Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/8/2019
10:00 AM
Ilan Abadi
Ilan Abadi
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Beyond the Horde: The Uptick in Targeted Attacks (And How to Fight Back)

We're seeing a dramatic rise in targeted attacks, but following these guidelines can help your enterprise stay safe.

In the TV series The Walking Dead, zombies move with no clear direction, searching for food, and looking for their next victim. When the zombies find a point of vulnerability, they lock in on it and attack. Over the past two years, malware — including WannaCry and NotPetya — have invaded vulnerable targets in a similar way, scanning the Internet to find weak spots and causing considerable damage.

Beyond these somewhat random attacks, we're also seeing a dramatic rise in targeted attacks on large organizations. The first quarter of 2019 saw a 195% increase in the number of ransomware attacks compared with the last quarter of 2018, and up to the time of writing this, the year has seen an increase of 500%. In other words, malware attacks now tend to operate less in a manner of "horde waves" and more as a targeted process, with advanced tools that can cause massive damage.

Information security managers are on alert, as too often attacks happen without any warning and can affect the organization quickly, leaving the security team with an urgent need to resolve problems that can expand and worsen by the second.

Unfortunately, the possibility of receiving real-time intelligence and indications of compromise (IoCs) during a direct point attack is slight to nonexistent. Information security platforms must now include real-time capabilities, including advanced robotic patch processes, artificial intelligence, and quick incidence response to new threats. These are the basis of the steps suggested below. I believe there are other solutions, but this protocol has been applied in practice and proven to be effective.

Back to Basics
Those who are responsible for cybersecurity must build a robust security patch process that can be implemented rapidly. Along with standard processes, we need an outbreak patch process that will allow organizations to react fast to critical vulnerability. This is no easy task for large enterprises, which have complicated enterprise resource planning systems and OT environments.

When we can't react quickly or when the cycle of patch updates is long, we must develop compensatory controls that will help manage the exposure to risk. These controls must be tested to ensure their effectiveness.

Though this patch management effort may be regarded as complicated and Sisyphean — perhaps even as archaic and dated — when such endeavors are operated correctly, many organizations see success with them.

Real-Time Governance
In addition to the robust array of updates and compensatory controls, we must develop the ability to understand the exposure associated with specific vulnerabilities in real time or near real time. To support this task, organizations can build a governance platform that will scan networks and devices on a regular basis, along with maintaining a data lake that can run an analytic search for potential and real-time threats that have shown up.

Intelligence and Immediate Actions
Prior knowledge of intentional targeted attacks is almost nonexistent; nevertheless, there is quite a lot of information about recent known attacks throughout the network, when there is an IOC accessible.

Using the services of intelligence companies is mandatory, and we are obligated to gather information on every lead of an attack/new vulnerability, analyze its features and look for defense methods that will suit the revealed exposure. Closing and tightening a gap will not always be a technological option; therefore, enforcing an intermediate policy is needed to reduce time gaps that can lead to fast-spreading viruses and other attacks. 

"Special Forces" Team
Enterprises need a solid protocol for responding to threats that goes beyond the IT department and enlists the support of business units throughout the organization. During the early 1970s, during the Cold War, the White House held daily morning meetings with authorized officials in order to conclude whether or not the Russians would attack. Having daily briefings — or as needed — is as relevant today, when we are armed with exponentially more information, as it was over 50 years ago.

Daily risk analysis works best when the organization creates a special task force. Decision support systems should be embraced daily by this team and should include skilled functionaries from the different IT units and representatives from key business units whose data may be at the most risk of attack. By meeting daily (or ad hoc because of a new possible threat) and reviewing intelligence information alerts, these mission-critical teams can gather intel, analyze, and apply control tools to map and assess different risks. Once data analysis is established, the team should apply a solution/actions and follow up protocols through the different IT units and business units.

Cyber war is not a cold war. It is made up of continued threats, and it's an extremely dynamic 24/7 challenge. As such, there is no replacement for teams, tools, and constant, daily vigilance.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Active Directory Security Tips for Your Poor, Neglected AD"

Ilan Abadi joined Teva Pharmaceutical Industries in May 2012 as Global CISO. In his current role, Ilan is in charge of establishing cybersecurity strategy and structure and managing ongoing cyber activities, including current and future security threats. Among his ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16863
PUBLISHED: 2019-11-14
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVE-2019-18949
PUBLISHED: 2019-11-14
SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration.
CVE-2011-1930
PUBLISHED: 2019-11-14
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.
CVE-2011-1145
PUBLISHED: 2019-11-14
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
CVE-2011-1488
PUBLISHED: 2019-11-14
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent withi...