Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10:00 AM
Ilan Abadi
Ilan Abadi
Connect Directly
E-Mail vvv

Beyond the Horde: The Uptick in Targeted Attacks (And How to Fight Back)

We're seeing a dramatic rise in targeted attacks, but following these guidelines can help your enterprise stay safe.

In the TV series The Walking Dead, zombies move with no clear direction, searching for food, and looking for their next victim. When the zombies find a point of vulnerability, they lock in on it and attack. Over the past two years, malware — including WannaCry and NotPetya — have invaded vulnerable targets in a similar way, scanning the Internet to find weak spots and causing considerable damage.

Beyond these somewhat random attacks, we're also seeing a dramatic rise in targeted attacks on large organizations. The first quarter of 2019 saw a 195% increase in the number of ransomware attacks compared with the last quarter of 2018, and up to the time of writing this, the year has seen an increase of 500%. In other words, malware attacks now tend to operate less in a manner of "horde waves" and more as a targeted process, with advanced tools that can cause massive damage.

Information security managers are on alert, as too often attacks happen without any warning and can affect the organization quickly, leaving the security team with an urgent need to resolve problems that can expand and worsen by the second.

Unfortunately, the possibility of receiving real-time intelligence and indications of compromise (IoCs) during a direct point attack is slight to nonexistent. Information security platforms must now include real-time capabilities, including advanced robotic patch processes, artificial intelligence, and quick incidence response to new threats. These are the basis of the steps suggested below. I believe there are other solutions, but this protocol has been applied in practice and proven to be effective.

Back to Basics
Those who are responsible for cybersecurity must build a robust security patch process that can be implemented rapidly. Along with standard processes, we need an outbreak patch process that will allow organizations to react fast to critical vulnerability. This is no easy task for large enterprises, which have complicated enterprise resource planning systems and OT environments.

When we can't react quickly or when the cycle of patch updates is long, we must develop compensatory controls that will help manage the exposure to risk. These controls must be tested to ensure their effectiveness.

Though this patch management effort may be regarded as complicated and Sisyphean — perhaps even as archaic and dated — when such endeavors are operated correctly, many organizations see success with them.

Real-Time Governance
In addition to the robust array of updates and compensatory controls, we must develop the ability to understand the exposure associated with specific vulnerabilities in real time or near real time. To support this task, organizations can build a governance platform that will scan networks and devices on a regular basis, along with maintaining a data lake that can run an analytic search for potential and real-time threats that have shown up.

Intelligence and Immediate Actions
Prior knowledge of intentional targeted attacks is almost nonexistent; nevertheless, there is quite a lot of information about recent known attacks throughout the network, when there is an IOC accessible.

Using the services of intelligence companies is mandatory, and we are obligated to gather information on every lead of an attack/new vulnerability, analyze its features and look for defense methods that will suit the revealed exposure. Closing and tightening a gap will not always be a technological option; therefore, enforcing an intermediate policy is needed to reduce time gaps that can lead to fast-spreading viruses and other attacks. 

"Special Forces" Team
Enterprises need a solid protocol for responding to threats that goes beyond the IT department and enlists the support of business units throughout the organization. During the early 1970s, during the Cold War, the White House held daily morning meetings with authorized officials in order to conclude whether or not the Russians would attack. Having daily briefings — or as needed — is as relevant today, when we are armed with exponentially more information, as it was over 50 years ago.

Daily risk analysis works best when the organization creates a special task force. Decision support systems should be embraced daily by this team and should include skilled functionaries from the different IT units and representatives from key business units whose data may be at the most risk of attack. By meeting daily (or ad hoc because of a new possible threat) and reviewing intelligence information alerts, these mission-critical teams can gather intel, analyze, and apply control tools to map and assess different risks. Once data analysis is established, the team should apply a solution/actions and follow up protocols through the different IT units and business units.

Cyber war is not a cold war. It is made up of continued threats, and it's an extremely dynamic 24/7 challenge. As such, there is no replacement for teams, tools, and constant, daily vigilance.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Active Directory Security Tips for Your Poor, Neglected AD"

Ilan Abadi joined Teva Pharmaceutical Industries in May 2012 as Global CISO. In his current role, Ilan is in charge of establishing cybersecurity strategy and structure and managing ongoing cyber activities, including current and future security threats. Among his ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-21
In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185196177
PUBLISHED: 2021-06-21
In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185193932
PUBLISHED: 2021-06-21
Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
PUBLISHED: 2021-06-21
In updateDrawable of StatusBarIconView.java, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege by running foreground services without notifying the user, with User execution privileges needed. User interaction is not needed for explo...
PUBLISHED: 2021-06-21
In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: ...