a step beyond a traditional threat intelligence platform. Aggregating data from external sources is no longer enough. You must look at your entire organizational knowledge to accurately to determine relevance, context, and priority.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX and learn from the industry’s most knowledgeable IT security experts. Check out the Interop ITX 2018 security track here. Save $200 off your conference pass with Promo Code DR200.