The bad guys only seem infallible. Use their weaknesses to beat them.

Roselle Safran & Utpal Desai, President of Rosint Labs/Director of Product Management of Bitdefender

April 24, 2019

5 Min Read

Sixth and final installment in a series about the human element in cybersecurity. 

As we close out this series, we look outside of organizations to explore the human weaknesses of attackers. Unlike previous articles, in which we looked introspectively at the defenders and how to reduce mistakes, this installment examines the other side of the equation and how we can use attacker mistakes to our advantage.

Attackers
Attackers are humans just like defenders and so are subject to the same errors and imperfections that we are. They can be single operators, members of a larger crime syndicate, nation-state actors, rogue organizations, or any one of a number of other "hackers." Their intent can be financial gain; retribution to an organization, individual, or employer; disruption or destruction; global dominance; or a variety of other motives. In this article, we use "attackers" to refer to the malware authors who develop the malware used in attacks, and the human hackers at the keyboard who utilize malware, social engineering, and other techniques to conduct cyberattacks on infrastructure, networks, applications, servers, data, and devices.

Common Mistakes
From the defender's perspective, one of the most advantageous mistakes that attackers make is writing a bug, error, or vulnerability into their code. Malware authors, who are programmers like the ones we discussed in our previous article, are not perfect. Prime examples of their imperfections include the "kill switch" found in early WannaCry ransomware malware and, more recently, exception handling errors in LockerGoga ransomware.

In addition, attackers often rely on the same or similar attacks. Attackers who are constrained by resources, time, or capabilities may turn to standard exploit kits and regularly use the same malware. Even when the malware files differ, segments of the malware code are often recycled and reused. Different malware files often point to the same infrastructure, such as the same command and control IP in multiple attacks. Moreover, even when entirely novel malware is used, attackers consistently use the same tactics, techniques, and procedures (TTPs).

Repercussions
When attackers make mistakes, they sometimes simply fail at achieving their desired goals of stealing, spying, exploitation, or disruption and are forced to spend more resources on a given attack. Furthermore, they provide a weakness that defenders can use to their advantage to better prevent, detect, and respond to attacks.

Maximize Mistakes
While our series has been focused on helping defenders understand how to minimize their mistakes, now we want to turn the tables and maximize attacker mistakes.

We can best capitalize on attacker mistakes of coding errors, malware, and TTP reuse and recycling by aggregating and sharing this threat intelligence. With the right data, defenders can build dossiers on threat actors, identify attacker motives and means, and then use this knowledge to limit attacker opportunity through threat modeling. While organizations can, and often do, develop their own threat intelligence, the fast and frequent exchange of threat intelligence among defenders amplifies the positive impact of this work.

For example, if an organization hit with an attack immediately shares that information with its peers, it can essentially help create a "cyber vaccine" that prevents other organizations from falling victim to the same attack. This can be particularly critical in cases of attacker coding errors because identifying these errors often requires malware analysis. Many organizations lack those advanced capabilities and must rely on more sophisticated teams for that analysis. Some security vendors have already begun to incorporate this exchange. When one customer sees a new attack, the associated threat intelligence is extracted and then incorporated into the product for the benefit of every customer.

Organizations can also encourage attacker mistakes and make the cost of an attack higher for the attacker by deploying advanced capabilities such as deception technologies and moving target defenses, which force the attacker to run in circles looking for the target and allow defenders to learn attacker TTPs in the process. Overall, by understanding attackers and their attack profiles, defenders can create an environment where attackers must invest more to make an attack successful.

Change the Paradigm
While society is beginning to understand that cybersecurity attacks are common and difficult to prevent, some organizations are still reluctant to reveal attack details out of fear that doing so would reflect poorly on the organization. As the subject matter experts on cybersecurity, we defenders have the responsibility to educate non-cybersecurity folks on the inevitability of attacks — and breaches — so that both are viewed as part of the cost of doing business in today's environment, and not weaknesses that were a result of someone dropping the ball. Organizations must be able to speak freely about attacks and incidents, without legal counsel restricting information-sharing out of concern that the data can and will be used against the organization in the future. With information sharing, we can collectively make the most out of attacker mistakes.

Conclusion
Cybersecurity is like an arms race. As we grow ever more dependent on technology and billions of interconnected devices, while generating an exponentially increasing volume of data (2.5 quintillion bytes of data at our current pace), we know that attackers will evolve and advance. Therefore, we defenders must evolve and advance as well. And we can make great strides toward doing so, toward getting better at our game and leveling the playing field, by recognizing and minimizing the inevitable human error of end users, security leaders, security analysts, IT security administrators, and programmers — and maximizing inescapable attacker error.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

About the Author(s)

Roselle Safran & Utpal Desai

President of Rosint Labs/Director of Product Management of Bitdefender

Roselle Safran is President of Rosint Labs, a cybersecurity consultancy to security teams, leaders, and startups. She is also the Entrepreneur in Residence at Lytical Ventures, a venture capital firm that invests in cybersecurity startups. Previously, Roselle was CEO and Co-Founder of Uplevel Security, which garnered Fortune 1000 customers and numerous industry accolades under her leadership. Earlier, Roselle managed cybersecurity operations at the Executive Office of the President during the Obama Administration, directing the Security Operations Center that protected and defended the White House's network. Before that, she managed security analysis teams at the Department of Homeland Security's US-CERT and spearheaded the development of two cyber-threat intelligence platforms there. LinkedIn profile.

Utpal "U.J." Desai is a Group Product Manager at Bitdefender. He is responsible for developing the vision and road map of Bitdefender Endpoint Security products. U.J. has over 10 years of experience in the cybersecurity space, specializing in endpoint security. He is passionate about building strong products that address customer needs. Prior to joining Bitdefender, he held product management positions at both Symantec and McAfee. Mr. Desai earned a master's degree in computer science from West Illinois University, and attended executive education courses at University of California Berkeley, Haas School of Business. LinkedIn profile.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights