Michelle Drolet

Subscribe to Michelle Drolet: eMailAlertsEmail Alerts
Get Michelle Drolet via: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn

Related Topics: SOA Best Practices Digest, Security Journal, Web Analytics, CyberSecurity Journal


How to Expose Cyber-Attacks and Combat Threats

Proper analysis will flag suspicious behavior and allow the IT department to assess the threat and take action to close it down

Cybercriminals are employing more sophisticated techniques all the time and far too many companies and organizations still don't have the protection they really need to safeguard their systems.

The prevalence of targeted attacks and advanced persistent threats (APTs) is disturbing.

The risk is that security is breached, typically through manipulation of employees using a technique such as spear phishing, and existing security systems are unable to detect the attack. Data can be harvested for many months, or even years, before the breach is discovered.

According to a white paper from the Enterprise Strategy Group, 59% of enterprise security professionals believe their organization has been the target of an APT, and 40% of large organizations have invested in various new security technologies as a direct result of APTs.

How Do They Get In?
Penetration may be achieved stealthily, typically with a targeted attack on an employee. The cybercriminal will gather data online, with social network accounts proving to be a particularly rich source. According to Trend Micro research spear phishing is the preferred method, accounting for a staggering 91% of targeted attacks. The employee targeted will receive an email that appears to come from an organization like LinkedIn, and if they trust the content, they'll follow the link within to a fake website where they may be tricked into allowing a cybercriminal to gain remote access to their computer.

Once the attacker has access to one employee's computer they can use it to gain remote access to devices belonging to other employees in the organization. The threat has spread dramatically and traditional security tools will be none the wiser. Provided the attacker is careful to keep the data theft slow and steady, with frequent small file transfers rather than a big data dump, there's little chance that it will be picked up by existing security systems.

How Do You Catch Them?
The idea is to analyze downloads and network payloads in order to expose potentially malicious communications. It's about detecting malware or human intrusions into your system by paying close attention to the addresses of any communication. Does the external location for a file transfer make sense? Does the address have a bad reputation? Are the SSL certificates legitimate?

It's important to expose suspicious internal communications as well. Is there any reason that a specific employee's computer should be the source of a remote desktop session on another employee's device? A proper analysis will flag suspicious behavior and allow the IT department to assess the threat and take action to close it down.

Keep Your Guard Up
The nature of this threat dictates the need for constant vigilance to keep the cybercriminals out. Shut down one route and they will continue to explore other avenues of access, the more obscure the better. There are many potential penetration points to consider. Activity must be analyzed across the entire organization and you need real-time information on potential attacks and known malicious sources.

How about blocking suspicious URLs and web-based content to stop penetration from the outset? Do you have application firewalls or database security? It's also wise to ensure that you have data encryption technology in place; far too many companies focus on a Maginot line defense, pouring resources into defending against external attacks and forgetting that if attackers do gain access they can circumvent this security from within. Is your user authentication stringent enough?

How Do You Know You've Caught Them?
One of the most worrying aspects of APTs is that advanced attacks typically go unnoticed for over a year. You may be locking the stable door after the horse has bolted. That's why an analysis of internal traffic is so vital. Suspicious behavior must be followed up and investigated. In the longer term you want to reach beyond identifying and blocking attacks to unmask the criminals responsible so that you can share intelligence to nullify their threat.

Targeted attacks are still on the rise. As governments and large organizations begin to take action and get a handle on the threat, there's a real risk that many cybercriminals will look for easier prey. Don't allow your company to be an easy target.

More Stories By Michelle Drolet

Michelle Drolet is founder of Towerwall, a data security services provider in Framingham, MA with clients such as PerkinElmer, Smith & Wesson, Middlesex Savings Bank, Brown University and SMBs. You may reach her at michelled@towerwall.com.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.