Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/8/2019
10:00 AM
Ilan Abadi
Ilan Abadi
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Beyond the Horde: The Uptick in Targeted Attacks (And How to Fight Back)

We're seeing a dramatic rise in targeted attacks, but following these guidelines can help your enterprise stay safe.

In the TV series The Walking Dead, zombies move with no clear direction, searching for food, and looking for their next victim. When the zombies find a point of vulnerability, they lock in on it and attack. Over the past two years, malware — including WannaCry and NotPetya — have invaded vulnerable targets in a similar way, scanning the Internet to find weak spots and causing considerable damage.

Beyond these somewhat random attacks, we're also seeing a dramatic rise in targeted attacks on large organizations. The first quarter of 2019 saw a 195% increase in the number of ransomware attacks compared with the last quarter of 2018, and up to the time of writing this, the year has seen an increase of 500%. In other words, malware attacks now tend to operate less in a manner of "horde waves" and more as a targeted process, with advanced tools that can cause massive damage.

Information security managers are on alert, as too often attacks happen without any warning and can affect the organization quickly, leaving the security team with an urgent need to resolve problems that can expand and worsen by the second.

Unfortunately, the possibility of receiving real-time intelligence and indications of compromise (IoCs) during a direct point attack is slight to nonexistent. Information security platforms must now include real-time capabilities, including advanced robotic patch processes, artificial intelligence, and quick incidence response to new threats. These are the basis of the steps suggested below. I believe there are other solutions, but this protocol has been applied in practice and proven to be effective.

Back to Basics
Those who are responsible for cybersecurity must build a robust security patch process that can be implemented rapidly. Along with standard processes, we need an outbreak patch process that will allow organizations to react fast to critical vulnerability. This is no easy task for large enterprises, which have complicated enterprise resource planning systems and OT environments.

When we can't react quickly or when the cycle of patch updates is long, we must develop compensatory controls that will help manage the exposure to risk. These controls must be tested to ensure their effectiveness.

Though this patch management effort may be regarded as complicated and Sisyphean — perhaps even as archaic and dated — when such endeavors are operated correctly, many organizations see success with them.

Real-Time Governance
In addition to the robust array of updates and compensatory controls, we must develop the ability to understand the exposure associated with specific vulnerabilities in real time or near real time. To support this task, organizations can build a governance platform that will scan networks and devices on a regular basis, along with maintaining a data lake that can run an analytic search for potential and real-time threats that have shown up.

Intelligence and Immediate Actions
Prior knowledge of intentional targeted attacks is almost nonexistent; nevertheless, there is quite a lot of information about recent known attacks throughout the network, when there is an IOC accessible.

Using the services of intelligence companies is mandatory, and we are obligated to gather information on every lead of an attack/new vulnerability, analyze its features and look for defense methods that will suit the revealed exposure. Closing and tightening a gap will not always be a technological option; therefore, enforcing an intermediate policy is needed to reduce time gaps that can lead to fast-spreading viruses and other attacks. 

"Special Forces" Team
Enterprises need a solid protocol for responding to threats that goes beyond the IT department and enlists the support of business units throughout the organization. During the early 1970s, during the Cold War, the White House held daily morning meetings with authorized officials in order to conclude whether or not the Russians would attack. Having daily briefings — or as needed — is as relevant today, when we are armed with exponentially more information, as it was over 50 years ago.

Daily risk analysis works best when the organization creates a special task force. Decision support systems should be embraced daily by this team and should include skilled functionaries from the different IT units and representatives from key business units whose data may be at the most risk of attack. By meeting daily (or ad hoc because of a new possible threat) and reviewing intelligence information alerts, these mission-critical teams can gather intel, analyze, and apply control tools to map and assess different risks. Once data analysis is established, the team should apply a solution/actions and follow up protocols through the different IT units and business units.

Cyber war is not a cold war. It is made up of continued threats, and it's an extremely dynamic 24/7 challenge. As such, there is no replacement for teams, tools, and constant, daily vigilance.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Active Directory Security Tips for Your Poor, Neglected AD"

Ilan Abadi joined Teva Pharmaceutical Industries in May 2012 as Global CISO. In his current role, Ilan is in charge of establishing cybersecurity strategy and structure and managing ongoing cyber activities, including current and future security threats. Among his ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19037
PUBLISHED: 2019-11-21
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.
CVE-2019-19036
PUBLISHED: 2019-11-21
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
CVE-2019-19039
PUBLISHED: 2019-11-21
__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program.
CVE-2019-6852
PUBLISHED: 2019-11-20
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP har...
CVE-2019-6853
PUBLISHED: 2019-11-20
A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server.