STE WILLIAMS

Security researchers have been working in overdrive examining processors for issues – and they haven’t come up empty-handed.

Image Source: Adobe Stock (Shawn)

Since the Spectre and Meltdown vulnerabilities knocked the glow off of the new year, 2018 has been the year of the CPU bug. Security researchers have been working in overdrive examining processors for design flaws, firmware bugs, and other vulnerabilities that put an entire computing architecture at risk.

They haven’t come up empty-handed.

Here’s what we’ve had to contend with this year on the CPU vulnerability front — and what we can expect in a couple of weeks when new research hits the stage at Black Hat.

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/endpoint/8-big-processor-vulnerabilities-in-2018/d/d-id/1332293?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Recent fears that this year’s most prolific ransomware threat has acquired new WannaCry-like propagation capabilities appear unfounded at the moment.

The authors of GandCrab, a ransomware sample that in less than six months has become the biggest threat in its category, are continuing to update and tweak the malware to make it harder to stop. But fears in recent days that they might have added a new WannaCry-like capability for spreading GandCrab via SMB shares appear unfounded at the moment.

Security vendor Fortinet recently discovered a new version (4.1) of GandCrab in the wild. Like its predecessor, released just two days prior to the new discovery, the latest version is being distributed through compromised websites designed to appear like download sites for cracked applications. And as with version 4, version 4.1, like the Petya ransomware tool, also uses the faster Salsa2.0 stream cipher to encrypt data instead of the RSA-2048 encryption used in early GandCrab releases.

The biggest difference in GandCrab 4.1 is that it contains a long, hard-coded list of websites to which the malware connects. Once connected to a URL in the list, the malware sends it data — such as the IP address, username, computer name, network domain, and, if present, a list of anti-malware tools on the system — from the infected system.

Interestingly, according to Fortinet, there is no evidence that any one of the websites in GandCrab 4.1’s hard-coded list has actually been compromised. And there’s little logical reason why the authors of GandCrab would want to send victim information to so many hosts at once anyway, when all they really need is to have the information sent to one system. The only explanations, according to the security firm, are that the creators of GandCrab are testing the functionality or have put it there as a diversionary tactic.

“Unfortunately, we really don’t know what the motivation behind the author truly is and how it makes sense, given that one functional URL can retrieve this information as well,” says Val Saengphaibul, senior threat researcher at Fortinet’s FortiGuard Labs. “It perhaps might be a smoke screen to throw off analysis or perhaps something experimental that might make sense afterward.”

Fortinet’s analysis also showed that GandCrab 4.1 is designed to kill numerous processes, such as msftesql.exe, sqlagent.exe, oracle.exe, msaccess.exe, powerpnt.exe, and wordpad.exe, so it can ensure full encryption of any targeted files.

Killing the processes ensures that high-value files of the victim — Microsoft Office Files, Steam, etc. — are encrypted, Saengphaibul says. “Any open, in-progress file is also shut down to allow it to be overwritten to ensure that the full encryption routine takes place on those as well,” he says.

One thing that Fortinet’s researchers did not find, however, is any evidence that GandCrab is now able to spread via SMB shares, such as WannaCry and Petya/NotPetya. That would have made the threat posed by the malware substantially greater.

According to the vendor, its researchers have not able to find any function in GandCrab 4.1 that would support this capability. Therefore, any fears about exploit propagation via SMB have to be considered as speculative for the moment, the vendor said.

Since first surfacing in January, GandCrab has caught the attention of the security community both for how prolific it has been and for how its authors have managed to keep one step ahead of defenders. As of March, when numbers were last available, the malware had infected over 50,000 systems and netted its operators over $600,000 in ransom payments.

Security researchers have previously noted how the creators of the tool appear to have adopted an agile-like development approach to the malware, including the way it is maintained. From an initially buggy release, the malware has kept evolving, with each version featuring tweaks designed to address shortcomings in previous iterations. Among the several updates is one that surfaced in version 4.0 that gives GandCrab the ability to encrypt data without first connecting to its C2 server, meaning it can encrypt even when an infected system is not connected to the Internet.

Even though many of the updates to the malware have been incremental in nature, they are still enough to warrant continual analysis from the security community, Saengphaibul says. “The GandCrab operation is run in true business-like fashion and focuses on a high return of infection on victims while at the same time focusing on evading antivirus technologies,” he notes.

Related Content:

• GandCrab Ransomware Goes ‘Agile’
• Gandcrab Ransomware Exploits Website Vulnerabilities
• Rnsomware Attacks Jumped 400% Worldwide in 2017
• What To Watch For With Ransomware: 2017 Edition

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/endpoint/gandcrab-ransomware-continues-to-evolve-but-cant-spread-via-smb-shares-yet/d/d-id/1332296?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

GRU hackers used bitcoin to fund US computer network infrastructure supporting and hiding the operation.

Twelve Russian military officers have been indicted on hacking charges as part of Special Counsel Robert Mueller’s investigation into Russian meddling in the 2016 presidential election. Assistant Attorney General Rod Rosenstein today announced the indictment handed down by a federal grand jury in the District of Columbia.

The charges come on the eve of President Donald Trump’s meeting with Russian president Vladimir Putin on Monday in Helsinki, where Trump has promised to raise US concerns over election-meddling. The indictment says the Russian officials allegedly hacked into the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton’s campaign, and waged strategic leaks online in an effort to damage Clinton’s candidacy.

Eleven of the defendants are charged with conspiracy to commit computer crimes, eight counts of aggravated identity theft, and money-laundering conspiracy. Two of the defendants face charges of conspiracy to commit computer crimes.

The hacking indictment syncs with US intelligence agencies’ previous conclusion that Russian nation-state actors had engaged in a widespread hacking, leaking, and social media influence campaign to sway the election toward Trump. Mueller’s team in June accused 13 Russian nationals and three Russian entities for a massive operation intended to interfere with the 2016 US presidential election that included bot operations and named the Internet Research Agency in Russia as the center of the operation.

Today’s indictment reveals that the Russian GRU officers also breached a state election board’s website and stole information on 500,000 voters, as well as the systems at a company that supplied software that verified voter registration information.

“They targeted state and local offices responsible for administering the elections; and they sent spear phishing emails to people involved in administering elections, including attaching malicious software,” Rosenstein said in a press conference today.

But like the historic DoJ indictments of Chinese military officers by the US Department of Justice in May of 2014, the Russian military indictment is more of a political statement: it’s unlikely the named suspects will ever face the US judicial system. The US and Russia have no extradition agreements. 

Among some of the key details in the indictment was that to mask their location in Russia, the suspects used a network of US-based computers paid for via bitcoin cryptocurrency.

In addition, the indictment reveals that even after the Russian APT operatives’ malware was removed from DNC systems in June of 2016, some of the malware (X-Agent) remained on a Linux server. “Despite these efforts, a Linux-based version of X-Agent, programmed to communicate with the GRU-registered domain linuxkrnel.net, remained on the DNC network until in or around October 2016.”

What the Mueller investigation’s findings show via the indictment, is that even nation-state intelligence officers can be unmasked, says John Bambenek, director of cybersecurity research for ThreatStop. “The broader story is how hard privacy is on the Internet. The [investigators] were able to turn them into names because their fingerprints were all over the place. Even intel agencies are having a hard time,” Bambenek says.

“This is far from over,” says Jim Zuffoletti, CEO of SocialSafeGuard, a startup that provides a social platform security service. “Think of all the different places this stolen data could be, incriminating data. They may be finding it years from now.”

Security and intel experts say the next shoe to drop from Mueller’s investigation is likely to be an indictment of American citizens who interacted with the Russian hackers and operatives. Today’s filing doesn’t name any US citizens, but does include a tidbit that a candidate for a US congressional seat in 2016 reached out to the attackers’ Guccifer 2.0 persona for stolen information on his or her political opponent. Guccifer 2.0 sent the candidate the requested documents.

“They are going to have a bad rest of their life” when their name is released, Bambenek says of the congressional candidate. “I think the inclusion of that wasn’t accidental. It was probably a way to say it wasn’t just the Russians operating alone.”

Another tidbit from the indictment: more than one GRU unit was behind the hacks. “The first of these units, Unit 26165, resembles APT28, the operator who we originally suspected of carrying out the DNC incident. The second of these two units, Unit 74455, is implicated in incidents affecting election systems,” says John Hultquist, director on intelligence analysis at FireEye.  

Related Content:

• 13 Russians Indicted for Massive Operation to Sway US Election
• How Guccifer 2.0 Got ‘Punk’d’ by a Security Researcher
• Trump Administration Slaps Sanctions on Russian Hackers, Operatives
• Destructive and False Flag Cyberattacks to Escalate

 

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/mueller-probe-yields-hacking-indictments-for-12-russian-military-officers/d/d-id/1332297?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Have you ever thought about how you’d deal with the aftermath of a data breach?

Would you be able to give your customers the bad news quickly, usefully and honestly?

We thought we’d dig into the recent malware infestation at Gentoo Linux – how it happened, how Gentoo responded, and how to avoid this sort of crisis in your own network.

We think Gentoo did a good job in a bad situation, and we can all learn something from that.

(Watch directly on YouTube if the video won’t play here.)

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/jiJ9XHui0Fs/

Germany’s highest court has ruled that access to social networks can be inherited when people die, overturning a previous court’s decision that kept a grieving mother locked out of her daughter’s account after the girl was hit by a subway train.

A year ago, a German court denied the mother’s request to access her dead daughter’s Facebook account – access she had been seeking for years in an effort to determine whether the girl had purposefully thrown herself in front of a train at a Berlin station in 2012, and if cyberbullying was behind what could have been her child’s suicide.

The girl’s parents already had her Facebook account password: according to the Guardian, their daughter had shared it with them in return for being allowed to open an account when she was 14. She died at the age of 15.

But when they tried to access the account, the girl’s parents found that it had been memorialized.

That means that Facebook completely removed the dead girl’s data, changed the privacy setting so that only confirmed friends could view her profile or search for it, removed her status updates, and locked the account so that nobody in the future could log in. As Facebook describes in its policy, the account was transformed into “a place where people can save and share their memories of those who’ve passed”.

On Thursday, Germany’s Federal Court of Justice said that social media accounts are no different than personal letters and diaries in that they, too, can be inherited. From an English translation of the court’s decision:

From a hereditary perspective, there is no reason to treat digital content differently.

Last year, a lower court had ruled that the girl’s rights to private telecommunications included her electronic communications, which, it decided, were meant to be read only by those with whom the girl had communicated.

The case brings up the complicated question of who has the right to unlock our social media accounts, our bank accounts, our eBay accounts, our creative output on Instagram, or any other aspect of our online presences or intellectual property after we die.

In the US, state laws have differed. The first law to pass in the US, in Delaware, ruled that digital assets including email, cloud storage, social media accounts, health records, content licenses, databases and more would become part of a person’s estate upon death, and the entities who control access to those assets would be required to provide the legal executor with control over the deceased’s digital assets.

Such a law has made service providers such as Facebook squirm. Back when Delaware was passing its law, a coalition of 21 technology and media companies argued against such legislation, raising issues such as those regarding liability: particularly relevant when an email contains information about a third party.

Others have called such fears a red herring, given that before the internet, doctors and drug counselors kept files with confidential information that could be accessed by a fiduciary if they died.

That fiduciary would bear the liability if confidential information was released in either digital or analog form.

Facebook, along with the tech industry at large, has also argued that digital assets laws are in direct conflict with a federal law, the Electronic Communications Privacy Act, which prohibits custodians of digital assets from releasing them to a third party without the sender’s or receiver’s permission or a court order.

That’s what a Rhode Island law stipulated: it requires that executors get a court order to access email accounts of people who die and indemnifies the provider from liability.

Thursday’s decision from Germany’s highest court made it clear that such data protection laws are irrelevant in the case of access to dead people’s digital accounts:

[Data protection] regulation protects only living persons.

A spokesperson for Facebook in Germany gave this statement to the Guardian:

We feel [for] the family. At the same time we have to ensure that personal exchanges between people on Facebook are protected. We represented a different position in this dispute, and the drawn-out court case shows how complex the matter is in legal terms.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/zLHKMyPJbHU/

Someone has been sending sextortion scam emails with a new twist – one aimed at making it more likely you’ll be duped into paying a blackmail fee.

One of the emails arrived at Naked Security yesterday, via a diligent reader, just as Brian Krebs was breaking the story on his site.

It claims to have compromising images of the recipient and goes on to ask for payment in order to stop the images being released publicly. Attempting to manipulate victims by claiming to have compromising images of them is known as sextortion, and its been used for years. What makes this scam different is that it’s added something extra: it contains a real password used by the victim.

The email reads:

I do know, [PASSWORD REDACTED], is your password. You do not know me and you are probably thinking why you are getting this e mail, correct? 

actually, I placed a malware on the adult videos (pornography) website and do you know what, you visited this web site to experience fun (you know what I mean). While you were watching videos, your internet browser initiated working as a RDP (Remote Desktop) that has a key logger which gave me accessibility to your display and also webcam. after that, my software program obtained all your contacts from your Messenger, Facebook, as well as email. 

What exactly did I do?

I made a double-screen video. First part displays the video you were viewing (you've got a nice taste haha), and second part shows the recording of your webcam. 

exactly what should you do?

Well, I believe, $2900 is a reasonable price tag for our little secret. You'll make the payment via Bitcoin (if you don't know this, search "how to buy bitcoin" in Google). 

BTC Address: 19ZFj3nLSJCgoAcvZSgxs6fWoEmvJhfKkY
(It is cAsE sensitive, so copy and paste it)

Important:
You have one day to make the payment. (I've a unique pixel within this email message, and now I know that you have read this e mail). If I do not get the BitCoins, I will definitely send out your video to all of your contacts including relatives, co-workers, and so forth. Nonetheless, if I receive the payment, I'll erase the video immidiately. If you want evidence, reply with "Yes!" and I will send your video to your 9 friends. It is a non-negotiable offer, that being said do not waste my time and yours by replying to this e-mail.

The power of a password

Many people, even those who feel as though they could have been seen in a compromising position, would normally be too jaded to fall for a sextortion scam with no evidence. Including a real password makes it seem more convincing, though, which might be enough to fool some people.

Several people mailed Krebs copies that they had received of this mail, and in all cases the passwords were more than ten years old. The person who forwarded the message to us also said that the password was an old one.

But still, how did they get the passwords?

Krebs mentions nefarious online lookup services that will grab this data for you. The other option is that the scammer has access to a list of compromised passwords from one of the many data breaches that have occurred within the last decade.

Websites aren’t supposed to store passwords in plain text but, sadly, some still do and ten years ago it was even more common.

Even when sites store your passwords securely, crooks who have a list of password hashes can run what’s known as a dictionary attack against the stolen list, trying millions of the most likely passwords for each user in the hope of getting a match.

If you’ve changed your password before the crooks get round to cracking it, then you win – the old, stolen password can’t login any more – but if you didn’t know (or weren’t told) there was a breach, the crooks might still get lucky.

Even if the crooks can’t login with your password by the time they crack it, they still know what is used to be, which is why you should never use the same, or even similar passwords, on different sites.

And, as this scam shows, even an old and retired password has “scare tactic” value to the crooks – the fact that they know what one of your passwords used to be is unsettling, to say the least.

There are some other notable things about this message. The first is that it apparently bypassed Gmail’s email filters, probably because of some random text included further down in the message.

The second is that some details vary in different copies of the mail. The sender’s email address (either in the reply-to field or in one case included in the text of the mail) change. The ransom amount also changes, and so does the bitcoin address.

Apparently, people are being taken in by this scam. Although at the time of writing the Bitcoin address in our email hasn’t received any funds, some of Krebs’ have. One address shows a transaction for 0.28847409 BTC on 6 July 2018. At that day’s prices, the transaction would have been worth around $1900. Another address reportedly used in a more or less identical mail received around 0.207145 BTC, or around $1300, on 9 July 2018.

These are unlikely to be the only cryptocurrency addresses used. That makes it a profitable little scheme for someone with lots of time, some scripting chops, and no soul.

Follow @DannyBradbury
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/oJ_DzS3QGIw/

A Ukrainian intel agency has claimed it stopped a cyber attack against a chlorine plant that was launched using the notorious VPNFilter malware.

Ukraine’s SBU Security Service said it thwarted an attack on network equipment belonging to the LLC Aulska chlorine plant in Auly, about an hour away from Dnepr City in Dnipropetrovsk, central Ukraine, Interfax Ukraine reports.

Kiev’s counterintelligence arm was quick to blame Russia for the assault on the plant, which provides chlorine to water treatment and sewage plants throughout Ukraine. According to the company’s website, its products are used by consumers in 23 regions of Ukraine, Moldova and Belarus.

“Specialists of the cyber security service established minutes after [the incident] that the enterprise’s process control system and system for detecting signs of emergencies had deliberately been infected by the VPNFilter computer virus originating from Russia,” the SBU said on its Facebook page on Wednesday. “The continuation of the cyber attack could have led to a breakdown in technological processes and a possible accident.”

Advanced VPNFilter malware menacing routers worldwide

READ MORE

The attack was allegedly geared at disrupting the stable operation of the plant, which provides NaClO (sodium hypochlorite, aka liquid chlorine) for water treatment. Elemental chlorine is commercially produced from a high concentration solution of NaCl (sodium chloride – aka common salt) in water through electrolysis.

Workers at the chlorine company worked with its telco providers and cyber security experts at the SBU to thwart the purported attack, the agency said. VPNFilter, first detected in May, is estimated to have hijacked half a million Internet of Things devices such as routers and network-attached storage (NAS) devices.

The malware is capable of snooping on encrypted web traffic as well as establishing a backdoor on compromised devices.

The code of some versions of the malware overlaps with versions of the BlackEnergy malware, a cyber-espionage nasty previously linked to attacks on Ukrainian power distribution stations. “The behaviour of this malware on networking equipment is particularly concerning, as components of the VPNFilter malware allows for theft of website credentials and monitoring of Modbus SCADA protocols,” Cisco Talos, the security team that discovered the malware, warned in May. “Lastly, the malware has a destructive capability that can render an infected device unusable, which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.”

Western intel agencies as well as Ukraine’s SBU have blamed Russia – an more specifically APT 28, a unit of Russian military intelligence, GRU – for creating and distributing VPNFilter. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/13/ukraine_vpnfilter_attack/

Business iPhone users in India have been targeted in a sophisticated and attack run through bogus Mobile Device Management (MDM) servers.

Using either physical access or – more likely – social engineering trickery, certificates from a selection of two sketchy MDM servers were installed on targeted iPhones. This gave the hacker-controlled MDMs admin rights that were abused to load bogus versions of WhatsApp, Telegram and other apps, security researchers said.

Data including emails, SMSes and other messages sent through enrolled smartphones was subsequently uploaded to systems under the control of hackers.

Attackers set up an open-source MDM and used this to deploy malicious code into secure chat applications such as Telegram and WhatsApps in order to surreptitiously retrieve messages/chats and photos.

The counterfeit apps also allowed the hackers to track the location of compromised smartphones, as a blog post by Cisco Talos explains.

The attacker used the BOptions sideloading technique to add features to legitimate apps, including the messaging apps WhatsApp and Telegram, that were then deployed by the MDM onto the 13 targeted devices in India. The purpose of the BOptions sideloading technique is to inject a dynamic library in the application.

The malicious code inserted into these apps is capable of collecting and exfiltrating information from the device, such as the phone number, serial number, location, contacts, user photos, SMS and Telegram and WhatsApp chat messages. Such information can be used to manipulate a victim or even use it for blackmail or bribery.

HackingTeam, a Milan-based law enforcement snoopware supplier, has previously used the same technique but there is no evidence to implicate it, and the use of an Indian-registered mobile phone and other factors point to a local attacker, according to Cisco Talos.

The attacker tried to mimic Russian hackers by using mail.ru email but Cisco Talos found testing devices enrolled on the MDM with an Indian phone number and registered on an Indian provider.

The threat intel crew has worked closely with Apple to counter the threat. Apple had already pulled three digital certificates associated with the hacking group before Cisco Talos got involved. Two other digital certificates were revoked shortly afterwards.

Log analysis of files left on the MDM servers and the malware’s command-and-control (C2) server revealed that the malicious code had run since August 2015.

Anatomy of a highly targeted attack on Indian iPhone users Source: Cisco Talos

MDM is an enterprise-focused technology designed to allow sysadmins to control the setup and apps that run on corporate smartphones or to lock up a device in the event of either theft or loss.

Cisco Talos warned: “Users must be aware that accepting an MDM certificate is equivalent to allowing someone administrator access to their device, passwords, etc. This must be done with great care in order to avoid security issues and should not be something the average home user does.

“The likely use of social engineering to recruit devices serves as a reminder that users need to be wary of clicking on unsolicited links and verify identities and legitimacy of requests to access devices,” it added.

Over a three-year period, the attackers remained under the radar — likely due to the low number of compromised devices. For now it’s unclear who the targets of the campaign were – much less the perpetrator of the attack or its purpose. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/13/bogus_mdm_iphone_snooping_india/

Promo No sooner have organisations fought off one type of security nightmare than another one looms even larger.

Security experts say that ransomware, having raged through high-profile organisations including the NHS, is becoming old hat. A more profitable and hard-to-trace strain of malware known as cryptojacking is replacing it as the biggest threat to large organisations.

Cryptojacking hackers install mining scripts or malicious malware onto computers of unsuspecting users to mine websites for cryptocurrencies. Their exploits have recently caused havoc at leading companies such as Tesla, and new strains are still appearing.

Understanding the ins and outs of cybercrime is the first step in spotting ever-evolving forms of malware and preventing their ravages. A webinar presented by Fraser Howard, principal threat researcher at SophosLabs, will help you to do just that.

Howard spends his days hands-on with Malware in the Sophos labs and so knows precisely how all the moving parts of malware-driven cybercrime fit together. All will be revealed in an interview with Sophos senior technologist Paul Ducklin.

The webinar starts at 2pm BST on Wednesday 18 July, and you can sign up here.

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/13/cybercrime_webinar/

Executives and front-line SOC teams see human and technology issues in much different ways, according to two new reports.

A Security Operations Center is an expensive resource for protecting enterprise computing and network resources. A handful of factors can keep an organization from getting the most from the resources — and a recent study shows that those factors are more common than some would think.

A recent study by Exabeam resulted in the 2018 State of the SOC Report which has sections on how SOCs are built and staffed, and how employees at various levels of the organization see the SOC. In key areas, people at different organizational levels have very different views of the issues that exist.

“In terms of importance, upwards of 62% of people who work in the SOC see inexperienced staff as a key pain point,” says Stephen Moore, vice president chief security strategist at Exabeam. “Only 21% of those at the C-level think that this could be an issue.” 

The divide is important, as indicated in another report, the 2018 State of Security Operations report, published by Micro Focus. According to the report, among the factors credited with improving SOC operations are the continuity and retention of key security personnel, and insight into the applications, data, systems, and users most likely to impact customers. That insight may be compromised when executives and front-line personnel have radically different views of the security landscape.

Experience level isn’t the only area where there is divergence of opinion. Moore says. “Technology is twice the pain point for line people as for the C-suite.” The Micro Focus report is quite specific on the nature of the pain. “Most security operations centers continue to be over-invested in technologies that inform them of a problem, yet truly struggle to protect, detect, respond, and recover from the cyber security attacks they fail to discover.”

A growing number of organizations are looking to continuous security, or DevSecOps, to optimize the effect of the people and technology they do have in place. The State of Security Operations report points out that, “20% of cyber defense organizations that were assessed over the past 5 years … continue to operate in an ad-hoc manner with undocumented processes and significant gaps in security and risk management.” While still high, those numbers represent improvement over time.

Moore says that improvement has to come through automation and continuous response. “It’s not enough to find something bad; you have to use your [organization] to respond,” he says, adding, “You’re seeing orchestration happen, which is sort of the SOC’s version of DevSecOps. It’s bringing all the pieces in together to help win the security fight.”

One of the most important results of using the assets of the organization to be proactive is that the SOC has to become more friendly to the rest of the organization, Moore says. “It’s meeting before a crisis and agreeing to a response,” he explains. “It’s a low-friction/high-trust response. That’s really cool, and that’s the promise — more communications at a human level.”

The planned and automated response can help reduce the impact of both reduced staff training and outdated technology. And in security, making the most of what the organization has is critical. “It’s important to be able to run a playbook,” Moore says, noting that doing so, “…takes a lot of the pain, a lot of the sting, out of the SOC.” In the end, he says “the SOC is a pain center, and this is a soothing agent. As a security executive it’s your job to remove pain.”

Related content:

• At RSAC, SOC ‘Sees’ User Behaviors
• CrowdStrike Introduces New Automated Threat Analysis Solution to Deliver Predictive Security
• 3 Security Measures That Can Actually Be Measured
• SOC in Translation: 4 Common Phrases Why They Raise Flags

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/socs-use-automation-to-compensate-for-training-technology-issues/d/d-id/1332292?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple