Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/16/2019
10:30 AM
Ben Haley
Ben Haley
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv

Are You Listening to Your Kill Chain?

With the right tools and trained staff, any organization should be able to deal with threats before information is compromised.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
MarkSindone
50%
50%
MarkSindone,
User Rank: Moderator
1/27/2019 | 10:40:04 PM
They evolve just as much
There is just so much that we can do in the prevention of attacks. Regardless of how tough we think our security measures might be, attackers might just be even more advanced than we really are. That is simply how evolvement truly works and we need to stay ahead of the attackers in order to come up with a solution.
b haley
50%
50%
b haley,
User Rank: Author
1/23/2019 | 11:24:16 AM
Re: Just Sniff them out
Thank you for reading and engaging in this discussion. You are right that it takes time for hackers to do their work and time to detect them. That part is a race condition. Can we spot, block and remove the hacker before they accomplish their goal. There are several sides to tilt the odds in our favor. the 3 I think are most important are actionable alerts, quick remediation, and proactive defenses.

If our detection tools can identify attacks quickly, clearly, with relevant information, and with certainty; we can take action. Looking at the forensics from major breaches, we captured great intelligence and usually identified the attack many times. However, the security team didn't get the details or have confidence that it was a real problem in all the noise. That feels like a problem with clarity and certainty, not identification. Most pitches I hear are all about speed to detect. My core premise is a tool giving alerts that cannot be acted on will be ignored. It gives only a false sense of security.

We have tools to quickly isolate and remediate machines. No excuse for not having those in place.

Proactive defenses provide some space between the attack and its completion. We see attacks where it is clear the hackers know what they are after in terms of servers, applications and sometimes passwords. By the time someone sees an IDS alert, that hacker has the info they were after. An IPS that shuts off access is speeding up the time to isolation, but is still in a race and false alarms impact operations. When users complain, security tends to loosen constraints, making detection slower.

Proactive defenses, those in place before the hacker attacks, at least slow the attack. Not talking about esoteric here. Firewalls, MFA, DLP, honeybots... all put speedbumps in the path and detection points. My gold standard for actionable alert is someone logging into a honeypot. Hackers are wasting time and giving away information on where they are, what they are after and whose credentials they are using. Honeypots weakness is a hacker must find the honeypot a more attractive target than real systems. With inside knowledge or good luck, the hacker avoids those defenses.

Another proactive example is my company builds tools to limit traffic from the server side (opposite the firewall approach). If you try to access a server from too far away (outside the data center, outside the cluster, outside the company...), an alert identifies the attack source, destination and target app. At the same time, the server cannot respond to the attacker so it is effectifly cloaked. While the attacker is trying to figure why this machine they found in LDAP won't respond, the security team is taking action. That gives a proactive defense with highly actionable alarms.

 
ChristopherJames
0%
100%
ChristopherJames,
User Rank: Strategist
1/22/2019 | 2:02:37 AM
Just Sniff them out
Well I don't think you're going to be a very successful hacker if you aren't at least able to hide long enough to get part of your hack in place right? Of course it will take a while for the systems to detect unauthorized entry. The most important part is how long it takes before they are discovered right?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17475
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVE-2020-0255
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-14353
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-17464
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-17473
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.