STE WILLIAMS

How much security do you need to effectively protect your organization’s infrastructure? Most (84% of) IT decision-makers say they can’t afford the minimum amount, according to new study from Cisco.

Researchers with Cisco surveyed 80 IT decision-makers on security budgeting and planning and found that more than half (56%) had experienced a significant security event – a breach, intrusion, or malware infection – in the past year, and 94% admit they have further to go to implement effective security practices.

There is a silver lining in that most companies know where they need help: 95% of respondents say they can identify which data and systems in the business require the most protection. The problem is that it’s not just money holding them back. Expertise, capability, and influence, along with budget, all play a role in security, says Wendy Nather, Cisco’s head of advisory CISOs.

Some organizations have a lot of money and expertise, so they know what they need to do. Some have the influence to communicate their security needs to vendors, partners, and other third parties who can fulfill their requests. But budget, expertise, and influence don’t guarantee capability if the organization operates in a heavily regulated industry, for example, she adds.

“It’s not that they’re incapable, but they have constraints in that environment they might not be able to get around,” she says. An airplane manufacturer has influence, Nather continues, but new technology will have to be carefully tested, in one airplane at a time, before it’s rolled out. In the public sector, it’s difficult to justify upgrading equipment when everything works fine. Public sector technology is designed to maximize taxpayer’s dollars, not keep up with security.

“Because there are four factors, if you don’t have any one of them, that can really hamper your program,” she says. Influence, for one, can make a big difference: 86% of organizations with 10,000+ employees learn of security vulnerabilities and incidents that affect them from affected vendors or partners, compared with just 60% of businesses with fewer than 1,000 employees.

Breaking Down Budgets

Among mid-market organizations (250-999 employees), 46% spend under $250,000 on security each year and 43% spend $250,000 to $999,999. Among enterprise organizations (1,000-9,999 employees), 57% spend between $250,000 and $999,999, 23% spend less than $250,000, and 20% spend at least $1 million. Half of large enterprises (more than 10,000 employees) spend $1 million or more on security each year and 43% spend between $250,000 and $999,999.

To an extent, more money drives confidence: 27% of organizations spending at least $1 million on security say they can afford the minimum level of protection they need, compared with only nine percent of those spending $250,000 to $999,999. However, the smallest organizations reported greater confidence in their security measures than midmarket firms spending more.

“What interests me is the midrange organizations – not so much in how much they’re spending, but what effect that spending has or doesn’t have,” says Nather. “They most often reported feelings of not doing enough … most often the ones to say they couldn’t spend as much as they needed.” Nineteen percent of the smallest businesses said they could afford the minimum amount of security they needed, compared with seven percent of midmarket organizations.

Could it be that smaller companies don’t perceive themselves as targets and aren’t as worried? Possibly, Nather notes, but organizations of all sizes can appear on attackers’ radar because of their operation or business function; not necessarily for their size. If a business swaps to a new ecommerce platform known to be vulnerable, attackers can take aim no matter how big it is.

Seeking Security Skills

Budget isn’t the only factor challenging midrange organizations, Cisco researchers report. Among organizations with 1,000-9,999 employees, only 23% rely most heavily on internal staff for security expertise, compared with 37% of respondents overall. And while it’s good businesses feel they can use external resources for help, they should be able to use internal staff for help with critical topics like user experience, process design, risk analysis, and incident response.

“Security talent, especially senior talent, is very hard to find,” Nather says. “Unfortunately, a lot of organizations are in the position of competing with security vendors for that talent.”

The percentage of those depending on external resources could be admitting there is a limit to how much an organization can know about security, she explains. After all, a business with the expertise to know what it needs to do for security may not have the talent to execute on it. Many companies outsource responsibilities that are hard to hire for, and hard to sustain with skilled workers: security operations monitoring is one example; incident response is another.

Even outsourcing has its limitations, Nather points out. “There won’t be anything you can completely outsource because your outsourcer will come back to you and say, ‘we don’t know what this means,’ and ‘we need to talk to someone internally who can take care of this.'”

Security Tech: What Do You Really Need?

The report lists 15 different security technologies used among respondents. Some organizations listed four tools they rely on, Nather says, while others listed more than 30 products. On the final list, firewalls and security policy management fall into first place, followed by email security and network malware protection. Of course, not every organization can afford all 15 tools, let alone the expertise needed to configure, maintain, and monitor all of them.

“Whether you have what you need, and whether you’re using it right, that’s the other big thing to remember,” she continues. “You might have a firewall, but if you’re letting everything in, it’s not a very useful firewall.”

Are there technologies an organization must have to achieve strong security? There is no standard blueprint, Nather says, as each business has different needs and different resources. CISOs don’t have a one-size-fits-all answer for the type of technologies they need; right now, the closest they have are compliance standards for tightly scoped risk cases like PCI-DSS.

“If we as professionals can’t agree on what organizations need, how are they supposed to know?” Nather asks. When you don’t know the risks you’re trying to manage, it’s tough to come up with a specific shopping list. Businesses may need to conduct extensive research and perform a security audit to determine exactly what they need and can afford.

“They should look at where they have better capabilities, and where they have lesser capabilities, and design security accordingly,” Nather advises.

Related Content:

• Surviving Alert Fatigue: 7 Tools and Techniques
• SOC Operations: 6 Vital Lessons Pitfalls
• In A Crowded Endpoint Security Market, Consolidation Is Underway
• Typosquatting Websites Proliferate in Run-up to US Elections

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/operations/how-much-security-is-enough-practitioners-weigh-in/d/d-id/1336138?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Two years after cyber-espionage actors infected the CCleaner utility with malware designed to infiltrated certain companies, Avast’s security team has foiled a second attack targeting the widely used system-maintenance program.

The company detected signs of the attack on Sept. 23, when suspicious network behavior tipped off its security team. The attackers gained access through compromised VPN credentials that used an old profile not requiring two-factor authentication. The attackers were able to compromise two separate accounts and access the internal network, Avast said in a statement on its site today.

The attack failed to advance beyond the early stages, says Jaya Baloo, Avast’s chief information security officer, who started on Oct. 1 as the investigation kicked off.

“The worst-case scenario was that they could try to do what they did before: Get code-signing keys, be able to push out malware, and send [malicious code] using valid updates,” she says. “So we looked for that, but we didn’t find it. We assumed nothing and looked at all the old versions of stuff we released in the last six months. … We checked and rechecked.”

The incident could have ended much worse, as it did two years ago. In July 2017, attackers managed to infiltrate the network of Piriform, maker of CCleaner, following Avast’s acquisition of the company, and pushed out malware-infected updates to 2.27 million users. The company was not a target of opportunity. The attackers pushed secondary infections to just 20 victims machines, targeting companies including Microsoft, Google, Sony, Cisco, and Akamai.

“From the insights we have gathered so far, it is clear that this was an extremely sophisticated attempt against us that had the intention to leave no traces of the intruder or their purpose, and that the actor was progressing with exceptional caution in order to not be detected,” Avast stated in the most recent blog post. “We do not know if this was the same actor as before and it is likely we will never know for sure, so we have named this attempt ‘Abiss’.”

After initially detecting the suspicious access on Sept. 23, the company found a second user account had also been used by the attackers. Tracking back the history of suspicious activity, the company found the first attempts by the attacker to infiltrate the system dated back to May 14.

The company then tracked the known compromised user accounts. While the original user account did not have administrative access, the attackers used a privilege-escalation exploit to gain greater permissions on the network, Avast stated. The attacker was able to replicate the Active Directory, a step toward attempting to retrieve additional credentials, but did not advance further, the company said.

The attack required that Baloo jump in with both feet into her new role. While she was hired earlier in the summer, she still had not left her previous job and was traveling when she got the call.

“The first order of business was to …. figure out where the bathroom is and examine all those logs,” she says.

As part of its response, Avast collaborated with the Czech intelligence agency, known as the Security Information Service (BIS), the cybersecurity section of the local Czech police, and a third-party incident response and forensics team.

Avast has a very technical team, who had learned a great deal from the attack two years ago, Baloo says. Yet there are still lessons to be learned from this time around.

The first is to better analyze the data the company is collecting. The initial alert had been detected by the company, but was deemed a false positive — not a threat. While many companies can cut out noisy data sources, Avast needs to analyze as much data possible because that is the company’s business, she says.

“This is really challenging, especially in a company whose business it is to look for the bad guys,” she says. “You have a lot of data, and so you have two different extremes — having a lot of data but not using it or being crippled by the immense amount of data you are getting.

The company also needs to better segment its permissions, which is difficult because everyone in the company is quite technical and wants to do as much on his or her own as possible, she says.

“The people are capable and have hands-on credibility, so they have a lot of leeway to ask for a lot of privileges on the network because they can handle it,” Baloo says. “But nothing is better for security than segmentation, isolation, and asking people to jump through a few more hoops before giving them access to the crown jewels.”

Related Content:

• Chinese APT Backdoor Found in CCleaner Supply Chain Attack
• DevOps Repository Firms Establish Shared Analysis Capability
• Understanding Supply Chain Cyber Attacks
• CCleaner Malware Targeted Tech Giants Cisco, Google, Microsoft
• Avast CCleaner Compromised Amid Rise in Supply Chain Threats

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/operations/avast-foils-another-ccleaner-attack/d/d-id/1336132?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft is teaming up with Windows device manufacturers to tighten firmware security in a new initiative called Secure-Core PCs, which are built to defend against firmware-level attacks.

Its announcement arrives as attackers take greater aim at firmware, the level of software that is closest to the hardware and controls the functions of devices and systems. Firmware is an appealing target because it has a higher level of access and privilege than the operating system kernel and hypervisor. The National Vulnerabilities Database reports 414 firmware bugs have been reported in 2019, compared with 476 in 2018, 401 in 2017, and seven in 2016.

“Firmware is the most privileged software running on the device,” says David Weston, partner director of OS security at Microsoft. “You can basically do anything.” Because firmware isn’t always centrally updated, he continues, it’s more likely to be outdated and vulnerable.

When firmware vulnerabilities are exploited by sophisticated groups such as Strontium/APT28, which has been spotted using this type of attack, the infection is difficult to detect and remove. Firmware attacks can weaken security functionalities like Windows’ Secure Boot; because many endpoint detection and response (EDR) tools have limited visibility at the firmware level, it’s easier for attackers to slip past them. If the firmware is assumed breached, the security of the whole machine is potentially at risk.

Secure Boot is a feature designed to make sure that when a device boots up, it’s only using software trusted by the OEM. When a computer starts, the firmware checks the signature of each component in the boot software. If the signatures are valid, the machine starts running. Secure Boot assumes firmware can be trusted – a major problem if it has been compromised. On its own, the secure measure doesn’t protect against malware that exploits firmware bugs.

New security requirements in Secured-Core PCs are intended to help users boot securely, protect devices from firmware flaws, and prevent unauthorized access to devices and data. Secured-Core PCs remove the need to trust firmware as part of the bootup process. Instead, they place the root of trust at the CPU level with new chipsets from AMD, Intel, and Qualcomm.

“System Guard uses the Dynamic Root of Trust for Measurement (DRTM) capabilities that are built into the latest silicon from AMD, Intel, and Qualcomm to enable the system to leverage firmware to start the hardware and then shortly after re-initialize the system into a trusted state by using the OS boot loader and processor capabilities to send the system down a well-known and verifiable code path,” Weston writes in a blog post on today’s news. If the CPU decides the firmware was compromised, it can transmit a signal to indicate foul play.

This limits the trust placed in firmware, protects against firmware attacks, and maintains the integrity of the virtualization-based security (VBS) functionality, implemented by the hypervisor. Securing VBS is critical, Weston says, because it’s used in key OS security capabilities like Windows Defender Credential Guard and Hypervisor-protected Code Integrity (HVCI), which ensures a code integrity policy is enforced and kernel code is verified.

The extra layer of security will arrive in new Windows 10 devices, starting with the Surface Pro X. Other devices will follow from Dell, HP, Lenovo, Panasonic, and Dynabook. Most of the Secured-Core devices launching are laptops, says Weston, with the exception of Surface Pro X.

While anyone can buy a Secured-Core PC – a sticker will inform them whether it meets the security requirements – Weston notes these are specifically designed for people who work in verticals like government or financial services, where sensitive information is often targeted.

“If you think about who is likely to suffer a really advanced, targeted firmware attack, it’s going to be people in those highly targeted verticals,” he adds.

Related Content:

• Surviving Alert Fatigue: 7 Tools and Techniques
• In A Crowded Endpoint Security Market, Consolidation Is Underway
• Glitching: The Hardware Attack That Can Disrupt Secure Software
• State of SMB Insecurity by the Numbers

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/operations/microsoft-aims-to-block-firmware-attacks-with-new-secured-core-pcs/d/d-id/1336136?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A new report from the United Kingdom’s National Cyber Security Center (NCSC) shows that the Russia-backed cyber espionage group Turla has carried out more attacks than previously thought using infrastructure and malware hijacked from Iranian threat group APT34.

The NCSC recently analyzed data pertaining to Turla’s use of three malware tools — Neuron, Nautilus, and an ASPX-based backdoor — in attacks targeted at UK organizations. The tools are designed for attackers to steal data and maintain persistence on Windows networks.

The NCSC has previously noted Turla’s use of these tools in intelligence-gathering operations targeting organizations in the technology, military, energy, and government sectors. But it had not until now connected the tools to APT34 (aka OilRig, Crambus) – though Symantec did so in a report back in June.

In a joint advisory with the National Security Agency (NSA) published Monday, the NCSC said its analysis of the malware — based on data from multiple-sources — shows Neuron and Nautilus are”very likely Iranian in origin.” The data shows that Turla not only hijacked APT34’s tools but also its command and control infrastructure to deliver malware and additional payloads on compromised systems, the NCSC said.  

Symantec in June reported that it had observed Waterbug (the security vendor’s name for Turla) using APT34’s malware and infrastructure in one targeted attack against an organization in the Middle East. The NCSC and NSA advisory, however, makes clear the Russian threat group used APT34’s malware and infrastructure in attacks on multiple targets, especially in the Middle East.

“Those behind Neuron or Nautilus were almost certainly not aware of, or complicit with, Turla’s use of their implants,” the NCSC said. “While Neuron and Nautilus tools were Iranian in origin, Turla were using these tools and accesses independently to further their own intelligence requirements.”

This is believed to be the first publicly known instance of one state-backed APT group hijacking and using a rival nation-state actor’s attack infrastructure to expand victim targeting. “Although this type of activity has been discussed as a hypothetical tactic within the cybersecurity industry, it has rarely been publicly identified as being used operationally,” says Alexandrea Berninger, senior cyber intelligence analyst at Symantec.

Like the NCSC, Symantec has found no evidence that the Iranian threat group knew it had been compromised or that another group was using its attack infrastructure to target the same victims. “The identification of Waterbug using Crambus’ infrastructure in our report in June was the first time Symantec has observed one targeted attack group seemingly hijack and use the infrastructure of another group,” Berninger notes.

According to the NCSC, Turla used APT34’s hijacked tools both on networks the latter had already compromised as well as on additional victim networks. The data showed that Turla scanned for networks across 35 countries, many in the Middle East, for the presence of the Iranian ASPX backdoor associated with APT34. When it found these networks, the threat group attempted to leverage APT34’s hijacked malware and infrastructure to establish its own separate presence on the same networks.

In some instances, APT34 would first deploy its implant on a victim network – only to have Turla access it later. The Russian group’s ability to remotely connect with APT34’s malware tools and get the tools to execute commands suggests that Turla had access to relevant cryptographic keys and controllers belonging the Iranian group, NCSC said.

Somewhat ironically, even as APT34 was busy distributing its malware on target networks, Turla quietly deployed its own implants on the Iran’s group’s APT infrastructure and used this to expand access into it.

More Attack Options

Avihai Ben Yossef, CTO of Cymulate, says Turla’s strategy could provide the Russian group with more data and options to attack. Breaking into APT34 infrastructure could provide them with a network of already compromised machines or databases from which to build out attacks. “This type of activity isn’t at all common, as usually APT groups knows how to protect their infrastructure and data,” he says.

Turla/Waterbug also may be using the stolen infrastructure to throw defenders and security, says Berninger. Turla/Waterbug has a history of false flag operations and deceptive tactics. So the group’s takeover of another group’s network would fit into that pattern, she says.

Alternatively, the data also suggests that the Russian threat actor may be using Crambus/APT34’s infrastructure to gain initial access to a victim network. “Waterbug is a sophisticated actor and likely has the capability to gain initial access via other means,” Berninger notes.

But threat actors tend to be opportunistic. If they get a chance to break into a network without having to put the work into it, they are likely to take the opportunity. “Gaining access to another APT groups’ infrastructure could provide Waterbug access to multiple victims they have interest in and would allow Waterbug to drop additional tools onto those networks to maintain access and execute their objectives,” she says.

Turla’s strategy of riding on Crambus’ back can complicate matters for targeted organizations, Berninger says. Because attribution becomes harder, defenders could end up deploying the wrong response to an attack, she notes.

Related Content:

• Russian Nation-State Group Employs Custom Backdoor for Microsoft Exchange Server
• Turla Threat Group Uses Email PDF Attachments to Control Stealthy Backdoor
• APT34 Toolset, Victim Data Leaked via Telegram
• 8 Legit Tools and Utilities That Cybercriminals Commonly Misuse

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/russian-hackers-using-iranian-apts-infrastructure-in-widespread-attacks/d/d-id/1336134?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple