Cybersecurity Guide: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING CYBERSECURITY GUIDE: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING TABLE OF CONTENTS 3 INTRODUCTION 4 SECTION 1 THE SITUATION REPORT 9 SECTION 2 THINK LIKE DA VINCI: MORE ART IS NEEDED IN THE SCIENCE OF CYBERSECURITY 16 SECTION 3 THROUGH THE LOOKING GLASS: MACHINE LEARNING AND ARTIFICIAL INTELLIGENCE 21 ENDNOTES PAGE 2 CYBERSECURITY GUIDE: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING Across the globe, lives and livelihoods are increasingly For information-security professionals, successfully moving online, physical and digital worlds are beginning to defending against the fire hose of now-nonstop online overlap, and digital currencies with no real-world equivalent attacks are both the stuff of nightmares and the reason to can buy real-world goods and services. Artificial intelligence get out of bed in the morning. Who’s winning — the is powering autonomous vehicle decision-making,1 finding attackers or the defenders? new drug candidates2 daily and personalizing lessons3 to help students learn. At the same time, doctors are Given the daily drumbeat of successful intrusions that often performing life-saving surgeries on the other side of the cripple companies’ operations and erase millions of dollars in globe via the internet4 and robot proxies while networked stock value,5 it’s hard to tell. sensors shake up industries from power generation to public transit. Every year, the list of industries being disrupted by To bring the current and future landscape of cybersecurity sensors, smart machines, and microprocessors expand. into focus, HP conferred with leading experts in the field to create this comprehensive, up-to-date guide. The aim is to Just about the only thing that isn’t changing is that, where an help decision-makers who lead information-security efforts opportunity presents itself, criminal and political bad actors at mid-sized and enterprise companies understand all of the look to exploit vulnerabilities for gain. And many of the same options available to prevent damage from cyber insecurity tools and techniques that are bringing such sweeping and keep their operations running smoothly. benefits to society are also making malicious efforts easier and more damaging. Malware, phishing and distributed denial of service (DDoS) attacks are just a few of the tricks that have piggybacked onto the digital breakthroughs that are advancing our world. PAGE 3 CYBERSECURITY GUIDE: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING Section 1: The situation report PAGE 4 CYBERSECURITY GUIDE: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING A new malware specimen will Meanwhile, millions of PCs and network-connected printers, emerge on the internet about cameras, thermostats and other Internet of Things (IoT) devices sit unsecured, with the latest security patches not installed, just waiting every four seconds. for someone with bad intentions to find an open door into an organization’s most sensitive data. The result is a constant stream of news reports about successful intrusions into networks that should be secure. From January to September 2019 alone, 621 ransomware attacks were launched, Today, 6 million to 11 million new malware infections will be including incidents that shut down schools and left surgeries on hold recorded on computers running just one type of antivirus software.6 as administrators tried to deal with the threats. The costs of these Scammers will send over 4 billion phishing emails in the hopes of attacks were estimated to be over $186 million.11 Meanwhile, stories luring unsuspecting people into clicking a fraudulent link that will let continue to break about vulnerabilities inside microchips that could them steal their personal data or gain access to a business network.7 leave the majority of unpatched modern computers at risk.12 And a new malware specimen will emerge on the Internet about every four seconds.8 It’s clear that these attacks — almost all financially motivated — aren’t only targeting groups like 2016’s Indian bank’s data breach13 An unknown number of hackers will spend about $150 to rent a or major organizations such as Google, Sony, Equifax, and Yahoo. botnet for a week9 to launch a distributed denial of service (DDoS) Hackers are also looking to extort small and mid-sized businesses,14 attack aimed at taking down an online service or a network by health-care providers, municipal governments, and other networks. flooding it with traffic. Cumulatively around the world, these attacks In fact, there’s so much monetary incentive that the threat is regularly fire 500 gigabits per second of weaponized data at mushrooming. One analysis puts the cost of cybercrime by 2021 at business and government servers to consume network bandwidth $6 trillion — yes, trillion — a value greater than the gains produced and shut the targets down.10 by the entire world trade in illegal drugs.15 PAGE 5 CYBERSECURITY GUIDE: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING Don’t neglect the obvious These threats are all too familiar to information-security expert And with the rapid proliferation of IoT devices and other machines Jason O’Keeffe, an HP Print Security Advisor. He knows the bad that are connected to both the external-facing internet and a guys are getting plenty of help from inadvertent computer-user business’s internal network without proper authentication required, behavior and under-deployed cybersecurity defenses due to bad guys have a rapidly increasing array of access points. Gone are many organizations’ nonexistent or stretched-too-thin the days when an information-security manager could feel the job is cybersecurity staff. done once critical servers at the core of the company’s operations are sufficiently protected. Now, that security envelope must extend While assessing companies’ computer networks for vulnerabilities, to the sometimes millions of connected devices in remote offices O’Keeffe has seen all kinds of problems that make a hacker’s work — and in the pockets of employees. easier, including glaring omissions by IT departments that should know better. “We’re trying to protect PCs, servers and other core parts of networks, but the IoT devices are the ones that are now putting During one such assessment, O’Keeffe was asked to snoop around a networks at greater risk,” says Shivaun Albright, HP’s Chief massive manufacturer’s IT infrastructure. Among numerous Technologist for Print Security. “For every 100 lines of source code problems, he found that the default factory-set passwords hadn’t written, there’s typically one defect. So all a hacker has to do is find a been changed on 90% of the company’s 36,000 printers spread defect that gives them entry to the system. We want to make sure around the network, allowing anyone with the know-how to bypass we reduce those exposure points as much as possible.” all security on the devices. Further investigation by O’Keeffe found that many printers were incorrectly configured, which could have allowed an outsider to gain access to the printers and reconfigure them to steal data from the network — or hijack them into service as a botnet. “The VP slammed the table and said, ‘Jason, are you kidding me?’” O’Keeffe recalled. “He was fuming.” All a hacker has to do is find a defect that gives them entry to the system. For every 100 lines of source code written... there’s typically one defect... PAGE 6 CYBERSECURITY GUIDE: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING Access everywhere For today’s hackers, the massive profit potential drives innovation So the key to keeping a network safe is giving IT workers the tools to and creativity. Among the greatest threats, says Albright, are detect intrusions and protect endpoints — the easily overlooked botnets — the automated tools built out of thousands of hacked opportunities for access that a determined foe will exploit if they’re IoT devices. To create a botnet, scammers hijack the processors of not properly defended. And if there is an intrusion, O’Keeffe stresses, unsecured machines, then use the compromised devices to mine it’s critical to have a robust recovery response in place to quickly bitcoin — or they can rent their botnet to others to launch contain and reverse the damage. ransom-seeking DDoS attacks.16 Daniel Kalai, the founder of managed IT service companies that Given the volume of attempted intrusions happening constantly and include home and small-business cybersecurity firm Shieldly, agrees the increasing number of ways hackers can get in, O’Keeffe and with Albright and O’Keeffe that the focus needs to be on securing a other experts say it might be better for security managers to think of network’s edges and endpoints.17 But he believes the pendulum has their perimeter networks as already breached. “What the security swung too far from thinking in terms of prevention to an over- community needs to fully accept is that their networks may already weighted focus on recovery. He disagrees with the notion that a be compromised — they just don’t know it yet,” O’Keeffe says. compromised network is inevitable in today’s digital landscape. Of the 50 plus small-sized and enterprise companies’ cybersecurity protocols that he has analyzed, O’Keeffe says every single one of them had vulnerabilities that would allow a hacker to gain access to the network through one of the printers, cameras, mobile devices or other endpoints connected to it. “Cybersecurity used to be about prevention. But now, so much is about remediation. It’s a sad way to look at things that comes from people losing faith in prevention tools. But a lot can be done to prevent an attack.” - Daniel Kalai, Founder of Shieldly PAGE 7 CYBERSECURITY GUIDE: HACKERS AND DEFENDERS HARNESS DESIGN AND MACHINE LEARNING $3.92 million the average cost of a data breach - Ponemon Institute The price of failure Better use of security devices, standards and protocols would certainly improve outcomes for those who institute their cyber- defense programs diligently, but real-world numbers show that there’s a huge gap between planning and execution.