Overcoming inevitable risks of electronic communication This page is unintentionally left blank. This publication may be cited as: Teemu Väisänen, Lorena Trinberg and Nikolaos Pissanidis, 2016, “I accidentally malware - what should I do… is this dangerous? Overcoming inevitable risks of electronic communication”, NATO CCD COE, Tallinn, Estonia. This publication is a product of the NATO Cooperative Cyber Defence Centre of Excellence (the Centre). It does not necessarily reflect the policy or the opinion of the Centre, NATO, any agency or any government. The Centre may not be held responsible for any loss or harm arising from the use of information contained in this publication and is not responsible for the content of the external sources, including external websites referenced in this publication. Information has been obtained by the Centre from sources believed to be reliable. However, because the possibility of human or mechanical error by our sources, the Centre, or others, the Centre does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the result obtained from the use of such information. Digital or hard copies of this publication may be produced for internal use within NATO and for personal or educational use when for non- profit and non-commercial purpose, provided that copies bear a full citation. Exception: Figure 27 is under Creative Commons http://creativecommons.org/licenses/by-sa/3.0/ www.ccdcoe.org [email protected] This study is the result of the ‘Unsecurable Systems Research’ -project of NATO CCD COE’s Program of Work (POW) 2015. The research purpose was to address the security concerns related to I) users who are exposed to the public and who cannot always follow the best security practices and II) legacy systems. In I) the professional positions of the users require different actions, such as opening attachments sent by not verified sources. Users are from public relations (PR), human resource management (HR) and from other posts exposed to public. It is assumed that devices used by such users are more likely to get infected at some point than devices used by normal employees, so additional protection techniques are required. The assumed audience of this study is security officers designing secure systems, system administrators managing security in systems, and managers to gain information about the existing technologies and required resources. Results of the study can be implemented by integrating the described techniques to existing systems (or processes) to improve their level of security. They can also be used to design new systems and might provide ideas for new security controls and mitigation techniques. The NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) is an international military organisation accredited in 2008 by NATO’s North Atlantic Council as a ‘Centre of Excellence’. Located in Tallinn, Estonia, the Centre is currently supported by the Czech Republic, Estonia, France, Germany, Greece, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, Turkey, the United Kingdom and the USA as Sponsoring Nations, and Austria and Finland as Contributing Participants. The Centre is neither part of NATO’s command or force structure, nor is it funded by NATO. However, it is part of a wider framework supporting NATO Command Arrangements. NATO CCD COE’s mission is to enhance capability, cooperation and information sharing between NATO, NATO member states and NATO’s partner countries in the area of cyber defence by virtue of research, education and consultation. The Centre has taken a NATO-oriented interdisciplinary approach to its key activities, including academic research on selected topics relevant to the cyber domain from the legal, policy, strategic, doctrinal and/or technical perspectives, providing education and training, organising conferences, workshops and cyber defence exercises, and offering consultations upon request. For more information on NATO CCD COE, visit the Centre’s website at http://www.ccdcoe.org. It is a common security policy not to open links1 or files coming from unknown senders via email2, instant messaging (IM)3, or social networking services (SNS). When these messages or websites contain known malware4, they can be automatically deleted and never shown to the receiver. There are different policies and techniques to handle such messages; they can be blocked, deleted, stored to spam folders, the receiver is or is not notified, messages can be filtered and modified so that only the malicious files or links are removed, and so on. If the messages or links contain unknown malware, the approach to handle them must be different, because the security tools do not detect the security threat. Even though files or links received from unknown senders may appear to be benevolent, they still might be malicious. It is possible that links open websites that only serve malicious content for a brief period or for certain types of visitors. Many of these unknown senders are just normal human users and received messages harmless, but some may actually be hostile: for example, adversaries might use stolen accounts and/or employ botnets5 to send messages. In normal situations malicious messages should not be opened. However, there are people who have to, or want to, open such links and files. Ordinarily, they are opened using specific clients or web browsers to access web pages from the World Wide Web (WWW). For example, it is possible that: secretaries need to read and reply to applications originating from unknown contacts, conference program committee members have to review abstracts and publications, and malware researchers want to discover previously unknown malware or understand the behaviour of botnets. Therefore a security policy where trust is only given to known contacts cannot be employed. Instead good technical solutions must be developed to mitigate threats arising from the described scenarios. In this study, two types of environment are analysed. In the first, it is assumed that baseline security controls are present. This means that administrative privileges are controlled, devices and software (SW) are inventoried, configurations are correct, software in devices within the environment is up-to-date and patched, data recovery is handled properly, backups work, etc. Of course, even up-to-date systems normally still contain several unknown, but exploitable, vulnerabilities6, configurations can be done incorrectly, and users can make mistakes, all of which result in infected systems. The second type of environment includes legacy systems, which usually contain a wider range of known exploitable vulnerabilities and thus cause additional risks7 and require more security controls. The aim of this study is to find mitigation techniques for a number of risks resulting from the usage of systems that will eventually become infected. The study was done by analysing usage scenarios, their actors, the assets to be secured, related threats, suitable mitigation mechanisms, threats lacking sufficient mitigation mechanisms, and describing novel mitigation mechanisms. The key results of this study are a set of threat descriptions related to various attack phases, existing mitigation mechanisms, proposed improvements for existing mitigation mechanisms, and novel mitigations. In addition, the most suitable mitigation techniques are assessed with regard to different attack/defence phases. A mitigation technique may be categorised according to: whether it can be used before the breach, whether it can protect against the actual compromise or during or after the breach, or whether it may be used in more than one attack phase. 1 This study defines a link as any Uniform Resource Identifier (URI) using zero or more registered or unregistered scheme component. 2 It is still common that emails are not end-to-end secured. Some techniques used for securing emails are: Pretty Good Privacy (PGP), Secure/Multipurpose Internet Mail Extensions (S/MIME), and/or Domain Keys Identified Mail (DKIM) [1, p. 592]. 3 The same applies to many IM solutions. For example, Extensible Messaging and Presence Protocol (XMPP) lacks native end-to-end encryption support, but many extensions and protocols, such as Off-the-Record Messaging (OTR), can be used to improve XMPP security. 4 Malware is code that is used to perform malicious actions [2]. 5 A botnet is a group of co-opted infected devices (known as bots or zombies) under control of an adversary (known as a botherder or botmaster) [3]. Botnets might use multiple automated propagation vectors [4] and they can be described as coordinated malware that exhibits group behaviour in communication and/or activities [5, p. 82]. 6 RFC 4949 [6] defines a vulnerability as a flaw or weakness in a system’s design, implementation, or operation and management that may be exploited to violate the system’s security policy. 7 On the other hand, for example, ICS networks are considered to be more defensible than normal enterprise IT systems [7]. Väisänen, Trinberg, Pissanidis 2016 1 The results of this study can be implemented into existing systems (or processes) by integrating the described security controls8, countermeasures9 and mitigation mechanisms in order to improve their level of security. The results can also be used to design new systems and might provide ideas for new security controls and mitigation techniques. The study proposes that in addition to the baseline security