Data Breaches Attack All Parts Of A Business

Data breaches are an enterprise problem involving legal counsel, human resources, corporate communications and other incident response (IR) stakeholders, say Verizon.

This is based on Verizon’s Data Breach Directory (DBD) case files that provide most of the data for its Data Breach Investigations Report (DBIR), and the latest report lists the 16 most common or lethal data breach scenarios from the point of view of IR stakeholders.

Each scenario is based on anonymised real-world data breach responses and is designed to resonate with IR stakeholders to help them improve their future contributions to data breach responses.

The DBD also maps incident patterns, showing that the accommodation and food services industry needs to focus on point of sales (PoS) intrusions and distributed denial of service (DDoS) attacks, for example, while public administration should focus on insider threats, privilege misuse and crime-ware.

“Companies need to be prepared to handle data breaches before they happen in order to recover as quickly as possible, otherwise breaches can lead to enterprise-wide damage that can have devastating and long-lasting consequences, such as loss of customer confidence,” said Bryan Sartin, executive director of Verizon’s computer forensics practice.

“The DBD is designed to help businesses and government organisations understand how to identify signs of data breach, important sources of evidence and ways to investigate, contain and recover from a breach quickly,” he said.

The report also highlights five actions organisations should take after a breach:

  • Preserve evidence and consider the consequences of every action taken.
  • Be flexible enough to adapt to evolving situations.
  • Establish consistent methods for communication.
  • Know your limitations and collaborate with other stakeholders when necessary.
  • Document all actions and findings, and be prepared to explain them.

“Preserving evidence is very important, but often investigators are told that an affected machine has been wiped and consequently they have very little to work with,” said Laurance Dine, managing principal of investigative response at Verizon Enterprise Solutions.

“In addition to preserving evidence and documenting absolutely everything, it is also extremely helpful if organisations can give investigators a ‘golden image’ for machines because that makes it easy to eliminate everything that should be there, so we can concentrate on whatever remains,” he said.

The “Absolute Zero” scenario deals with the human element in the form of security risks of disgruntled employees and maps to the human resources department, for example, while the “Panda Monium” deals with conduit devices, specifically security risks of internet of things (IoT) devices and maps to the incident response commander.

Each scenario indicates the sophistication level, the associated incident pattern drawn from the DBIR, the time to discovery, the time to containment, the industries typically targeted, the threat actor involved, typical motives, key IR stakeholders and recommended countermeasures.

Panda Monium scenario

In the case of the Panda Monium scenario, involving IoT devices within an organisation being used to carry out a DDoS attack on the organisation, the sophistication level is 2 to 3, the incident pattern is DDoS attacks along with privilege misuse and crime-ware, the time to discovery is normally measured in hours, time to containment is also measured in hours, threat actors are likely to include activists and state-affiliated actors.

Motives are likely to include grudges and ideology, tactics are likely to include privilege abuse and the exploitation of vulnerabilities, targeted industries are likely to include education and manufacturing, and stakeholders include the incident commander as well as legal counsel and corporate communications.

Although this kind of attack is not common, it is currently classified as “lethal” because it can paralyse organisations, but it is likely to become more common in future, said Dine.

Verizon notes that security is often an afterthought when it comes to IoT devices, which means these devices are often vulnerable to a wide array of threats.

The scenario included in the DBB is about a university that was experiencing slow or inaccessible network connectivity that was eventually linked to a type of denial of service (DoS) attack that used vending machines and other IoT devices on the university network to carry out domain name system (DNS) lookups for subdomains related to seafood.

“This was an unusual case because the university’s own IoT infrastructure was being used to slow down the network through DNS lookups rather than external IoT devices being used in a classic DDoS attack to bombard the target with online requests,” said Dine.  

The firewall analysis identified more than 5,000 discrete systems making hundreds of DNS lookups every 15 minutes, with nearly all systems on the segment of the network dedicated to the university’s IoT infrastructure.

Analysis of the domains requested identified that only 15 distinct IP addresses were returned, and four of these IP addresses and close to 100 of the domains appeared in recent indicator lists for an emergent IoT botnet.

Although Verizon is unwilling to confirm any details, the fact that the incident took place in the past year and that the botnet spread from device to device by brute-forcing default and weak passwords, makes it likely that the scenario is based on an attack by the Mirai botnet or one of its variants.

Once the password was known, the DBB said the malware had full control of the device and would check in with command infrastructure for updates and change the device’s password, locking investigators out of the 5,000 affected systems.

Analysis of previous malware samples had shown that the control password, used to issue commands to infected systems, was also used as the newly updated device password. These commands were typically received via hypertext transfer protocol (HTTP) and, in many cases, did not rely on secure sockets layer (SSL) to encrypt the transmissions.

Assuming that this was also the case in the university attack, incident responders set up a full packet capture capability to inspect the network traffic and identify the new device password. Once captured, the information was used to perform a password change before the next malware update to regain control of all IoT devices and remove the malware infection.

The DBD recommends the following mitigations/countermeasures:

  • Create separate network zones for IoT systems so they are air-gapped from other critical systems.
  • Do not allow direct ingress or egress connectivity to the Internet.
  • Implement an in-line content filtering system.
  • Change default credentials on devices.
  • Use strong and unique passwords for device accounts and Wi-Fi networks.
  • Regularly monitor events and logs to hunt for threats at endpoints and at the network level.
  • Scan for open remote access protocols on your network.
  • Disable commonly unused and unsecured features and services, such as Universal Plug and Play.
  • Include IoT devices in IT asset inventory.
  • Regularly check manufacturer websites for firmware updates.
  • Ensure secure configurations for hardware and software.
  • Limit and control network ports, protocols and services.
  • Secure configurations for network devices such as routers and switches.

The DBB recommends that anyone responding to an IoT security incident should:

Develop and follow predesigned IR playbooks to tackle IoT device-related incidents.
Scope and contain the incident immediately by segregating the affected subnet.
Restrict network ingress and egress communication to/from the affected subnet.
Change admin or console passwords of the IoT systems and controllers.
Use network forensics, to include network logs, NetFlow data and packet captures.
Consider informing law enforcement and government computer emergency response teams.

The DBB notes that the rapid proliferation of IoT devices has led to as many new issues as the underlying devices were intended to solve.

“The underlying problem is that many IoT manufacturers are primarily designing their devices for functionality, and proper security testing often takes a back seat,” the report said. “It is even more necessary with IoT devices that the buyer scrutinises the security of any devices they use.”

According to Verizon, IoT botnets spread quickly because they do not face some of the problems conventional botnets do, due to the fact that IoT devices are often rarely patched or updated.

Also, the makers of IoT devices, along with the users that own and operate them, are not always directly affected by a compromise or even immediately aware that their devices played a role in a cyber security incident.

In a number of these circumstances, the IoT environment used in an attack is not actually the intended victim, but rather an involuntary accomplice that is being used to attack an unrelated third-party target, the report said.

“IoT threats go well beyond a typical security breach where concerns revolve around the theft of confidential data. In this new age of IoT breaches, we are seeing a growing and wide-ranging impact in our physical world as well as on human life and even a changing financial and legal liability landscape,” the report said, adding that this should prompt organisations to think about IoT threat modelling in a way that incorporates security and privacy by design.

“An IoT solution requires a detailed and comprehensive security and privacy framework, an area that, unfortunately, still requires a lot of work on design, as well as a substantial impetus on collaboration by the IoT market players on the underlying security,” the report said.

Computer Weekly

Directors Report January 2017. Cyber Security Checklist For Management (£):

 

 

« Ethics of Drones, Remote Weapons and Robots
Stealthy Malware Is Going Mainstream »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Cleo

Cleo

Cleo is a leader in secure information integration, enabling both ease and excellence in business data movement and orchestration.

Wilson Sonsini Goodrich & Rosati (WSGR)

Wilson Sonsini Goodrich & Rosati (WSGR)

WSGR is the premier provider of legal services to technology, life sciences, and growth enterprises worldwide. Practice areas include cybersecurity and data protection.

CLUSIL

CLUSIL

CLUSIL is an association for the information security industry in Luxembourg.

Eustema

Eustema

Eustema designs and manages ICT solutions for medium and large organizations.

Fidus Information Security

Fidus Information Security

Fidus is a team of security professionals providing Penetration Testing and Cyber Security Consulting services throughout the UK and worldwide.

Novastor

Novastor

NovaStor® is an award-winning, international data backup and recovery software company with solutions supporting physical, virtual and cloud environments.

SECURITI.ai

SECURITI.ai

SECURITI.ai's PrivacyOps platform is a full-stack solution that operationalizes and simplifies privacy compliance using robotic automation and a natural language interface.

BrandProtections.Online

BrandProtections.Online

BrandProtections.online offer end-to-end customer support solutions to help protect against threats which may affect your brand online.

Innovex Global

Innovex Global

Innovex is a full-service executive search and advisory business that engages with early-stage startups, scale-ups, and established businesses in the Fintech, Cybersecurity and Technology industries.

eCloudvalley Digital Technology

eCloudvalley Digital Technology

eCloudvalley Digital Technology is a born-in-the-cloud partner focused entirely on AWS services across APAC region.

EDGE Group

EDGE Group

EDGE is one of the world’s leading advanced technology groups, established to develop agile, bold and disruptive solutions for defence and beyond.

Riot Security

Riot Security

In today's world, most successful cyberattacks start by a human failure. Riot have developed a platform that makes it easy to prepare your employees for cyberattacks, in a way they love.

B2Bcert

B2Bcert

B2BCERT one of the top companies offering ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 27001, ISO 20000,CE Marking, HACCP, and other globally accepted standards and Management solutions.

Issue53

Issue53

We empower organizations to thrive in the digital landscape. Strengthen your defenses, enhance resilience – Choose Issue53 for a secure and future-ready IT environment.

Precision Cybertechnologies & Digital Solutions (Precision-Cyber)

Precision Cybertechnologies & Digital Solutions (Precision-Cyber)

Precision-Cyber was founded on the philosophy of state-of-the-art cybersecurity and digital solutions. Our guiding principle is simply that we will provide and secure all your digital needs.

Cybersecurity Elastic Laboratory (CEL)

Cybersecurity Elastic Laboratory (CEL)

CEL specialize in providing top-tier services in vulnerability diagnosis and penetration testing, offering a comprehensive suite of solutions to mitigate cyber risks.