IT Security State of the Union: Three Short Security Essays WHITE PAPER WHITE PAPER: State of the Union on Security Contents State of the Union on Security, Part I: The Rise of Nation-State Activities ..............................3 The Threat Landscape of Software Vulnerabilities ..............................................................3 A Sophisticated, Layered Approach to Attack Requires a Sophisticated, Layered Approach to Defense ............................................................................................................4 State of the Union on Security, Part II: SamSam Attacks and the Need to Prioritize Risks ....4 The SamSam Ransomware Family .....................................................................................4 Edge Servers or Infecting Servers .......................................................................................5 Not Looking for Individual System Payouts .........................................................................5 Attack on the City of Atlanta .................................................................................................5 How Do We Start Prioritizing Risks? ....................................................................................5 Known Vulnerabilities ...........................................................................................................6 People: Your Weakest Link ..................................................................................................6 State of the Union on Security Part III: The Framework of CIS Critical Security Controls ......6 CIS Controls—A Proven Security Framework .....................................................................6 Inventory and Control of Hardware and Software Assets ...................................................7 Continuous Vulnerability Management ................................................................................7 Controlled Use of Administrative Privileges .........................................................................7 Secure Configuration for Hardware and Software ...............................................................8 Staying Vigilant ..........................................................................................................................8 This document is provided strictly as a guide. No guarantees can be provided or expected. This document contains the confidential information and/or proprietary property of Ivanti, Inc. and its affiliates (referred to collectively as “Ivanti”) and may not be disclosed or copied without prior written consent of Ivanti. Ivanti retains the right to make changes to this document or related product specifications and descriptions, at any time, without notice. Ivanti makes no warranty for the use of this document and assumes no responsibility for any errors that can appear in the document nor does it make a commitment to update the information contained herein. For the most current product information, please visit www.Ivanti.com. Copyright © 2019, Ivanti. All rights reserved. IVI-2259 1/19 CG/AB/JR/BB/DL ivanti.com 2 WHITE PAPER: State of the Union on Security State of the Union on Security, organizations like airlines, banks, the Chernobyl nuclear Part I: The Rise of Nation-State power plant, pharmaceutical company Merck, FedEx, and Activities global shipping company Maersk, which was forced to shut down container terminals in ports from Los Angeles Without question, hackers today can have a major impact to Mumbai. It managed to take down multi-national on critical infrastructure worldwide. Hospitals, banking companies whose internal networks were large enough systems, power grids, and many other areas are regularly that the infection could travel quite far from ground zero. It prone to and affected by cyber threats. The uptick is in no infected more than 2,000 organizations worldwide. small part due to the widespread availability today of sophisticated attack tools. The question is, then: How do we as security and IT professionals strategize and make ourselves more As you may know, for example, the base architecture for effective at defending against this type of attack? 2017’s NotPetya attack used exploits that were developed The Threat Landscape of Software by a nation-state entity—in this case, the U.S. National Vulnerabilities Security Agency (NSA). The tools and vulnerabilities that were being exploited were disclosed through the activities We have to prioritize risk. of a hacking group who got their hands on these NSA To this day, for example, software vulnerabilities play a tools. significant part in the overall threat landscape—the total In this case, the attack that used nation-state tools was attack surface that we're exposed to. orchestrated by nation-state hackers as well. NotPetya The Forrester Wave: Vulnerability Risk Management, Q1 masqueraded as ransomware but was in fact not 2018 cites that 58 percent of enterprise organizations motivated by money at all. Most ransomware campaigns suffered a breach at least once in the past year. Now, not provide a variety of mechanisms to allow for payment to every breach among that 58 percent was headline- occur because they want to make sure that the authorities grabbing where millions of accounts were exposed. But can't shut them down and limit their ability to get a payout. the scary part of all of this is that more than half of the Well, a lot of those characteristics were lightly companies out there suffered at least one breach in the implemented or near nonexistent in the NotPetya attack. past year. The attackers also provided no means for those impacted The good news is there’s a solid takeaway here. Of those to recover files even if they paid the ransom breaches, 41 percent exploited a software vulnerability. What we really saw was ransomware used as a social and One very significant breach during that time period—the economic disrupter rather than a direct impact to try to get Equifax breach that exposed the personal data (Social a payout—a new evolution in cyber-attacks. It was a Security numbers, addresses, driver’s license numbers, deliberate, malicious act designed to destroy, not to credit card numbers, and more) of 147.9 million extort—in this case, to destabilize a country. The NotPetya consumers—can be traced to software vulnerabilities in attack targeted Ukrainian infrastructure by compromising the Apache Struts web framework. Ukrainian accounting and tax software from the financial There were likely other stepping stones employed to get to tech company MeDoc and using that to launch the attack that Apache web server and access sensitive data. But, on those who would likely download that software— again, software vulnerability was the way that the data Ukrainian businesses. was actually accessed and extracted. Notably, this was It proved very successful, too, at destroying all records on also a software vulnerability for which a patch existed. targeted systems, rendering them unusable. Entire Returning to our exploration of nation-state attacks, let’s organizations in Ukraine found themselves unable to look now at WannaCry. It was a nation state–developed operate for days on end. NotPetya impacted hospitals— software exploit and ransomware incident that affected leading to canceled surgeries—and other major ivanti.com 3 WHITE PAPER: State of the Union on Security more than 230,000 endpoints in over 150 countries other existing tools like PsExec and WMIC, and to access worldwide in a short period of time. other systems remotely using those tools and compromised credentials, allowing the exploit to spread As with NotPetya, attackers used the EternalBlue exploit, even to where the SMB exploit was not available. developed by the NSA, and leaked by the Shadow Brokers hacker group on April 14, 2017. EternalBlue Finally, in the second wave of attacks, phishing was exploits a vulnerability in Microsoft’s implementation of the another method NotPetya used to introduce malware onto Server Message Block (SMB) protocol. a machine. Did you know that phishing is actually the number one threat vector for ransomware and other Microsoft issued a security bulletin that detailed the flaw malware? and released a patch update. But, as with the Equifax breach and NotPetya (which struck after WannaCry), All of this is to say that this was a very sophisticated, despite the availability of a patch, attackers were later able layered approach to attack—requiring an equally to launch the WannaCry attack using the EternalBlue sophisticated layered approach to defense. As we’ve exploit. seen, properly executed patch management is critical, but so is privilege management to reduce the spread of Another tool employed in the attack was DoublePulsar, a malware through an organization. And, so is security backdoor utility also developed by the NSA and leaked by awareness training for employees to reduce the the Shadow Brokers that allowed the WannaCry infections effectiveness of phishing campaigns. to get into environments where there wasn’t a public- facing SMB port. DoublePulsar was previously installed on In our final essay, we’ll take a closer look at the risks you tens of thousands of systems globally, leaving control of should prioritize and the security controls you should have those systems in the attackers’ hands and enabling them in place to mitigate them.. to use DoublePulsar to easily execute the WannaCry ransomware. Because DoublePulsar runs in kernel mode, State of the Union on Security, it grants