Data Breaches Attack All Parts Of A Business

Data breaches are an enterprise problem involving legal counsel, human resources, corporate communications and other incident response (IR) stakeholders, say Verizon.

This is based on Verizon’s Data Breach Directory (DBD) case files that provide most of the data for its Data Breach Investigations Report (DBIR), and the latest report lists the 16 most common or lethal data breach scenarios from the point of view of IR stakeholders.

Each scenario is based on anonymised real-world data breach responses and is designed to resonate with IR stakeholders to help them improve their future contributions to data breach responses.

The DBD also maps incident patterns, showing that the accommodation and food services industry needs to focus on point of sales (PoS) intrusions and distributed denial of service (DDoS) attacks, for example, while public administration should focus on insider threats, privilege misuse and crime-ware.

“Companies need to be prepared to handle data breaches before they happen in order to recover as quickly as possible, otherwise breaches can lead to enterprise-wide damage that can have devastating and long-lasting consequences, such as loss of customer confidence,” said Bryan Sartin, executive director of Verizon’s computer forensics practice.

“The DBD is designed to help businesses and government organisations understand how to identify signs of data breach, important sources of evidence and ways to investigate, contain and recover from a breach quickly,” he said.

The report also highlights five actions organisations should take after a breach:

  • Preserve evidence and consider the consequences of every action taken.
  • Be flexible enough to adapt to evolving situations.
  • Establish consistent methods for communication.
  • Know your limitations and collaborate with other stakeholders when necessary.
  • Document all actions and findings, and be prepared to explain them.

“Preserving evidence is very important, but often investigators are told that an affected machine has been wiped and consequently they have very little to work with,” said Laurance Dine, managing principal of investigative response at Verizon Enterprise Solutions.

“In addition to preserving evidence and documenting absolutely everything, it is also extremely helpful if organisations can give investigators a ‘golden image’ for machines because that makes it easy to eliminate everything that should be there, so we can concentrate on whatever remains,” he said.

The “Absolute Zero” scenario deals with the human element in the form of security risks of disgruntled employees and maps to the human resources department, for example, while the “Panda Monium” deals with conduit devices, specifically security risks of internet of things (IoT) devices and maps to the incident response commander.

Each scenario indicates the sophistication level, the associated incident pattern drawn from the DBIR, the time to discovery, the time to containment, the industries typically targeted, the threat actor involved, typical motives, key IR stakeholders and recommended countermeasures.

Panda Monium scenario

In the case of the Panda Monium scenario, involving IoT devices within an organisation being used to carry out a DDoS attack on the organisation, the sophistication level is 2 to 3, the incident pattern is DDoS attacks along with privilege misuse and crime-ware, the time to discovery is normally measured in hours, time to containment is also measured in hours, threat actors are likely to include activists and state-affiliated actors.

Motives are likely to include grudges and ideology, tactics are likely to include privilege abuse and the exploitation of vulnerabilities, targeted industries are likely to include education and manufacturing, and stakeholders include the incident commander as well as legal counsel and corporate communications.

Although this kind of attack is not common, it is currently classified as “lethal” because it can paralyse organisations, but it is likely to become more common in future, said Dine.

Verizon notes that security is often an afterthought when it comes to IoT devices, which means these devices are often vulnerable to a wide array of threats.

The scenario included in the DBB is about a university that was experiencing slow or inaccessible network connectivity that was eventually linked to a type of denial of service (DoS) attack that used vending machines and other IoT devices on the university network to carry out domain name system (DNS) lookups for subdomains related to seafood.

“This was an unusual case because the university’s own IoT infrastructure was being used to slow down the network through DNS lookups rather than external IoT devices being used in a classic DDoS attack to bombard the target with online requests,” said Dine.  

The firewall analysis identified more than 5,000 discrete systems making hundreds of DNS lookups every 15 minutes, with nearly all systems on the segment of the network dedicated to the university’s IoT infrastructure.

Analysis of the domains requested identified that only 15 distinct IP addresses were returned, and four of these IP addresses and close to 100 of the domains appeared in recent indicator lists for an emergent IoT botnet.

Although Verizon is unwilling to confirm any details, the fact that the incident took place in the past year and that the botnet spread from device to device by brute-forcing default and weak passwords, makes it likely that the scenario is based on an attack by the Mirai botnet or one of its variants.

Once the password was known, the DBB said the malware had full control of the device and would check in with command infrastructure for updates and change the device’s password, locking investigators out of the 5,000 affected systems.

Analysis of previous malware samples had shown that the control password, used to issue commands to infected systems, was also used as the newly updated device password. These commands were typically received via hypertext transfer protocol (HTTP) and, in many cases, did not rely on secure sockets layer (SSL) to encrypt the transmissions.

Assuming that this was also the case in the university attack, incident responders set up a full packet capture capability to inspect the network traffic and identify the new device password. Once captured, the information was used to perform a password change before the next malware update to regain control of all IoT devices and remove the malware infection.

The DBD recommends the following mitigations/countermeasures:

  • Create separate network zones for IoT systems so they are air-gapped from other critical systems.
  • Do not allow direct ingress or egress connectivity to the Internet.
  • Implement an in-line content filtering system.
  • Change default credentials on devices.
  • Use strong and unique passwords for device accounts and Wi-Fi networks.
  • Regularly monitor events and logs to hunt for threats at endpoints and at the network level.
  • Scan for open remote access protocols on your network.
  • Disable commonly unused and unsecured features and services, such as Universal Plug and Play.
  • Include IoT devices in IT asset inventory.
  • Regularly check manufacturer websites for firmware updates.
  • Ensure secure configurations for hardware and software.
  • Limit and control network ports, protocols and services.
  • Secure configurations for network devices such as routers and switches.

The DBB recommends that anyone responding to an IoT security incident should:

Develop and follow predesigned IR playbooks to tackle IoT device-related incidents.
Scope and contain the incident immediately by segregating the affected subnet.
Restrict network ingress and egress communication to/from the affected subnet.
Change admin or console passwords of the IoT systems and controllers.
Use network forensics, to include network logs, NetFlow data and packet captures.
Consider informing law enforcement and government computer emergency response teams.

The DBB notes that the rapid proliferation of IoT devices has led to as many new issues as the underlying devices were intended to solve.

“The underlying problem is that many IoT manufacturers are primarily designing their devices for functionality, and proper security testing often takes a back seat,” the report said. “It is even more necessary with IoT devices that the buyer scrutinises the security of any devices they use.”

According to Verizon, IoT botnets spread quickly because they do not face some of the problems conventional botnets do, due to the fact that IoT devices are often rarely patched or updated.

Also, the makers of IoT devices, along with the users that own and operate them, are not always directly affected by a compromise or even immediately aware that their devices played a role in a cyber security incident.

In a number of these circumstances, the IoT environment used in an attack is not actually the intended victim, but rather an involuntary accomplice that is being used to attack an unrelated third-party target, the report said.

“IoT threats go well beyond a typical security breach where concerns revolve around the theft of confidential data. In this new age of IoT breaches, we are seeing a growing and wide-ranging impact in our physical world as well as on human life and even a changing financial and legal liability landscape,” the report said, adding that this should prompt organisations to think about IoT threat modelling in a way that incorporates security and privacy by design.

“An IoT solution requires a detailed and comprehensive security and privacy framework, an area that, unfortunately, still requires a lot of work on design, as well as a substantial impetus on collaboration by the IoT market players on the underlying security,” the report said.

Computer Weekly

Directors Report January 2017. Cyber Security Checklist For Management (£):

 

 

« Ethics of Drones, Remote Weapons and Robots
Stealthy Malware Is Going Mainstream »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Frazer-Nash Consultancy

Frazer-Nash Consultancy

Frazer-Nash is a leading engineering, systems and technology company. Areas of expertise include information security and cyber security.

Hogan Lovells

Hogan Lovells

Hogan Lovells is an international business law firm with offices across Europe, Asia and the USA. Practice areas include Privacy & Cybersecurity.

Vera Security

Vera Security

Vera is a data security platform that provides 360-degree visibility and control over critical business data, anywhere it's shared or stored.

Combitech

Combitech

Combitech is the Nordic region’s leading cyber security consultancy firm, with about 260 certified security consultants helping companies and authorities prevent and manage cyber threats.

AFCON Control & Automation

AFCON Control & Automation

AFCON is a leading global provider of software solutions and services for the smart management of Control & Automation systems in the age of Digital Transformation.

IAC

IAC

IAC is a specialist Irecruitment consultancy covering Internal Audit, Risk, Controls, Governance, IT Audit, and Cyber Security roles.

Brainloop

Brainloop

Brainloop's security architecture enables you to work on and distribute strictly confidential documents both within and beyond the firewall.

AdaptiveMobile Security

AdaptiveMobile Security

AdaptiveMobile Security, a world leader in mobile network security, protecting more than 2.2 billion subscribers worldwide.

Uppsala Security

Uppsala Security

Uppsala Security built the first crowdsourced Threat Intelligence platform known as the Sentinel Protocol, which is powered by blockchain technology.

Travelers

Travelers

Travelers is a leading writer of US commercial property casualty insurance and one of the world’s largest global insurers for cyber insurance.

Belden

Belden

Belden is a global leader in signal transmission and security solutions for mission-critical applications in enterprise and industrial markets. Belden brands include Hirschmann and Tofino Security.

Cyvatar

Cyvatar

Cyvatar is a technology-enabled cyber security as a service (CSaaS) provider delivering smarter managed security to help you achieve compliance and security faster and more efficiently.

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection (HIP) is the premier educational forum for identity-centric cybersecurity practitioners charged with defending hybrid cloud environments.

Nuts Technologies

Nuts Technologies

Nuts Technologies are simplifying data privacy and encryption with our innovative and novel data containers we call nuts based on our Zero Trust Data framework.

CaseMatrix

CaseMatrix

Discover a new era of legal intelligence with CaseMatrix. We identify potential class action cases arising from cyber incidents and data breaches.

NetAlly

NetAlly

NetAlly network test solutions help engineers and technicians better deploy, manage, maintain, and secure today’s complex wired and wireless networks.