The Changing Face of Cyber-Attacks: Understanding and Preventing Both External and Insider Security Breaches

WHITE PAPER | June 2013 The Changing Face of Cyber-Attacks: Understanding and preventing both external and insider security breaches Russell Miller CA Security Management PROTECT AGAINST INSIDER THREATS AND EXTERNAL ATTACKS Table of Contents Executive Summary 3 Section 1: Challenge 4 External Cyber-Threats are Changing Rapidly Section 2: Opportunity 7 Where Organizations Fall Short Section 3: 12 Conclusions Section 4: 12 Refernces Section 5: 13 About the Author 2 PROTECT AGAINST INSIDER THREATS AND EXTERNAL ATTACKS Executive Summary Total number of records containing Challenge sensitive personal Techniques to attack computer networks are never static. Methods and tools evolve, as do the information attackers themselves. The attacker landscape from a few years ago—where individuals or small involved in groups attacked organizations for fun and profit—no longer exists. The environment is much more security breaches complex today. Semi-organized “Hacktivist” groups, such as Anonymous and LulzSec, attempt to in the U.S. is cause damage for causes they find worthwhile. Even state-sponsored actors are becoming prominent, 607,611,003 bringing dramatically expanded resources to bear. Advanced Persistent Threats (APTs) are perhaps not in 3,716 data new, but have come to the forefront of cyber-security awareness as a result of these changes. Insider breaches between threats are also ever more complex, with the potential for damage increasing due to rapidly January 2005 expanding stores of sensitive information and highly-dynamic and virtualized IT environments. and April 2013. – A Chronology of Data Breaches, Privacy Rights Clearinghouse Opportunity Fortunately, an organization’s toolbox to defend against security breaches is more complete than ever. Beyond perimeter tools and detection solutions, such as firewalls and intrusion detection systems, cyber-security experts can protect their systems and data from the inside out. Data can be automatically discovered, classified and controlled with modern data leak prevention technologies. The identities that are needed to access data and critical systems—particularly privileged identities— “As cybercriminals can be carefully managed and monitored. With an identity and data-centric approach to security, have become organizations can meet the challenge of ever-evolving threats. more skillful and sophisticated, they have eroded the effectiveness Benefits of our traditional Organizations that successfully reduce the chances of a security breach not only guard their data, but perimeter-based protect their brand, and avoid costly lawsuits and fines. In addition, organizations with an extensive 1 security controls.” security program can save money by simplifying audits and can focus efforts on innovation instead – Forrester Research, Inc. of constantly worrying about devastating attacks. 3 PROTECT AGAINST INSIDER THREATS AND EXTERNAL ATTACKS “APT1 has Section 1: Challenge systematically stolen hundreds External Cyber-Threats are Changing Rapidly of terabytes of It is tempting to think about cyber-attacks as an ever-present, but unchanging threat. While individuals, data from at small groups, and organized crime are still significant players, they are no longer the only threat to an least 141 organization. To the contrary, attacker profiles have shifted, and new goals and sources of motivation organizations, have fundamentally altered the nature of the threat landscape. The trends driving this shift include: and has demonstrated The militarization of cyber-attacks. Network penetrations to cause damage and steal intellectual the capability property are now commonly state-sponsored, with highly-trained, disciplined and patient attackers. and intent to Military attackers can have access to resources such as training, computing power, and cutting-edge steal from dozens R&D not available to previous generations of attackers. Their targets often include critical infrastructure of organizations to the capture of foreign intellectual property. Recent reports have gone so far as to identify a specific simultaneously.” military unit as the source of a significant number of cyber-attacks. – Mandiant Cyber-security firm Mandiant released a report in February 2013 titled “APT1: Exposing One of China’s Cyber Espionage Units.”2 This report detailed the actions of the China-based group APT1, a unit Mandiant has identified as the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, which is most commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. Operation AntiSec The rise of “hacktivism”. Groups such as Anonymous frequently attack organizations in the name of A joint effort by social causes and look to cause significant financial and reputational damage to a target organization. the groups LulzSec, Hacktivists have targeted entities from MasterCard and Visa, to the U.S. Department of Justice, the Anonymous, and Church of Scientology, the state of Egypt and the World Bank. others, this extremely large New, sophisticated attacks have often been called Advanced Persistent Threats, a term that is hacking operation sometimes derided, but has attained widespread adoption. Whatever these attacks are called, they targeted many have unique qualities that make them more difficult to defend against: companies and • Patient individuals will wait for new vulnerabilities to open up or combine seemingly small security government weaknesses into a large-scale, damaging attack. agencies, from the Arizona • A dedicated, state-sponsored team will not be dissuaded from targeting an organization simply Department of because it has stronger security than similar companies. Public Safety • An APT can unfold in a very measured, deliberate manner, helping it evade even the most well- to the British configured firewalls and intrusion-detection systems. newspaper The Sun and the Companies from RSA Security to Google to Northrup Grumman have found themselves the target Fox News of these targeted attacks. Twitter account. 4 PROTECT AGAINST INSIDER THREATS AND EXTERNAL ATTACKS Insider fraud Insider Threats is a common occurrence. Insiders pose a significant risk due to the damage they can cause through either malicious or On average, inadvertent actions. The most dangerous risk is an organization’s privileged users. These organizations have administrators often possess the privileges to perform essentially any operation on critical systems had approximately and users often have accumulated more entitlements than they need for their current job role. 55 employee- Insider threats are not all the same. There are three types of insider threats, malicious insiders who related incidents deliberately steal information or cause damage, insiders who are unwittingly exploited by external of fraud in the parties, and insiders who are careless and make unintended mistakes.: past 12 months.3 • Malicious insiders are the least frequent, but have the potential to cause significant damage – The Ponemon Institute due to their insider access. Administrators with privileged identities are especially risky. According to the Ponemon Institute, “data breaches that result from malicious attacks are most costly.”3 • Exploited insiders may be “tricked” by external parties into providing data or passwords they shouldn’t. • Careless insiders may simply press the wrong key and accidentally delete or modify critical information. Many security breaches due to insiders are never made public. Organizations would rather keep these breaches private to avoid the reputational hit and customer concerns about their security About 65 percent that may result. However, many highly-damaging insider breaches have been disclosed, both publicly of employees and anonymously. who commit insider IP theft The potential for damage from insider threats has recently increased with the quantity of sensitive had already data exploding and more powerful administration tools. The rise of virtualization, in particular, has accepted given rise to new risks. First, there is a new class of administrators on the hypervisor that must be positions with managed, monitored and controlled. Second, those hypervisor administrators can change, copy, or a competing delete dozens of virtual machines with only a few clicks of the mouse, making theft and damage company or simpler, faster, and more damaging and difficult to detect than ever. started their own company at the Well-Known Insider Security Breaches time of the theft. WikiLeaks Switzerland’s Intelligence Service (NDB). About 20 percent were recruited by In what is perhaps the most well-known insider A senior IT technician reportedly downloaded an outsider who security breach, (former) U.S. Army Private terabytes of classified counter-terrorism targeted the Bradley Manning leaked hundreds of thousands information to physical hard drives, which he data. More than of classified military and State Department carried out of the datacenter in a backpack. half steal data documents to the WikiLeaks organization, which Investigators believe that the administrator had within a month made many of them available on the Internet. become disgruntled when his advice on securing of leaving. While an “insider”, there are significant key systems was ignored. A source close to the questions about why Manning had such investigation called the perpetrator a talented – Behavioral Risk extensive access to view and classify technician with “administrator rights”, giving Indicators of Malicious Insider IP

Load more