Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/8/2019
10:00 AM
Ilan Abadi
Ilan Abadi
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Beyond the Horde: The Uptick in Targeted Attacks (And How to Fight Back)

We're seeing a dramatic rise in targeted attacks, but following these guidelines can help your enterprise stay safe.

In the TV series The Walking Dead, zombies move with no clear direction, searching for food, and looking for their next victim. When the zombies find a point of vulnerability, they lock in on it and attack. Over the past two years, malware — including WannaCry and NotPetya — have invaded vulnerable targets in a similar way, scanning the Internet to find weak spots and causing considerable damage.

Beyond these somewhat random attacks, we're also seeing a dramatic rise in targeted attacks on large organizations. The first quarter of 2019 saw a 195% increase in the number of ransomware attacks compared with the last quarter of 2018, and up to the time of writing this, the year has seen an increase of 500%. In other words, malware attacks now tend to operate less in a manner of "horde waves" and more as a targeted process, with advanced tools that can cause massive damage.

Information security managers are on alert, as too often attacks happen without any warning and can affect the organization quickly, leaving the security team with an urgent need to resolve problems that can expand and worsen by the second.

Unfortunately, the possibility of receiving real-time intelligence and indications of compromise (IoCs) during a direct point attack is slight to nonexistent. Information security platforms must now include real-time capabilities, including advanced robotic patch processes, artificial intelligence, and quick incidence response to new threats. These are the basis of the steps suggested below. I believe there are other solutions, but this protocol has been applied in practice and proven to be effective.

Back to Basics
Those who are responsible for cybersecurity must build a robust security patch process that can be implemented rapidly. Along with standard processes, we need an outbreak patch process that will allow organizations to react fast to critical vulnerability. This is no easy task for large enterprises, which have complicated enterprise resource planning systems and OT environments.

When we can't react quickly or when the cycle of patch updates is long, we must develop compensatory controls that will help manage the exposure to risk. These controls must be tested to ensure their effectiveness.

Though this patch management effort may be regarded as complicated and Sisyphean — perhaps even as archaic and dated — when such endeavors are operated correctly, many organizations see success with them.

Real-Time Governance
In addition to the robust array of updates and compensatory controls, we must develop the ability to understand the exposure associated with specific vulnerabilities in real time or near real time. To support this task, organizations can build a governance platform that will scan networks and devices on a regular basis, along with maintaining a data lake that can run an analytic search for potential and real-time threats that have shown up.

Intelligence and Immediate Actions
Prior knowledge of intentional targeted attacks is almost nonexistent; nevertheless, there is quite a lot of information about recent known attacks throughout the network, when there is an IOC accessible.

Using the services of intelligence companies is mandatory, and we are obligated to gather information on every lead of an attack/new vulnerability, analyze its features and look for defense methods that will suit the revealed exposure. Closing and tightening a gap will not always be a technological option; therefore, enforcing an intermediate policy is needed to reduce time gaps that can lead to fast-spreading viruses and other attacks. 

"Special Forces" Team
Enterprises need a solid protocol for responding to threats that goes beyond the IT department and enlists the support of business units throughout the organization. During the early 1970s, during the Cold War, the White House held daily morning meetings with authorized officials in order to conclude whether or not the Russians would attack. Having daily briefings — or as needed — is as relevant today, when we are armed with exponentially more information, as it was over 50 years ago.

Daily risk analysis works best when the organization creates a special task force. Decision support systems should be embraced daily by this team and should include skilled functionaries from the different IT units and representatives from key business units whose data may be at the most risk of attack. By meeting daily (or ad hoc because of a new possible threat) and reviewing intelligence information alerts, these mission-critical teams can gather intel, analyze, and apply control tools to map and assess different risks. Once data analysis is established, the team should apply a solution/actions and follow up protocols through the different IT units and business units.

Cyber war is not a cold war. It is made up of continued threats, and it's an extremely dynamic 24/7 challenge. As such, there is no replacement for teams, tools, and constant, daily vigilance.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Active Directory Security Tips for Your Poor, Neglected AD"

Ilan Abadi joined Teva Pharmaceutical Industries in May 2012 as Global CISO. In his current role, Ilan is in charge of establishing cybersecurity strategy and structure and managing ongoing cyber activities, including current and future security threats. Among his ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16404
PUBLISHED: 2019-10-21
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
CVE-2019-17400
PUBLISHED: 2019-10-21
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2019-17498
PUBLISHED: 2019-10-21
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a ...
CVE-2019-16969
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16974
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.