STE WILLIAMS

Organizations are more quickly detecting attackers in their networks and systems, but the majority of attacks are still being found by third parties and not by internal security groups.

In 2019, companies needed 56 days, on average, to detect an attacker in their networks, down from 78 days in 2018, FireEye Mandiant stated in its “M-Trends 2020” report, out today. While the improvement is partially due to companies spending more effort and resources on detecting threats and responding to incidents, much of the impetus to improve is due to a second trend identified in the report: Attackers are more quickly taking action once inside a victim’s network, and often the action is destructive, says Charles Carmakal, vice president of consulting and chief technology officer at FireEye Mandiant.

“Unfortunately, we are seeing a lot more disruptive threats,” he says. “We are seeing a lot more ransomware out there, and ransomware operators are deploying in days to weeks, executing in a much shorter time frame than espionage-type threats.”

Overall, 43% of attacks have a destructive element, the company found.

The findings indicate that, while organizations are getting better at detecting threats, attackers have become more agile as well. 

The groups behind the attacks, for example, are expanding beyond just attacking Windows systems. In 2019, 274 of the 1,268 malware families tracked by FireEye — 22% of the total — targeted either the Linux operating system or the Mac OS. Seven in 10 malware samples encountered belonged to the top five malware families, which are based on open source tools and under active development, the company stated in the report. About 41% of the malware families encountered by FireEye were previously unknown.

“Attackers continue to grow more adept at working across a range of operating systems and device types, as well as in both on-premises and cloud architectures,” the report stated. “Traditional barriers to attacker success continue to lessen over time. Put simply, more attackers can do more things in more diverse environments.”

While the overall time between the compromise of a network and the detection of the attack showed improvement, the percentage of attacks discovered by company employees, as opposed to external third parties, declined to 47% in 2019, demonstrating that businesses need to focus more on their own security. In 2017, internal detection of threats peaked at 62%.

Organizations based in the Americas had the best success, with 52% detecting threats internally rather than relying on third parties, while the Asia-Pacific region relied far more on third parties, with almost three-quarters of attacks discovered by external sources.

Data on threat detection varies widely. Cybersecurity firm CrowdStrike, for example, sees companies detecting attacks more quickly; it found the average organization takes five days to detect an attack and a little less than seven days to contain a breach. Meanwhile, a Trustwave report found that companies detected attacks within 14 days in 2018, down from 26 days in the prior year.

The differences in estimates of the so-called “dwell time” could be due to the focus of the company collecting the data. FireEye Mandiant focuses on incident response, helping companies that have already been breached, while Trustwave and CrowdStrike aim to proactively prevent breaches and detect attacks. 

The company tracked 1,268 malware families in 2019, 41% of which were new. While the vast majority of malicious software targeted Windows systems, 208 targeted or could impact Linux systems and 66 targeted or could impact Mac systems. 

The attackers’ focus on ransomware and other disruptive attacks raises the stakes for organizations. While many companies are prepared to recover from such attacks — regularly backing up data being a priority — many still pay ransoms to expedite recovery, Carmakal says. 

“The assumption is that when victims pay, they are doing it because they have not made good backups, but that’s not the case,” he says. “There are plenty of organizations that have terrific backups. But if you have so many systems taken offline in a matter of minutes or hours, and you have to recover so many servers in your environment, the amount of downtime can be excessive.”

Carmakal declined to say how many, or what fraction, of ransomware incidents resulted in the victim paying a ransom.

Related Content

• Most Companies Lag Behind ‘1-10-60’ Benchmark for Breach Response
• Persistent Threats Can Last Inside SMB Networks for Years
• Carbanak Attack: Two Hours to Total Compromise
• Hackers Still Outpace Breach Detection, Containment Efforts
• Financial Sector Under Siege

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “8 Things Users Do That Make Security Pros Miserable.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/firms-improve-threat-detection-but-face-increasingly-disruptive-attacks/d/d-id/1337097?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

CISOs are now getting plenty of face time with executive management: In fact, a study from ISC2 finds 43% of CISOs report to the CEO and 14% report to the board directly. And those dynamics are expected to shift even more. According to Gartner, 100% of CISOs at large enterprises are on pace to report to their boards on cybersecurity and technology risk at least annually.

With security in the spotlight more often, the ability to answer a common question like “Are we secure?” is no longer sufficient – and it really does little to convey the much larger picture of security efforts.

What questions should today’s CISOs be prepping to answer for their next executive meeting? The Edge asked a half-dozen security pros to weigh in on some of the most essential queries security managers should be ready to answer. Read on.

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Article source: https://www.darkreading.com/edge/theedge/10-tough-questions-ceos-are-asking-cisos-/b/d-id/1337083?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The cloud, once touted as an IT panacea, has a flip side that we see all too often in headlines when malicious actors take advantage of gaps in security. This cannot be repeated enough: Securing data and networks in a cloud environment is very different than doing so on-premises.

Infrastructure elements that were static on-premises are now abstracted to software. Firewalls must be designed to operate in an inherently fluid infrastructure. And in the cloud, you’ll need to focus more on applications, application programming interfaces, and user roles. 

Drawing from our experience with commercial and government cloud clients, here are five tips that re-emphasize and expand upon the fundamentals.

1. Control access to cloud management and configuration tools.
As cloud management and configuration tools — cloud service provider (CSP) consoles, command line interfaces, and APIs — provide end users great flexibility and autonomy, strong role-based access control is vital to protect the organization against external and insider threats.

• Authenticate and authorize privileged users with two-factor authentication, digital signatures, and certificates.
• Make training and skills evaluations mandatory before granting cloud roles.
• Strictly separate user and admin credentials, and restrict user access to production systems.
• Standardize processes for account life-cycle management.

2. Encrypt sensitive (and maybe all) data. 
In the cloud, data breach and data spillage are inevitable. Protecting data in transit via techniques like encryption becomes more critical as “the very notions of data-in-motion and data-at-rest become blurred.”

Encrypt all sensitive data, and segment it using multiple keys to minimize the impact of a compromised key. Keys should rotate regularly, with strong access control policies.

• Implement encryption for data in transit and at rest.
• Review CSP network encryption. (Not all network traffic between data centers may be natively encrypted.)
• Evaluate both native cloud and third-party encryption solutions.

3. Use automation to minimize human errors due to misconfiguration.
Manual configuration eventually leads to human error and its consequences: inconsistent deployment configurations, inadvertent data spillages, and vulnerabilities to malicious activity. This is a big security risk. According to Gartner research, nearly all — 99% — of “cloud security failures will be the customer’s fault.”

Automation, with pretested and audited configurations, ensures that infrastructure is deployed and configured correctly. We recommend the following:

• Automating infrastructure and platform builds, security testing, security guardrails, and baseline configurations.
• Implementing high-availability configurations to mitigate the risks of unavailable regions or zones due to cloud provider errors.
• Periodically performing configuration checks and routine compromise assessments.

4. Adapt visibility and vulnerability management to manage ephemeral and new types of cloud assets.
With a cloud solution — as data, systems, and responsibilities spread across environments — organizations may lack sufficient visibility for monitoring threats and ensuring compliance. Furthermore, legacy methods involving human vulnerability detection and remediation management may be too slow or cumbersome in the cloud, where incidents move at warp speed across interconnected systems and data.

A move to the cloud spurs many visibility questions:

• Does your infrastructure allow for visibility across the cloud environment? For instance, is there an aggregated system of logs, dashboards, and reports for collecting data from network appliances, cloud infrastructure, operating systems, applications, and so forth?
• Do you understand your cloud vendor’s incident response service-level agreements and how they integrate into your own processes?

Organizations will need to extend vulnerability management tools to container and serverless architectures and adapt these tools for rapid infrastructure deployment cycles and new cloud services. They will also benefit from in-line services such as proxies and network overlays to replicate traffic to “transparent” security services.

5. Implement enhancements throughout the operations life cycle.
Often, the initial cloud implementation is just the beginning. As apps are introduced, IT teams will need to make continual enhancements. And traditional “stovepiped” IT operations can impede the journey to cloud agility.

DevSecOps approach can help. As you take this approach, do the following:

• Implement site reliability engineer functions so ops staff can continue to upgrade the environment.
• Integrate DevSecOps with security staff in development and operations.
• Track new products and services, with a road map for future integration.

With these five fundamentals in mind, organizations can reduce their security and compliance risk as they reap the cloud’s many benefits: cost savings, lower total cost of ownership, and faster time to value.

Related Content:

• 10 Tips for Building Compliance by Design into Cloud Architecture
• Assessing Cybersecurity Risk in Today’s Enterprise
• Why Ransomware Will Soon Target the Cloud
• Processor Vulnerabilities Put Virtual Workloads at Risk
• The “Art of Cloud War” for Business-Critical Data

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “8 Things Users Do That Make Security Pros Miserable.“

Chris Christou is a leader in Booz Allen’s secure cloud and IT infrastructure business. He applies expertise in cloud security, cloud infrastructure and platforms, network engineering, and IT infrastructure. Chris has more than 20 years of experience designing, testing, and … View Full Bio

Article source: https://www.darkreading.com/cloud/5-strategies-to-secure-cloud-operations-against-todays-cyber-threats/a/d-id/1337033?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The personal information of 10.6 million MGM Resort guests has been published in a hacking forum, ZDNet reports. MGM Resorts has confirmed the data was stolen in a breach that occurred last summer.

When officials discovered unauthorized access to a cloud server holding certain information belonging to previous hotel guests, they sent out notifications, launched an investigation, and strengthened its network security to avoid the same problem in the future. Now some of this same data has resurfaced.

This trove of data contains details including full names, phone numbers, birthdates, and physical and email addresses for travelers who visited MGM Resorts through 2017. Those affected include tourists, DHS and TSA officials, tech CEOs, celebrities, reporters, and employees of major tech companies. Twitter founder Jack Dorsey and pop star Justin Bieber are among those whose data was exposed. Security experts warn this could put those affected at a higher risk of spear-phishing and SIM-swapping attacks.

MGM Resorts says the incident did not compromise financial, payment card, or password information.

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “10 Tough Questions CEOs Are Asking CISOs.“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/personal-info-of-106m-mgm-resort-guests-leaked-online/d/d-id/1337102?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Discussions about recruitment trends and how people can further their careers in cybersecurity are common topics at industry conferences these days. Recently, at Black Hat Europe, one of the most striking career discussions revolved around audience demographics, which reminded me of a point I’d heard earlier in the week: the “Rule of Steve,” a concept originally introduced by Dawn-Marie Hutchinson, chief information security officer for pharmaceuticals and RD at GSK.

This rule is easy enough to explain: In a room full of cybersecurity professionals, there are usually more people called Steve than there are females. Yes, this is a tongue-in-cheek observation, but it illustrates how far our industry has to go in encouraging not only women but other diverse groups into the workforce.

The security industry needs more people. Globally, (ISC)² estimates the workforce shortage to be over 4 million. That’s a lot of people, with the biggest shortage of around 2.6 million reported in Asia-Pacific. The shortfall in North America stands around 560,000, in Latin America around 600,000, and in Europe just shy of 300,000.

It is time to think beyond the usual confines of building a specialized workforce. Often, roles are advertised requiring a master’s degree in information security or a Certified Information Systems Security Professional (CISSP) or Certified Ethical Hacker (CEH) qualification. Without doubt, these qualifications are highly valued and sought after, but they probably can only cover a very small percentage of the 4 million workforce shortage — not to mention that individuals with these qualifications are likely already working in the industry anyway.

To build the workforce we need to encourage diversity. We need more women. We need more ethnic diversity. We need more neurodiversity. We need more men. We need more people from a whole range of “groups” who have the right aptitude and attitude to work in information and cybersecurity.

Does everyone who works in the industry need to be technical? No! Here’s an example. Business information security officers (BISO) need to be able to speak to the business and speak to the IT and information security functions. They do not need to be able to trace alerts through a SOC to identify potential security incidents and breaches. So instead of looking for a BISO with a Certified Information Security Manager (CISM) qualification, which arguably is the closest professional qualification for a BISO, the net should be spread wider.

For example, don’t limit potential candidates to the around 27,000 people with CISM (according to ISACA). Rather, look within the organization for individuals who are perhaps security ambassadors or champions, or others who have expressed an interest to join the group. Even if there are no direct expressions of interest then start with “lunch and learn” sessions to stimulate interest. Don’t be dry — make it exciting — and in this way organizations can start to build the next generation of security professionals.

Does everyone who works in the industry need to be in an office? No to this question, too. Remote working significantly expands the pool of candidates, which in turn brings access to better and diverse resource groups. A disparate and global workforce thinks more broadly, has different ideas, and can drive faster business outcomes than centrally located groups.

Some people in the industry do need to be technical, shown again at Black Hat Europe, and finding people with the right technical skills and expertise is also a challenge. However, at the event there was a cohort of technical people — DBAs, for example — who were desperate to make their way in the world of cybersecurity but couldn’t find an opening because they didn’t have the CISSP qualification. Is the industry limiting itself to that extent? According to (ISC)² there were fewer than 140,000 CISSP qualified individuals globally at the end of May 2019. Surely, we can see a way to bring in these individuals with an aptitude for technology and an enthusiasm for security, and train them into the roles so desperately needed?

There are initiatives around the globe, such as Vietnam’s Project DARE (Data Analytics Raising Employment) developing workplace-ready competencies for employers. The US National Institute of Standards and Technology (NIST) Cybersecurity Framework is fast becoming a globally recognized approach for cybersecurity and is being used to develop employee competencies. Look for these in your country or region and take advantage of them — they are there to help build the security workforce.

Many of the people I spoke with at Black Hat Europe were not called Steve and would make fantastic additions to the global information security workforce. It’s time to break the “Rule of Steve” and think outside the box.

Related Content:

• A Password Management Report Card
• Cybersecurity Vendor Landscape Transforming as Symantec, McAfee Enter New Eras
• Hiring Untapped Security Talent Can Transform the Industry

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “Chaos Order: The Keys to Quantum-Proof Encryption“

Maxine leads Omdia’s cybersecurity research, developing a comprehensive research program to support vendor, service provider, and enterprise clients. Having worked with enterprises across multiple industries in the world of information security, Maxine has a strong … View Full Bio

Article source: https://www.darkreading.com/operations/its-time-to-break-the-rule-of-steve/a/d-id/1337040?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple