Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/13/2017
09:15 AM
Connect Directly
Facebook
Twitter
RSS
E-Mail
100%
0%

Verizon Data Breach Digest Triangulates Humanity Inside Security

The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and attack patterns, along with their times to discovery and containment.

If the whole security management services thing doesn't work out, Verizon may want to consider getting into the techno-thriller mystery writing business. Its newly released Data Breach Digest is chockablock with stories of online shenanigans (with some identifying details altered) that would be right at home in an episode of Mr. Robot.

In one example, an online gaming company finds its production network hacked; worse, points of top players were being siphoned off and customers' personal information might have been compromised as well. Network and application logs were quickly parsed and Verizon's RISK team identified 15 systems that process game-point transactions, yet only 14 of them were known to be legitimate resources.

Sure enough, the anomalous system, while valid, had been abandoned for more than a year after an employee left the company. But it remained attached to the network, if dormant, and was an inviting target for hackers who brute-forced it, then loaded it with malware to do their dirty work.

Situations like these, where hidden endpoints that could be anything from systems, user accounts, software, or data, are what Verizon labels “Unknown Unknowns,” and are the hardest for organizations to plan for and react to, Verizon says in its latest DBD report. "We're seeing lots of cases of Unknown Unknowns … detection systems are picking up old and new malware that may be sitting there," says John Grim, senior manager and lead for Verizon's investigative response team. "We then come in and see if it's done any damage or if it's just laying in wait. Sometimes they emerge when we do testing."

The DBD has two objectives: Sketch out the complexity of the most common kinds of attacks, and provide a guidebook for all the individuals affected in the chain of command.

The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and the attack's pattern, along with its times to discovery and containment. Each scenario identifies a threat actor along with their motives, tactics, and techniques; the targeted victim also gets profiled in terms of industry sector(s), key stakeholders, and the necessary countermeasures.

In another DBD scenario dubbed "Mobile Assault – The Secret Squirrel," Verizon outlines the problems faced by a business traveler who may be forced to use sketchy Wi-Fi networks, hand over their laptop or smartphone at security checkpoints or immigration areas, or are required to decrypt their devices completely. There's also the potential for loss, theft, or device tampering in a hotel room; in some instances, specific companies and individual personnel are targeted for the high-value data they carry or are able to access.

The fix for Mobile Assault is ridiculously simple. Employees no longer travel with their assigned corporate devices, but instead are given “travel” smartphones and laptops, and after every trip, these devices are wiped clean and rebuilt. "From a forensic examination standpoint, having this known baseline image to compare against drastically reduces analysis time and helps [the organization] focus on potential problems rather than background noise," Verizon says in the new DBD report.

This year's report also deconstructs the complexity of breaches from a human standpoint and a stakeholder perspective, Grim tells Dark Reading.

And it's no longer enough to tell companies and end-user organizations, "This is the malware, and this is how you fix it," Grim adds. "HR and legal need to be involved too if it's an inside threat or involves employee records." Grim is quick to emphasize that the DBD report isn't just for IT staff or infosec professionals. Human resources professionals can query the report for HR issues, or HR in a specific industry sector. Incident responders can also query by industry, Grim says.

The DBD uses data derived from the Verizon's more comprehensive Data Breach Investigation Report. This is the second year Verizon has released the digest.

Verizon also offers a five-point incident response plan for organizations that have discovered any kind of data breach:

  • Preserve evidence; consider consequences of every action taken once the breach has been discovered.
  • Be flexible; adapt to evolving situations.
  • Establish consistent methods for communication.
  • Know the limits of your own expertise; collaborate with other key stakeholders.
  • Document actions and findings; be prepared to explain them.

Related Content:

Save

Save

Save

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain's New York Business, Red Herring, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
mikeroch
50%
50%
mikeroch,
User Rank: Apprentice
2/17/2017 | 9:39:33 PM
Easy 192.168.1.1
Absolutely agree with your thoughts. Nice post btw.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/17/2017 | 6:46:42 PM
Re: "Ridiculously simple"
> we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

This goes to my consulting philosophy as well.  Increasingly, data security, data privacy, and data compliance are three very different Venn diagram circles with but modest overlaps.  More problematically, however, these three interests sometimes downright conflict with each other!

Ultimately, it's about data stewardship as a whole.  Or, in other words, basic risk management.
T Sweeney
100%
0%
T Sweeney,
User Rank: Moderator
2/13/2017 | 4:12:16 PM
Re: "Ridiculously simple"
Thanks for your comment, HardenStance. There really is very little in information security that is easy or simple, and my "ridiculously simple" characterization was a bit glib. You made several good points, from the threat of the IoT to the need to pick our security battles/priorities carefully. I view the Mobile Assault strategy as a smart way to reduce headaches cut down on headaches for everyone.
HardenStance
100%
0%
HardenStance,
User Rank: Strategist
2/13/2017 | 12:51:07 PM
"Ridiculously simple"

Nice write-up, Terry.

Your term "ridiculously simple" about the Mobile Assault Fix is a more important one than some of us would want to acknowledge, I think.

I agree that for a lot of business travel, temporary suspension of access to some data or some apps while traveling need only be a small price to pay relative to the threat of a serious breach. In the consumer space, the potential risk posed by insecure Internet-enabled toasters and Internet-enabled toothbrushes outweighs the value these things can possibly generate by so many times, it's not even funny. 

Engineers and computer scientists tend to have a "yes we can" mentality to using technology to solve human problems. Without it, horses would still be our main mode of travel and the abacus would still be our main tool for supporting mathematical calculations.

But as we zero-in on making security much more of a priority in light of what adversaries are capable of now, we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

There will always be lots of use cases in cyber security where we have no choice but to engage in pitched battles against our opponents, facing off with the very latest in cutting edge technology. No quarter asked - and none given. Sometimes with no spending limit either.

But there are also some cyber security battles that are just not worth fighting - engaging in them  actually plays right into the hands of adversaries.

We've got to be better served by more of us being willing to  embrace the full end to end gamut of high tech and low tech cyber security options that are available to us, if only we'd pause to seriously consider them all.

That has to be better than automatically rising to the challenge - or the bait - each and every time.

 

COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4719
PUBLISHED: 2020-09-24
The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
CVE-2020-15604
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-24560
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-25596
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. T...
CVE-2020-25597
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. Howeve...