Magazine menu Close Magazine menu

Threat intelligence

Latest stories

cybersecurity new team sport

Why cybersecurity is the new team sport

  • min read
    • The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little. The result is, we're losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer – not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport. The futuristic wild west of IT When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne – refrigerated because the IT team would often share the room with servers that need to be kept cool – knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy. Today, we're in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist 'gun slingers' – in the form of CISOs – have the IT administrator's security responsibilities. Each tries their best to cope with the onslaught of potential threats – anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn't. Start-up mentality not all it's cracked up to be "Fail fast" and "move fast and break things" are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don't worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without considering if it will breach compliance. Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn't understand the need for rapid reaction to combat the latest advance in 'dark tech.' We've seen this challenge before Up to now, I've described a futile, dystopian, 'Mad Max' world. But I think the battles CISOs fight today are our history, not of our future. Companies, and those in cybersecurity, often call their critical data and intellectual property the 'crown jewels,' referencing the ceremonial treasures acquired by English kings and queens. Those crown jewels are protected by thick walls, with guards and few entry points – like how IT administrators guarded our data back in the 80s. CISOs are inevitably 'outgunned,' under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we 'fight the good fight' and win? Again, history has answers. Early 1900s business theorist Harrington Emerson is sometimes paraphrased, "Methods are many, principles are few. Methods may change, but principles never do." So let's go back to first principles. We're stronger together Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth. Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live. Settlements collaborated – sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored 'everyone for themselves,' most joined together for the greater good. Charles Darwin said, "It is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed." History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history. COVID-19: Each taking on a little During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society. Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up. During the pandemic, countries teamed up, sharing information about infections – different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn't stop there – sharing goes on, so vaccines can be tweaked to ensure continued efficacy. Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team – not just within one organization, but within a global network, openly sharing intelligence and insight. On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security. This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since September 11, 2001. This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap 'war stories' under the Chatham House rule: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports. We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange – it doesn't have to be that way. History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.
cyber threats business 2022

Five business cyberthreats taking center stage in 2022

  • min read
    • Every year, businesses face a changing threat landscape. It pays for leaders to know what the experts think will come next. If you're upgrading your cybersecurity or looking for a new vendor, knowing what attacks are likely in 2022 will help you make the right choice. It turns out our predictions for 2021 were on the money. So what should you and your colleagues plan for this year? We're forecasting these four events that could have flow-on effects for other industries. 1.  Financial organizations will face more threats around cryptocurrency Cryptocurrency keeps growing, and people will keep investing in it for many reasons, including its anonymity, which also makes it attractive to cybercrime groups. In the scramble for cryptocurrency investment opportunities, cybercriminals will use social engineering campaigns, fabricating and selling rogue devices with backdoors to steal financial assets. More financial industry cyberthreats we'll see in 2022 2.  Fake medical documentation will trouble healthcare We saw the trade in faked medical documents like COVID-19 vaccination passports and test results in 2021. Fake vaccines were even spotted for sale on the dark web. As more countries roll out privileges alongside vaccination or test documentation, criminals will roll out more fakes. Medical-themed bait has long featured in cybercrime. With the pandemic triggering increased use of online medical services, patients watch for notifications about test results and messages from doctors. More healthcare cyberthreats likely in 2022 3.  Governments will conflict and compromise with big tech Governments are wary of big tech's growing power and data hoarding. As states build more digital infrastructure for delivering services and deeper insights into their population, they'll show more interest in what citizen data big business holds. We'll see more regulation, such as privacy and data localization laws, and regulation around how law enforcement can access data. Apple's new system that scans devices for child abuse images shows the challenges of balancing user privacy against stopping crime. More privacy predictions for 2022 4.  Industrial attacks will become more focused In many parts of the world, a rapidly snowballing trend is laser-focused attacks, particularly on Industrial Computer Systems (ICS.) We've seen increasing theft of authentication data using spyware, with each attack directed at only a handful of targets. We think these kinds of attacks will make up an even greater portion of the threat landscape in 2022, and we'll see the tactic used more widely. These attacks show why industrial shop floors must be protected. Industrial internet of things (IIoT) devices are easily overlooked and often vulnerable. More predictions for industrial cybercrime in 2022 5.  Ransomware attacks will get more targeted 2021 was a big year in ransomware, with a 30 percent growth in Ransomware 2.0, also known as double extortion. These attacks go beyond demanding a ransom to de-encrypt systems to using stolen sensitive data as leverage to pressure victims to pay up. In November 2021, the US FBI warned ransomware actors are "using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections." At these times, any leaked information could have devastating consequences, making victims more inclined to pay ransoms. In 2022, this type of extortion will become more common. Regular, high-quality cybersecurity training for all staff is one of the best ways of avoiding falling victim to ransomware. Kaspersky is one of several organizations behind the No More Ransom initiative, providing free decryption tools and advice for ransomware victims. More on ransomware activity in 2021 As your strategic plans for 2022 take shape, improving cybersecurity will no doubt be among them. Your business must adapt as cybercriminals' ways and means change. These predictions will help you and your team be forewarned and forearmed.

Give your threat intelligence an intelligence test

  • min read
    • The saying "ask and you shall receive" seems to need a footnote or two these days. Make sure the furnishings you're ordering aren't meant for a doll's house. Remember that romantic poem, roses are red; spring onions are green? And quite who would be the happy recipient of this 'magical' Christmas mug, we'll never know. Threat intelligence can also be a case of 'wrong item delivered.' There are many products out there described as threat intelligence that aren't. And customers might not realize they're not getting what they asked for. So how do you give your threat intelligence an intelligence test? Threat intelligence is data analyzed Threat intelligence identifies and analyzes cyber threats aimed at your business. The keyword is 'analyze.' It means to sift through piles of data, spot real problems by looking at context and put in place a solution specific to the problem. It's most often confused with "threat data." Threat data is a list of possible threats, without analysis of context or tailored solutions. Threat intelligence should captivate your security team Once upon a time, there were IP and URL blacklists. Early security products would just refer to these blacklists to warn of a dangerous IP or URL. Over time, the amount of threat data grew exponentially. It became difficult to define what was a real threat and what wasn't. Security software wasn't designed to process so many indicators of compromise, like malicious file hash sums, domains or botnet server addresses. Some products marketed as threat intelligence include threat feeds and indicators of compromise, but without context – they're just vast amounts of raw data. This is a problem. Giving security operations such 'intelligence' will cause too many false security alerts. Alert fatigue has a serious impact on the overall security of your company. Research found 52 percent of security alerts are not investigated. And data, however relevant, is useless unless it has context and can be acted upon. With true threat intelligence, an InfoSec team can stop a breach early and protect a network, or realize they're just seeing everyday malware that doesn't pose a serious threat. Threat intelligence should tell your future Identifying yesterday's threat is history. Threat intelligence now focuses on the quality of data sources. It's not enough for data to bring insights but not give guidelines for decisions and actions. And when its quality is limited by lack of sources – such as not seeing into the darknet, or lack of global, multilingual reach – it can't be processed into effective threat intelligence. Intelligence must be able to predict how your business should prepare for and combat future threats. Threat intelligence should adapt to your organization A threat intelligence solution must be able to adapt to an organization's security needs. It must guide the organization to set up internal data collection points around critical assets. It then matches that data with external threat intelligence to identify threats. Without this targeted approach, it won't succeed in prioritizing information needed to defend key assets. As Helen Patton, Chief Information Security Officer (CISO) at Ohio State University said in a 2019 Forbes article, "Threats are only a threat in the context of the risk to the business itself." Threat intelligence can be acted on Threat intelligence is something you can act on. It must integrate multiple sources of information into an organization's security operations, through a single point of entry. To be effective, the organization must be able to use both machine-readable and human-readable threat intelligence. Its delivery methods and formats must allow it to be smoothly integrated into existing security workflows. It must give unique insights into emerging threats, so security teams can prioritize alerts, maximize resources and accelerate decision-making. Does your organization's threat intelligence pass? If not, it's time to get what you were promised. This article was published in April, 2020.
evolution of supply chain attacks

Detection is better than cure: Seeing and preventing supply chain attacks

  • min read
    • Supply chain attacks represent something of a sea change among hackers. They're not new, but they're fast becoming more common, and evolving to evade detection. These attacks involve implanting the part of a virus that executes an attack (the payload) into components like software, firmware and hardware. That payload becomes part of the finished product. Companies that sell these products become unwitting distributors. They stow away silently on customers' computers or networks until something triggers their malicious processes. Here, we focus on software supply chain attacks, but it's worth a few words on the other two to understand the scale and scope of supply chain vulnerabilities. Hardware supply chain attacks Supply chain attacks on hardware are often crude and cheap. For example, implanting keyloggers in USB drives, capable of registering 8,000 pages of keystrokes, or inserting a microphone into Ethernet networking connectors (RJ45 plugs), stealing passwords and other sensitive data. Firmware supply chain attacks Hackers also tamper with firmware by embedding malicious code that enters customer devices. Boot firmware is often the target. By using the booting process, it only takes starting the hardware to execute the malware. Software supply chain attacks Hackers like software supply chain attacks because they only need to compromise one link in a long chain to smuggle malware everywhere. They can insert malicious code into software at several points during build, compilation, distribution and update. The increasing sophistication of enterprise software also increases the number of attack options. Attacks can target the software's source code, embedding malicious code in the build of a trusted app. Sometimes the code is embedded in an executable file with an infected compiler (a program that translates code from one language to another) or linker (a program that combines the data the compiler generates into one executable file). Another frequent target is software update mechanisms. While genuine software developers often 'sign' their executables and scripts with a digital certificate to give their identity and confirm the code is unaltered, supply chain attacks often include stolen certificates that seem genuine. Software developers dependent on open source code, usually smaller operators, are particularly vulnerable to supply chain attacks. Significant supply chain attacks Attacks that make their own a hit list Some supply chain attacks have used highly sophisticated pre-attack planning to identify suitable targets. Energetic Bear was one of the most significant attacks on critical infrastructure. It used an opening spear-phishing campaign to make a hit list of suppliers to target. Ghost in the app-creating tool Even Apple, famous for its virus resistance, fell victim to a supply chain attack. Hackers used Xcode, a tool for creating iOS and OS X apps, to smuggle malicious code into apps. Apple hosted these apps unwitting in its App Store. While developers usually download Xcode safely from Apple, it's also available on developer forums. Hackers embedded malicious code in these alternative sources. Researchers from Alibaba called these malicious variants 'XcodeGhost.' They contained just a few extra lines of code – hard to detect, but enough to penetrate. Backdoor in popular server management software The ShadowPad incident is one of the largest known and most sophisticated supply chain attacks. In 2017, Kaspersky researchers discovered a 'backdoor' (dubbed ShadowPad) planted in server management software used by hundreds of large businesses around the world. When activated, the backdoor lets attackers download further malicious modules or steal data. In this case, hackers had signed the malicious code with a legitimate certificate. The pointer to the infected function was also hidden from the user's view. The attackers had gained access not only to the certificates but also to the source code and build environment. Researchers in Kaspersky's Global Research and Analysis Team (GReAT) immediately notified the suppliers, NetSarang, who quickly pulled down the compromised software and replaced it with an earlier clean version. NetSarang proved that responding fast to cyberattacks makes a difference. Kaspersky and NetSarang found only one infected payload – an excellent result given the product's popularity. Cleaner attack goes right to the top CCleaner is a hugely popular system cleaner, downloaded more than two billion times. After a supply chain attack in September 2017, infected software was downloaded two million times. Hackers attacked through a tiny backdoor. They encrypted all strings, making them harder to detect. Like the ShadowPad attack, hackers signed their malicious code with legitimate digital certificates. These hackers wanted to get right to the top. They included a function in determining if the user had admin privileges. The attack would only continue if the user had access to the company's Command and Control function. Because the attack was highly selective, the full infection was downloaded only onto 40 computers. But the CCleaner infection's victims included some of the biggest names in enterprise tech – Samsung, Fujitsu, Intel, Sony and Asus. This made it one of the most damaging and effective supply chain attacks discovered. Hammering through automatic update functions Kaspersky researchers discovered the Operation ShadowHammer attack in January 2019. We found a suspicious file signed with a legitimate digital certificate from Asus. While distributed from Asus's official server, the files contained a sneaky backdoor. Supply chain attacks often target automatic update functions. At first, hackers planted Operation ShadowHammer's malicious code in Asus's live updater tool, but the mode of attack evolved over time. Operation ShadowHammer targeted more than 400 computers, with multiple unique backdoored samples. Asus was not the only target. Since our first discovery, we've identified several other cases, including digitally signed examples, from three other software businesses. Hackers signed backdoors with different certificates and chains of trust in each attack. Detection is better than cure Detecting supply chain attacks is nuanced work. Sometimes attacks don't directly manipulate original code, with updates downloaded and executed only in computing memory. Games are among the most attractive supply chain attack targets. Here, it's harder to know whether malware is part of the software's original functionality. For example, anti-cheating and IP protection mechanisms can trigger behavior analysis logics. Malicious code in supply chain attacks is only a tiny portion of code in an executable file. It's like trying to find a polar bear in a snowstorm. This is made harder by the valid code-signing certificates that often accompany the malicious code. How can businesses defend against supply chain attacks? Suppliers are softer targets than finished product vendors, partly because the final package is more extensive and complex. So what can businesses do about it? 1.      Use the best cybersecurity software Lightweight security solutions prioritize speed over rigor, leaving the risk of being fooled by supposedly legitimate code-signing certificates or mistaking suspicious files for false positives. Dedicated cybersecurity solutions do it better. A proven, corporate-grade security solution is essential for spotting and catching advanced targeted attacks. These analyze anomalies and give cybersecurity teams full visibility over their network, with an automated response. 2.      Hire the right team, and the red team Businesses should hire highly skilled information security personnel, including security specialists, SOC (security operation center) analysts and 'red teams.' 3.      Use threat modeling during software development During software development, companies must create a threat model for their development infrastructure to identify and eliminate risks in advance. Access models should apply the Principle of Least Privilege (PoLP) to restrict the risk of malicious access. 4.      Carefully manage supplier relationships Build trust that goes beyond traditional assumptions. 5.      Invest in response As we saw with NetSarang's rapid response to the ShadowPad attack, businesses must invest in response as well as protection. If you don't have internal capacity, involve an incident response team to investigate an incident or suspicious activity. Article published in 2019.
threat attribution

How to find out who’s behind a cyberattack

  • min read
    • Knowing who or what has attacked us is critical for survival. In cybersecurity, threat intelligence cuts through the noise to find the poisoned needle in your data stack, letting you act fast before damage spreads. But what if you could also find out who is behind the attack? How threat attribution helps if you've been targeted by an APT If you've been targeted by an advanced persistent threat (APT), threat attribution helps you understand the attack motive and respond quickly. The cybercrime groups that carry out APT attacks are often linked to state-sponsored attacks. It's a costly way to get to their prize. If you have something they want, you could be a target. They're advanced. No low-cost software bought on the dark web by do-it-yourself cybercriminals. They build their own sophisticated software for purposeful damage. They're persistent. They seek you as their target, hitting you with weeks or months of attacks until they break through your IT security defenses. Or they lie dormant for years until the time to attack. Once in, they conduct secret operations to find critical data. If they're determined, there's only so much that cybersecurity software can keep safe. And they're a serious threat. Their goals range from espionage to sabotage, to data theft for profit. Threat attribution wins the threat intelligence race, but it's not for everyone Threat attribution is a next-level solution, but it's not for every business. It's like choosing a car. What you need depends on your journey. A budget motor is fine for driving from A to B. In cybersecurity, that's endpoint security. If you're carrying precious cargo, a limousine may be a worthwhile investment. In cybersecurity, that's threat intelligence. If you hold classified information that's interesting to a rival state, you're at greatest risk of an APT attack. National security and law enforcement agencies (like Interpol or the FBI) are most vulnerable. They have much to gain by uncovering who's hacking them. Sometimes APT attacks also target corporates, other government agencies and critical infrastructure like power plants and manufacturing. You don't have to be a big organization to be a target. If you're making components for a military plane, a less friendly state may want to know how you're making the rudder for counter-intelligence. Supply chain attacks are also on the rise. By hitting a laptop manufacturer, hackers can infect everyone in an organization. Then, when the time's right, they strike, cherry-picking who they spy on by hacking straight into their laptop. Who are the threat actors? APTs are a fast-growing 'industry.' These threat actors are not amateurs. They're super-organized crime workers. Some have different units for espionage, counter-intelligence and financial exploitation. Lazarus was the most significant threat actor in 2019. They attacked Sony Pictures Entertainment with a data-wipe in 2014 and made several attacks on South Korea. APT trends in 2020 predict more sophisticated attacks using artificial intelligence (AI) and deep fakes to access personal data. How does threat attribution work? When one of the most damaging ever ransomware attacks WannaCry hit in 2017, a Google researcher tweeted cryptic code showing similarities between WannaCry and 2015 malware attributed to Lazarus. This is threat attribution. You need to analyze and find clues that take you back to existing knowledge. By analyzing the attack's context, and nuances and languages deep in the code, researchers can reveal the threat actor's origins. These actors rarely leave a calling card, but they do leave evidence. We can analyze malware samples never seen before to find out if the actor is new, or an existing player in disguise. Like all forensic analysis, it's slow and painstaking. With highly sophisticated threats, it means reverse-engineering the attacks. It can take years, even for teams of the most skilled researchers. That's often enough time for attackers to achieve their goals. How can we shorten the analysis time? What if we could speed up the process? Faster attribution can shorten incident response times from hours to minutes, and reduce false positives. Kaspersky's Global Research and Analysis Team (GReAT) tracks over 600 APT actors and campaigns. To help the Information Security (InfoSec) community block APTs, they produce 120 or more subscriber reports each year and share highlights in quarterly APT trends reports. Profiling each threat actor can take years, building a database of everything you need to know about them. From this insight, Kaspersky developed one of the first solutions for automated threat attribution. It's like the Shazam app – that can identify the song you're humming by finding a match – for threat intelligence. By uploading a code sample to Kaspersky's Threat Attribution Engine, it matches previous attacks and APT groups in seconds. It analyzes the malware's 'genetics' to compare to 'genotypes:' known malware linked to a threat actor. This fast analysis can help those facing APT attacks to limit damage. We can't stop the flood of threats permeating our world, but we can build our defenses. Threat attribution is a new weapon in the arsenal for tackling organized cybercrime, and it could make it far harder for them to succeed.
cyberthreats as a physical stronghold

Whether protecting the physical or the cyber world, savvy security works the same way

  • min read
    • There's not much difference between an advanced cyberattack and a thief breaking into your company's premises. A corporate building has a fence, entrances, corridors, offices and server rooms. IT infrastructure is similar, only here we have a network, workstations, servers, virtual machines and so on. If someone wants to steal from, spy on or disrupt a business, they must sneak into its territory or its network. Judging by the massive security breaches that have dominated the headlines in the past year, attackers favor the latter these days. Fighting targeted cyberattacks has a lot in common with physical protection. Let's consider the three fundamental principles for dealing with a physical breach, and see how these can improve a company's cyber defenses. 1.    Realize you're under attack Before dealing with any attack, you need to know you're under attack. That means noticing suspicious activity and linking it to a plot. Let's say you're at the office late in the evening, and the alarm system goes off on the second floor. A security officer goes to find out what's wrong. At the same time, a pizza delivery person arrives and hands a pizza over to someone from accounting, gets their money and leaves. That's all perfectly normal, but if you look closer, you may notice a string of coincidences. The alarm went off at about the same time a few days ago, accountants (unlike IT staff) don't typically order pizza, and this one usually complains about gluten intolerance. Putting these clues together, a perceptive security officer might ask some questions. The same principle applies to detect cyberattacks. Separate activities inside the network might not, on face value, show an organization is under attack. But look at the bigger picture, and it might suddenly seem critical to investigate. Threat management and defense do just that: automatically detects and flags malicious patterns behind separate, simpler, seemingly unrelated activities in the network. 2.     Start investigating Coming back to our mystery pizza scenario, to begin investigations, the security officer could go to the camera room and look through the recordings. She would know there are smart cameras all around, letting her see any corner of the office at any time, and the records can't be erased. On the footage, the security officer sees the pizza delivery person jumped out of a black minivan… not the usual vehicle for pizza delivery, right? The gluten-intolerant accountant didn't order a pizza; he ordered spy equipment that he's planning to plant under the CEO's desk. Like smart cameras, anti-targeted attack software reviews network traffic for security purposes. Endpoint Detection and Response (EDR) software watches for cyber-threats too. It sees what's going on at end-user devices (desktops, laptops, mobile devices) and gives the retrospective data needed for an investigation, even when devices are compromised, or when cybercriminals have destroyed or encrypted data to cover their tracks. 3.     Know where to look To spot the right things at the right time, you need to know where to look. That's why it's so crucial that security teams in large corporations get the right training and experience. There's also information. Access to police reports and databases is helpful in physical corporate security. In the scenario I've described, the security guard could run the minivan license plate numbers through the police system to see if it's been stolen or used in similar operations. And once again, the same applies to investigate cybersecurity incidents. You can use threat intelligence data tailored to your industry or location, and you can get specialized training for your IT security team; you can even outsource cyberthreat protection to an experienced third party. Build your cyber fortress We've seen that in many respects, you can use the basics of protecting your premises when building your cyber fortress. With these solutions and services combined, your teams will get ahead of the cybersecurity agenda. You will always have the answer to even the most advanced attacks.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries