Gregarius » éléments par John Pirc

éléments par John Pirc

Closing the time to protection gap with threat forecasting

Publié: mars 10, 2014, 12:47pm CET par John Pirc

The dominant theme at this year’s RSA Conference in San Francisco was actionable security intelligence, a term which can mean different things to different people. For example, do bad IP addresses, DNS fast fluxing information, and geolocation constitute security intelligence? Additionally, do malware campaigns and adversary tracking count as security intelligence?

The answer is yes for both questions, but it is important to note that these are not the only high-level indicators that can be considered security intelligence. The key challenge is understanding how to "apply" security intelligence in such a way that it is actionable. The following may be considered provocative and even go against the grain of opinion in Silicon Valley: In most approaches to security, there is too much emphasis on the adversary and not enough on understanding the attack surface.

Pirc’s Law of Adversarial Disruption

The image above visually represents Pirc’s Law of Adversarial Disruption (is based on the Law of Disruption), which is my assertion that there is a rapidly expanding innovation gap between the adversary and traditional product-based security best practices. Further, this gap can only be disrupted by the application of new data-driven approaches that provide enterprises with actionable security intelligence and better visibility into their unique risk profiles. This is a key issue that security professionals face in our race to keep up with the adversary. Over time, cyber criminals have been able to re-invent themselves due to increased connectivity, social engineering, and the various applications that enable them to conduct campaigns and operations against a multitude of targets across every industry vertical. The security industry is preoccupied with the adversary and some believe that taking out a cyber criminal’s supply chain or trying to build a better version of "Anonymous" through white hat cyber vigilante groups will solve the problem. These tactics may help, but they won’t solve the problem. Attribution and traceability will eventually catch cyber criminals, but once their methods of attribution are uncovered, cyber criminals will move on to something more advanced. That amounts to a lot of work for little gain and also takes the focus off defending assets.

I’ve yet to attend a security conference where I haven’t heard the quote from Sun Tzu’s Art of War: "Know thy Enemy". After years of focusing on the threat landscape, there is still one thing we need to know better than the enemy… ourselves. You can’t properly defend your infrastructure if you are not intimately familiar with your attack surface, and few enterprises fully understand the full scope of the attack surfaces within their own organizations. Enterprises continue to buy and deploy tier 1 security products (antivirus, NGFW, IPS, SWG, SIEM, etc.) because these products are listed as security best practices. In order to defend against most of today’s threats, we first have to know what they are, and then we have to propagate that information across various security products. Some security vendors are quick to respond, while others are not so quick. This, however, is a shotgun approach to security that will likely solve only about 70 percent of an enterprise’s risk. Enterprises definitely need these technologies, but what about the other ~30 percent? This is where actionable intelligence can be used to offset the risk in the change window indicated in the image. We can never be 100 percent risk free, but by utilizing actionable security intelligence, we can begin to close the gap of time to protection and disrupt the adversary.

Threat Forecasting

We must take a sniper’s approach to identifying risk and closing the gaps. This requires a move from static risk analysis to variable risk analysis. How does variable risk analysis apply to threat forecasting? It removes the ambiguity and reduces the signal-to-noise ratio by tailoring security that is prescriptive to a specific environment. First, threat forecasting requires an in-depth understanding of your attack surface. The ability to clearly identify your attack surface is a fundamental of good security hygiene: again, how can you defend what you don’t know? Further, threat forecasting utilizes threat intelligence about known and unknown exploits and malware and maps it to your attack surface.

At this point, we have a lot of information, but it still only provides half the picture, and it’s difficult to discern what is actionable. To close the gap and understand which threats are a clear and present danger to your organization, you must be able to identify which of the possible threats targeting your attack surface are capable of bypassing the security products deployed in your network. Once you have this knowledge, you will have actionable and prescriptive intelligence that will not only reduce the time-to-protection gap, but will also greatly reduce risk.

This is a quick overview of the power of threat forecasting and the impact actionable security intelligence can have on your overall security efficacy.

Call to Action

As security professionals we need to challenge the status quo of security best practices. Additionally, we need to close the gap on time to protection by utilizing actionable security intelligence that matches our attack surface. Without any changes, we will continue to be like lemmings marching off a cliff.

Image Credit: watcharakun/Shutterstock

NSS Labs' Chief Technology Officer, John Pirc is a noted security intelligence and cybercrime expert, an author and a renowned speaker, with more than 15 years of experience across all areas of security. The co-author of two books, "Blackhatonomics: An Inside Look at the Economics of Cybercrime" and "Cyber Crime and Espionage", Pirc has been named a security thought leader from the SANS Institute and speaks at top tier security conferences worldwide. Pirc’s extensive expertise in the security field includes roles in cybersecurity research and development for the Central Intelligence Agency, Chief Technology Officer at CSG LTD, Product Manager at Cisco, Product Line Executive for Security Products at IBM Internet Security Systems, Director of McAfee's Network Defense Business Unit and, most recently, Director of Security Intelligence at HP Enterprise Security Products, where he led the strategy for next generation security products.

Crossing the hacktivism line

Publié: octobre 18, 2013, 11:27am CEST par John Pirc

Recently, I was a guest on the CNBC program, Squawk on the Street. The discussion centered on the possible outcome of a limited strike by the US on Syria, and I had the opportunity to provide my opinion on the retaliatory cyber implications for US interests. During the program, I disagreed strongly with the position taken by McAfee Worldwide CTO, Mike Fey: that the Syrian Electronic Army is no more than a hacktivist group. In my opinion, this is a dangerous assertion based on industry group-think and marketing rhetoric.

Two books that I have co-authored have examined attack sophistication in terms of categorizing a threat actor. Ultimately, I am not concerned with which organization or entity carries out an attack. I am, however, concerned with identifying and stopping malicious activity. For example, were a nation-state to engage in industrial espionage against a defense industrial-based contracting firm or critical infrastructure, such as a power grid, this typically would be classified as advanced persistent threat (APT).

At NSS, we would more accurately describe it as a targeted persistent attack, since the APT refers to a specific nation-state. Any individual or group with the right connections and with sufficient funding (from, for example, a nation-state or a cyber crime organization) will have access to the same sophisticated, weaponized exploitation kits that are used by government organizations. This has made it much more difficult to accurately categorize threat actors.

With hacktivism, however, it is somewhat easier to classify the threat actor. A hacktivist message or a hacktivist’s defacement of a website will offer clues regarding attacker identity, and, since the purpose of activism is to draw attention to oneself and one’s cause, the attackers will discuss their operations on Twitter and other social media. Furthermore, a hacktivist group will also claim responsibility for an operation once it has been successfully executed. A hacktivist operation typically involves a distributed denial-of-service (DDoS) attack. Hacktivists will deface websites; hack into organizations, stealing information such as usernames and passwords, or emails, which they publish on public websites. Whatever the motivation behind such "operations," their activities are disruptive and embarrassing for the victims, and the resulting public fall-out financially impacts their brands.

In my opinion, the Syrian Electronic Army (SEA) poses a viable and significant threat against US interests. By incorrectly labeling the group as a "hacktivist" organization, the industry has marginalized this threat. A group that is capable of conducting successful operations against high-profile media sites is a group that is capable of sophisticated attacks against highly visible and presumably well-defended targets.

However, since the media did not consider this attack "disruptive," it was marginalized. Consider this: the SEA’s take-down of a high profile media site could just as easily have been a take-down of an online banking site or an online retail site. The ability to affect how a company conducts transactions and thus makes money is the ability to affect its bottom line. But no big deal, let’s just chalk this up to "hacktivism", right?

I think not. If a large retail organization were to be taken offline during the holiday shopping season, the repercussions would be far-reaching, and I am quite certain the organization would consider this a big deal.

When did the SEA graduate from hacktivism? I’d say right after they hacked the AP Twitter account and caused the stock market to fluctuate in less than 140 characters. Their fake news alert was an operation that did undermine the US economy.

Attempting to place threat actors in neatly defined categories is difficult and not altogether wise. That said, let’s examine a few definitions.

Hacktivism: "The practice of gaining unauthorized access to a computer system and carrying out various disruptive actions as a means of achieving political or social goals".

Terrorism: "The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons".

Cyber Warfare: "Cyber warfare involves the actions by a nation-state or international organization to attack and attempt to damage another nation's computers or information networks".

On the strength of these definitions, I would rule out the SEA as a hacktivist group. I would, however, propose that the SEA falls into both the "terrorism" and "cyber warfare" categories, or at least that it lies somewhere in between, perhaps a combination of the two -- a category we could refer to as "guerilla cyber warfare".

Classifications aside, what we should not do is marginalize a group’s capabilities. This will affect the way we protect critical systems against groups that "cross over" from hacktivism to operations that are well-defined. Terrorism and cyber warfare can have catastrophic consequences for the US and its interests, or for any other country. Would an infrastructure be defended differently if it was known to be the target of cyber warfare or terrorism? I would hope the answer is a resounding "yes".

As security experts, it’s our job to protect infrastructures against cyber threats, regardless of the identities of the threat actors -- they only need to get it right once, we have to get it right every time.

Image Credit: lolloj/Shutterstock

NSS Labs Research Vice President John Pirc is a noted security intelligence and cybercrime expert, an author and a renowned speaker, with more than 15 years of experience across all areas of security. The co-author of two books, “Blackhatonomics: An Inside Look at the Economics of Cybercrime” and “Cyber Crime and Espionage”, Pirc has been named a security thought leader from the SANS Institute and speaks at top tier security conferences worldwide.

Pirc’s extensive expertise in the security field includes roles in cybersecurity research and development for the Central Intelligence Agency, Chief Technology Officer at CSG LTD, Product Manager at Cisco, Product Line Executive for Security Products at IBM Internet Security Systems, Director of McAfee's Network Defense Business Unit and, most recently, Director of Security Intelligence at HP Enterprise Security Products, where he led the strategy for next generation security products.