Are You Ready For State-Sponsored Cyber Attack?

 

Geopolitical tensions ensure that 2017 will be another big year for state-sponsored cyber attacks.  The lethality of state-sponsored attacks derives from their ability to bypass security point products by combining device, network and data center vulnerabilities into an integrated assault.  

Another aspect of state-sponsored cyber-attacks is their willingness to patiently creep from organisation to organisation to get to their target.

Irrespective of the lethality of state-sponsored cyber-attacks, it is a mistake to think that there is no way to stop them.  If your organisation has something of value to a foreign government here are five cyber-attack counter-measures you should be implementing.

Verify User Identity

Phishing to steal credentials is the #1 technique used by foreign governments to gain access to sensitive data.  Why? It works.  The bigger an organisation, the greater the number of supply chain partners, the easier it becomes for cyber attackers to steal credentials.   

The foundational security control to stop credential theft is 2 factor authentication.  To make it less painful, you can extend the session timeout to a full workday.  

To protect more sensitive business critical apps, consider a certificate-based VPN that binds the user identity to their device.  While it is possible to steal a certificate, as soon as you have 2 connections from the same cert you instantly know there’s a breach.

Check Device and Server Software

Right after identity theft, malware is the next favorite cyber-attack technique.  Installing malware on user devices and Internet accessible servers has become commonplace today.   There’s now a robust international marketplace for zero-day attacks and server exploits.

Malware detection software has greatly improved in recent years so there’s no reason not to implement it.  Code signing has been around for a while but IT organisations don’t like setting up PKI services to generate and verify digital certificates. However, this is a critical control for any large organisation.

Match Authorisation to Role

The OPM cyber attackers utilised non-active contractor account to gain access to the data center.  Unfortunately, most organisations maintain non-active accounts for tax purposes, even though users don't need access to the data center.

Make sure the authorisation level matches the role of the user.  If you need to keep identities active for tax or retirement purposes, consider migrating non-active accounts to externally hosted identity services and allowing access only to partitioned services.

Protect Data Encryption and Virtual Desktops

Many IT managers assume that by encrypting data or putting it behind a virtual desktop they are safe they are safe from theft. Unfortunately, most data encryption systems automatically decrypt data for authorised users.  Additionally, virtual desktop solutions are vulnerable to the same server exploits and data center attacks as regular PCs.

To protect against a state-sponsored cyber-attack, data encryption and virtual desktop solutions need the same protections against credential theft and lateral movement that Internet accessible systems have. Implement access controls and network partitions to protect high value data encryption and virtual desktops.

Partition Supply Chain Resources

Most Fortune 500 companies have outsourced some aspect of their mission critical operations to a supply chain partner.  Unfortunately, when partner personnel have all the same internal access as employee’s traditional perimeter security systems are of little value.  It gets even worse when one considers that most outsourcing companies outsource their activities to other outsource companies.

Partition your data center so resources accessed by supply chain partners have no lateral access to sensitive data.  One strategy that has been successfully used is migrate partner apps to a public cloud and utilise a secure application-layer connection back to the data center.  This way if there is a breach, it’s contained to a public cloud.

We can’t stop foreign governments from attacking nations but we can stop the attacks from being successful!  We now have enough data on their techniques to design counter-measures. We need to implement them.

CTO Vison:             What Happens When Two Countries Fight A Cyber War?:

 Surprise: N Korea Hacked S Korea Cyber Command:   

 

 

« Internet Has Changed The Media Business Model
Robots Will Take Our Jobs – But That's Good. »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Grid32

Grid32

Grid32 provides independent computer system and physical security audit services to government and corporate clients of all sizes.

CERT.GOV.AZ

CERT.GOV.AZ

Azerbaijan Government Computer Incident Response Team

MNCERT/CC

MNCERT/CC

MNCERT/CC is the national Computer Emergency Response Team for Mongolia.

Baffle

Baffle

Baffle is pioneering a solution that makes data breaches irrelevant by keeping data encrypted from production through processing.

RedLock

RedLock

The RedLock Cloud 360TM platform correlates disparate security data sets to provide a unified view of risks across fragmented cloud environments.

Metrarc

Metrarc

Metrarc has developed a ground-breaking technology called ICMetrics™ for deriving secure encryption keys from the properties of digital systems without the need to store any of the encryption keys.

BetaDen

BetaDen

BetaDen provides a revolutionary platform for businesses to develop next-generation technology, such as the internet of things and industry 4.0.

Cybersecurity Maturity Model Certification Center of Excellence (CMMC COE)

Cybersecurity Maturity Model Certification Center of Excellence (CMMC COE)

CMMC COE is an IT-AAC sponsored public–private partnership that will be the focal point for entities seeking to achieve Cybersecurity Maturity Model Certification.

Akito

Akito

Akito was set up to become a point of reference in the ICT market for issues related to Security and in particular Cyber Security.

Comparitech

Comparitech

Comparitech strives to promote cyber security and privacy for all. We are committed to providing detailed information to help our readers become more cyber secure and cyber aware.

Across Verticals

Across Verticals

Across Verticals is a boutique cyber security consulting firm that specializes in holistic, deeply technical and end to end cyber security advisory services based on industry best practices.

Guardio

Guardio

Guardio develop tools and products to combat modern web and browser threats.

SecOps Group

SecOps Group

SecOps Group is a boutique cybersecurity consultancy helping enterprises identify & eliminate security risks on a continuous basis.

Arcserve

Arcserve

Defend your data with Arcserve all-in-one data protection and management solutions designed to be the right fit for your business, regardless of size or complexity.

Velum Labs

Velum Labs

Velum Labs is a cyber intelligence company that provides simple and non-intrusive, cloud and cyber intelligence solutions; built from a market-leading understanding of cyber-attack methodology.

Aliro Security

Aliro Security

AliroNet is the world’s first entanglement Advanced Secure Network solution.