Home Blog Page 140

“API targets are growing fast, therefore the need for API security”

Yisrael Gross is the Co-founder, and Director of Business Development of Israel-based L7 Defense, a cybersecurity firm that specializes in API security. Entrepreneur and business development mentor, Gross is the producer of a popular tech show in Israel, “Kikar HiTech.” He is also a founding member of the Israel Cyber Group.

In a recent interaction with Augustin Kurian, Senior Feature Writer at CISO MAG, Yisrael Gross talks about API security, cloud security, and cyber hygiene among several other things.

 

API security is touted as the new frontier in cybercrime. In fact, by 2022, API abuses will be the most-frequent attack vector resulting in data breaches of enterprise web applications. Is the cybersecurity industry taking necessary precautions to safeguard enterprises from this imminent threat landscape?

According to Gartner, “With few exceptions, WAF technology has failed to deliver on the promise to automatically enforce a positive security model. Shorter application project cycles further impede the ability of security teams to implement and fine-tune WAF appliances.”

That is the main reason for the recent raising of a new cybersecurity vertical, named as “API Security.” API Security solutions are aimed to protect from same “classical” types of threats as used to be handled by WAFs, plus new types of emerging threats, such as BL attacks, which are specific to APIs. It should be done in a much more dynamic, automated, and precise manner than it used to be made by application security solutions.

 

It is said that current API solutions like content delivery networks and application delivery controllers, web application firewalls, identity and access management, and API gateways provide basic protections for API infrastructure against volumetric DDoS attacks, OWASP top ten vulnerabilities, session high jacking, and invalid input attacks, to name a few. But are they enough to stop threat actors determined to exploit vulnerabilities unique to each API? How can companies be a step ahead of hackers on this front?

This API “customized policy” referred to here is a major point in protecting APIs. The ability to set an automated, fully adapted policy to an API is the hurt of any API protection layer as otherwise, a major fraction of the request might be mistakenly considered as hostile or friendly, by their generic structure or content, while only the specific API policy may judge it correctly. For example, lets us assume a policy of a search API, which might get a broad content landscape including even operator types such as OR and AND. Using a general policy will make false such requests, while specific API policy should know how to differentiate these.

In reality, as “open banking” was initially regarded by many as a typical exercise in compliance, following the implementation of the Second Payments Services Directive (PSD2), banks are now shifting gears and going beyond the regulatory requirements by leveraging the benefits of “open APIs” to cater to customer needs and innovate open banking business models, and demand more of these type of solutions.

 

How has the API security threat landscape changed since the onset of COVID-19?

The threat landscape hasn’t changed much. However, the attack scale has grown dramatically for two main reasons. The number of API targets is growing fast now, developed and deployed at less order, and therefore are more vulnerable. On the other side, criminal motivations are skyrocketing as expected at such time. So, these two are facing each other in growing frequency as expected, since the beginning of this global situation.

 

As attacks become AI-based, there are higher chances that the Next-gen “Zero-day Payload” attacks can bypass even the most advanced solutions. What are the best practices that need to be adopted to avert this crisis?

The answer is, of course, said inside the question. There is a major need to adapt the AI protection shield, in all aspects of cybersecurity. It should be adaptive to the ever dynamically changing inside structure and outside threat nature. It should also be automated and precise, as for the growing gap of professional resources availability and the growing sophistication of AI-governed attack tactics.

 

Poor cloud security hygiene has been plaguing several organizations globally.  Nearly half of the global organizations on AWS workloads don’t have MFA enabled for users. It is an example of potential avenues for attackers to infiltrate an organization. What is your take on that? 

Definitely! It really presents the way of doing the job these days, cross-industry. Business usually comes before cybersecurity, which leaves a wide-open window to the attacks. And when you call them, they come, sometimes in seconds, as everyone who opens a new server on AWS may know.

We believe that there is no point in fighting this lost battle, as this is the way of life. Instead, we present a different approach that is adapted to this trend. We offer enterprises these days to deploy our API security solution, in front of your APIs and Applications, thereby giving them the best of breath protection that may be found in the market.

Augustin Kurian

About the Author 

Augustin Kurian is part of the editorial team at CISO MAG and writes interviews and features.

 

AI-Powered Cybersecurity: From Automated Threat Detection to Adaptive Defense

Artificial Intelligence, AL and ML

Cybersecurity, the protection of IT infrastructures and communication networks in cyberspace and cyber-physical systems, is becoming increasingly important, covering threat detection and security countermeasures for interconnected digital devices, from computers to Internet of Things (IoT) devices. While components of traditional cybersecurity infrastructures, such as firewalls, malware signature databases, and strong password policies are still crucial, in today’s ever-changing online landscape, they no longer provide sufficient security measures against evolving, previously unknown cyberthreats, particularly when aiming for proactive rather than reactive countermeasures.

By Dr. Leslie F. Sikos, Edith Cowan University, Australia

Considering that a large share of network intrusions relies on stolen credentials used for gaining administrative access, and others on malware infections, analyzing and making sense of network data is more crucial than ever before. Compared to the late 1990s when there were very few threats online (such as malicious executables on software download sites), today not only the volume, but even the variety of cyberthreats is beyond comprehension, ranging from ransomware to sophisticated cyberattacks. Cybersecurity personnel cannot cope alone anymore with the advanced persistent threats that knock down a nuclear power station, an ongoing cyber-espionage that leaks out classified government data, or cyberattacks that jeopardize business continuity.
An emerging direction in cybersecurity is to employ artificial intelligence (AI), i.e., intelligence demonstrated by machines — not to be confused with cybernetics, which deals with communications and automatic control systems. By using AI, not only can known threats can be identified, but also unknown threats can be isolated by suspicious and nefarious online actions. Some AI fields utilized in cybersecurity applications include machine learning, formal knowledge representation and automated reasoning, and automated planning and scheduling.

Machine learning (ML) is the utilization of methods and technologies that “give computers the ability to learn without being explicitly programmed.” If an ML algorithm builds a mathematical model from a dataset that contains both the input and the desired output, it is called supervised learning. If the training data is incomplete, we talk about semi-supervised learning. If there are no desired output labels, the ML is called unsupervised learning.

ML can be utilized in cybersecurity for a variety of tasks, such as to predict cyberattacks based on behavioral patterns on social media, recognize network attack patterns, identify malicious webpages, and prevent adversarial ML (which attempts to mislead training with malicious input). State-of-the-art antivirus software use supervised learning by considering a set of object features (file content or behavior) in the training phase, together with associated object labels indicating which samples are malicious and which ones are not (in case of more fine-grained classifications, various types of malware, such as virus, Trojan, etc., are used).

Based on this input, a predictive model is created that will produce labels for previously unseen objects. In the protection phase, unknown executables are processed by this model, which yields a model decision about the executable most probably being malicious or benign. For finding groups of similar objects or highly correlated object features, unsupervised learning can be used.

Combining several learners’ models into an ensemble performs better than the original learners (ensemble learning). If the predictive model is a set of decision trees that use a tree-like model of decisions and their possible consequences, all nodes that are not leaves contain questions about file features (e.g., whether the file size or file content entropy is bigger than a certain threshold), and all nodes that are leaves have the final decision of the tree on the object. During the test phase, this type of model traverses the tree by answering the questions in the nodes with the corresponding features of the object. The final decision on the object is calculated by averaging the decisions of multiple trees. One of the most common ML methods in this category is called a random forest, which uses random feature samples rather than the entire feature set for training, thereby trying to reduce the correlation between estimators.

Inspired by biological neural networks, artificial neural networks (ANNs) consider examples such as manually labeled malicious and benign code samples, but without task-specific rules (i.e., without explicitly collecting the characteristics of malicious code, for example, in the case of zero-day exploits). The sequence of system events during software execution and the parameters of the commands executed can be used to create a behavioral log, which is suitable for training deep neural networks (DNNs), which have multiple layers between the input and output layers (to model complex, non-linear relationships), thereby identifying previously unknown malicious activities while minimizing false alarms. To process the ever-increasing volume of unknown files, MLbased clustering algorithms can be used so that malicious and benign groups of files can be efficiently differentiated based on their properties.

Utilizing ML can help organizations perform a dynamic risk analysis, discover signs of malicious network traffic, detect anomalies, protect their assets from cyberattacks, and minimize or mitigate malware spread. Contemporary implementations include cloud-managed firewalls, real-time threat intelligence, and adaptive antivirus software that perform complex behavior analysis, thereby complementing traditional signature-based malware detection with advanced heuristics. Software examples include, but are not limited to, Bitdefender Advanced Threat Intelligence, Chronicle, Cyber Reconnaissance (CYR3CON), Cylance, the Darktrace Enterprise Immune System, IBM QRadar SIEM, Senseon, and Vectra.

Knowledge Representation in Cybersecurity

Knowledge representation is a field of AI focusing on formalisms and data models for computer systems to solve complex tasks, such as fusing and finding correlations in complex datasets such as cyberthreat intelligence datasets. Formal knowledge representation can uniformly capture the semantics (meaning) of expert knowledge derived from diverse sources in the form of structured data upon which automated software agents can categorize vulnerabilities, threats, and attacks; perform entity resolution; detect anomalies, and match attack patterns, thereby revealing correlations even experienced analysts might miss. To this end, cybersecurity concepts and their properties as well as the relationships between these are defined formally in knowledge organization systems, such as thesauri and ontologies, which can be used in the automation of network data processing via querying and automated reasoning. These systems are typically grounded in description logics with computationally favorable properties and often implemented using Semantic Web languages such as RDF, RDFS, and OWL.

Cybersecurity ontologies facilitate data sharing and reuse across information security infrastructures and automated knowledge discovery that reveals new insights for cybersituational awareness, cyberthreat intelligence, and digital forensic investigations. They can assist intelligence gathering and data analytics and provide aggregated data for SOC monitor dashboards automatically 24/7/365.

AI Planning in Cybersecurity

AI planning is the study of strategies and action sequences. By planning from the perspective of a hypothetical attacker, AI planning can be utilized for estimating the vulnerability of communication networks to cyberattacks. If the attacker has complete knowledge about the network and IT infrastructure (in the case of ethical hacking), classical planning can be used for penetration testing. If the knowledge is incomplete, partially observable Markov decision processes (POMDP) can be used, which can model the attackers’ prior knowledge about the network configuration in the form of a probability distribution over possible states (belief). However, it is more realistic and scalable if a qualitative model is used. A qualitative model employs partially observable contingent planning instead of POMDP. This type of model attempts to find a plan tree (or graph) of actions in which the leaves correspond to goal states, and the edges are labeled by observations. Contingent planning can effectively model attackers with initial qualitative knowledge about the network configuration, which is improved during the attack based on the outcome of exploits attempted and explicit sensing actions. This way, contingent planning is suitable for combining exploits and sensing actions similar to real-world attackers.

Conclusion

Artificial intelligence is well-utilized in a variety of cybersecurity applications, from antivirus software to automated threat detection and mitigation. Being a dynamic and promising field, it attracts increasing research interest and development efforts. However, while utilizing ML in cybersecurity certainly has its benefits, there are also some challenges. Some of these include the need for large representative datasets, interpretable trained models, and mechanisms to obtain very low false-positive rates in (near) real-time, just to mention a few. On top of these, developers have to consider an increasing number of expectations and legal requirements, such as explainability, interpretability and being free from bias, as outlined in, for example, the Algorithmic Accountability Act of 2019 in the U.S. Moreover, AI can be used not only for defense but also for attacks, as seen with adversarial ML.

About the Author

Leslie F. SikosLeslie F. Sikos, Ph.D., is a computer scientist specializing in network forensics and cybersecurity applications powered by artificial intelligence and data science. He has industry experience in the data center and cloud infrastructures, cyberthreat prevention and mitigation, and firewall management. He regularly contributes to cybersecurity research projects and collaborates with the Defence Science and Technology Group of the Australian Government, CSIRO’s Data61, and the Cybersecurity Collaborative Research Centre. He is a reviewer of academic journals, such as Computers & Security and IEEE Transactions on Dependable and Secure Computing, and chairs sessions at international conferences, and regularly edits books, on AI in cybersecurity. Dr. Sikos holds professional certificates, and is a member of the IEEE Computer Society Technical Committee on Security and Privacy, and a founding member of the IEEE Special Interest Group on Big Data for Cybersecurity and Privacy.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

The State of Ransomware: From Evolution to Progression

The State of Ransomware

CISO MAG, in association with Cybereason, conducted a virtual round table discussion on “The State of Ransomware”.

The panel discussed the evolution and the new trends in ransomware attacks. Grab the snippet of the discussion below…

Since the past decade, ransomware has been one of the most common types of malware deployed during a cyberattack. However, if anyone asked to place a finger on a year that marked the sudden surge of ransomware, it would be 2020.

As per a recent report,  in the past year (from H2 2019 to H1 2020), there have been more than 500 successful ransomware attacks in over 45 countries that were reported officially. This means every single day there has been more than one ransomware attack around the globe. Experts believe this number could even double if all attacks were reported. The financial damages arising from ransomware attacks during the time period have accounted for over $1 billion ($1,005,186,000) and the future forecast predicts this number to rise 20 times to $20 billion by 2021.

So, how do you tame the raging bull going by the name “Ransomware”? To take on the bull by its horns, CISO MAG, in association with Cybereason, conducted a virtual round table discussion on “The State of Ransomware.” The discussion was moderated by Cybereason’s Tarek Kuzbari, Regional Director Middle East & Turkey, who was joined in by Eng. Abdullah Biary, CISO at SALAMA Cooperative Insurance Co., and Hamad Al Katheri, Enterprise Risk & Information Security Vice President, Zain.

The discussion was led on the following key points:

Evolution of Ransomware

Since the turn of the century, cybercriminals started playing with human psychology and spread emails consisting of fearful or anxiety-inducing content to pressurize readers into clicking malicious links, which further installed malware. This technique was adopted by ransomware gangs, which, after installing the malware on an individual’s computer, encrypted the data and left a ransom note in exchange for the decryption key. This modus operandi worked perfectly for years but gave smaller returns to threat actors. Thus, came the next step in the evolution – targeting bigger organizations.

The State of Ransomware, Tarek Kuzbari

“Ransomware attacks have now become daily news. You pick up your paper or mobile phone and there it is, so and so company has been hit by a ransomware attack written in BOLD”

– Tarek Kuzbari, RD Middle East and Turkey, Cybereason

Answering Tarek’s questions as to why the shift towards bigger company’s and not individuals, Abdullah Biary said, “It is simple. Moving from individuals to bigger organizations gave threat actors better returns. Large corporations have critical and sensitive data, which, if leaked, could cause not just monetary but reputational damages. These are not easy to repair.” And thus, threat actors leveraged on this exact fear.

Current Trends and New Tactics

Ransomware has certainly not reached its final stage of evolution. Ransomware gangs now download critical data from the victims even before encrypting their machines. They use this data as a means to negotiate. If the victims fail to pay the ransom, they threaten them by hosting data auctions on the dark web. In fact, REvil, an infamous ransomware gang, has already staged an auction website to sell the stolen data who refuse to pay ransom. In Hamad’s words, “this is Blackmail,” and it indeed is.

Tarek also raised a very important issue of ransomware being sold “as-a-Service” (known as RaaS). Abdullah Biary agreed by saying, “Yes, this has simply taken off. They are distributing it as Ransomware-as-a-Service to earn some extra money and collaborate. They are uniting and so should we in its defense.”

Tarek asked Hamad whether there was a missing gap in ransomware that adds to our pain point, to which he replied, “Gaps are there, and they have always been there. There is nothing one can do about it other than continuously monitoring and fixing these gaps proactively.”

Lessons from the Field

Humans and Technology

Time and again it has been said that humans are a weak link, and the panelists echoed this thought. Hamad said, “The human factor in security is the most dreaded. Small mistakes like delayed patching or updating the systems and application cause the reason for exploitation.” Abdullah seconded Hamad by saying, “More than technologies like the XDR and MDR, organizations need rightly-skilled cybersecurity workforce. This is the need of the hour.”

Abdullah Biary, The State of Ransomware

“More than technologies like the XDR and MDR, organizations need rightly skilled cybersecurity workforce. This is the need of the hour. Humans can make or break security.”

– Abdullah Biary, CISO, Salama Coop. Insurance Co.

To Pay or Not to Pay, That is the Question

The U.S. Department of the Treasury (OFAC) recently announced that paying ransom to cybercriminals is now illegal. Governing bodies around the globe have always condemned ransom payments, but this is the first instance where it has actually been documented that paying up a ransom is illegal. Thus, taking the discussion forward, Abdullah said, “We should not, but it is situational.” Giving the example of the recent death of a person due to delayed medical aid since the hospital was hit by a ransomware attack, he said, “This is an exception. It’s a matter of life and death and nothing comes above saving a life.”

Hamad had similar views and said, “This should be the last resort. If you pay then you are a potential customer to the bad guys, they will come back to you. Also, there is no guarantee of getting your data back. So, why pay? However, this is always a difficult choice, to pay or not to pay.”

How to Better Protect Your Organization from Ransomware

As stated earlier, we are far from the end of the tunnel of ransomware attacks. They are only beginning to fizzle up. Probably, the worst is yet to come. So, how do we strengthen our defenses against a ransomware attack? Tarek asked this question to both panelists and they gave our participants some good insights.

Abdullah said, “Constant monitoring along with frequent penetration testing and vulnerability assessment is utmost important.” Additionally, he also recommended one more thing that he asks his own team to follow – “keeping track of all assets.” He suggests, “With accountability of all assets of internal teams, you know what you need to defend and be ready for an attack at all instances.”

Adding to this, Hamad suggested the adoption of a proactive approach. “Do not wait until it happens. Defend as if it is definitely going to happen.” He reminded the participants of the popular cybersecurity adage, “A good guy (defense) needs to be right all the time, but a bad actor (offense) needs to get it right just once.”

Hamad Faisal Alkatheri, The State of Ransomware

“Your data is a crowned jewel. Always encrypt it, else it will be bad very bad.”

– Hamad Al Katheri, Enterprise Risk & Information Security VP, Zain

 

Lastly, Tarek asked our panelists to pick the top three pieces of advice that could be the crown jewels for the fight against ransomware attacks, to which both unanimously agreed upon the following:

  1. Identify your assets: Understand what needs to be protected based on the risk analysis reports from the internal teams. And as Hamad said, “Your organization’s data is a crown jewel. Always Encrypt it.”
  2. Define critical business flows: Gather as much information as possible. You need to ask all stakeholders to submit what they believe is most critical to the business flow. Every team has a different perspective. So, considering every perspective will help you design a better guideline for security.
  3. Convey and convince the business leadership: This step is very important. Return on investment (ROI) is something that business leaders are always interested in. Explaining to them why investing in protection against a cyberattack, which might or might not take place, could be tricky. Abdullah suggested, “Talk to them in their own language. Show them numbers and make them understand the importance of investing in cybersecurity.” Hamad added, “There is no room for regret in cybersecurity. Investing the money once you are already attacked does not make sense. Do it when there is still hope.”

The virtual round table was attended by nearly 100+ participants and the insightful discussion kept them glued to their screens throughout. CISO MAG would like to take the opportunity to once again thank Mr. Tarek Kuzbari, Eng. Abdullah Biary, and Hamad Al Katheri for their valuable time and meaningful insights on “The State of Ransomware.”

About the Interviewer
CISO MAG Writer - Mihir Bagwe
Mihir Bagwe is a Tech Writer and part of the editorial team at CISO MAG. He writes news features, technical blogs, and conducts interviews on latest cybersecurity technologies and trends.

 

Other Posts from the Author:

Sophos Suffers Data Breach; Small Subset of Customers Impacted

DEO data breach

Cybersecurity firm Sophos is the latest victim of a data breach that affected a small subset of its customers’ information. The exposed information included customer details like first and last names, email addresses, and phone numbers if provided. The data breach incident came to light after a security researcher reported the issue to Sophos.

“On November 24, 2020, Sophos was advised of an access permission issue in a tool used to store information on customers who have contacted Sophos Support. Only a small subset of the customers was affected, it added. At Sophos, customer privacy and security are always our top priority. We are contacting all affected customers. Additionally, we are implementing additional measures to ensure access permission settings are continuously secure,” as per Sophos breach notification.

Prioritizing customer privacy and security, Sophos notified the impacted users via email. The company develops security products for communication endpoints, encryption, network security, email security, mobile security, and unified threat management. The company is primarily focused on providing security software solutions to mid-market businesses.

Recently, Sophos partnered with Mapua, a Philippines-based technology university, to offer cybersecurity courses and training to university students. The new training alliance comes on the heels of a skills shortage in the cybersecurity sector and frequent data breaches in recent years. The partnership intends to enhance students’ skills and knowledge of cybersecurity. With the latest partnership, Sophos will offer train-the-trainer-style education on XG Firewall, which would earn Mapua faculty members the certification to teach the courses and embed these into the university curriculum. It also provides an option for students to obtain certifications from Sophos through an examination.

5 in 10 Ransomware Attacks in 2020 Occurred in the U.S.

Ransomware, supply chain and ransomware

Organizations in the U.S. witnessed a greater number of ransomware attacks than any other country, research from security firm BlackFog revealed. According to the research report, “The State of Ransomware in 2020,” nearly 57% of all ransomware attacks tracked in 2020 were reported in the U.S., with cybercriminals demanding $176,000 ransom per victim. It is found that ransomware operators focused mostly on organizations that are having tens of thousands of employees.

Key Findings

  • Australia stood second with 7% of ransomware attacks, followed by Canada (6%), the U.K. (5%), and Germany (4%).
  • The public sector was the primary target in 2020, with 34% of attacks, followed by education (29%), manufacturing (33%), health care (24%), and general services (23%).
  • In the Q4 of 2019, ransomware victims paid over $45,000 to threat actors. While in Q2 2020, victims paid up to $180,000 on average.
  • Most of the attacks were operated by infamous hacker groups like Maze (17%), REvil/Sodinokibi (16%), NetWalker (14%), and Ryuk (13%), making 60% of ransomware attacks globally.
  • The average ransom demand for a Maze attack is $420,000, Ryuk ransomware operators demand $282,590 on average, and the NetWalker group demands $176,910.
  • Ransomware actors targeted organizations that are having an average of 37,000 or more employees.

BlackFog predicts that an organization is attacked by a cybercriminal every 11 seconds and the damage costs from these attacks will hit around $20 billion by 2021.

Ransomware: A Lucrative Business

A recent survey from the Financial Services Information Sharing and Analysis Center (FS-ISAC), highlighted that rapidly evolving ransomware attacks have become a primary security concern for most financial organizations. The research indicated that ransomware operators have openly claimed successful attacks against eight financial institutions globally in 2020, three of which were banks. The FS-ISAC suggested that even organizations with robust cybersecurity defenses are still vulnerable to ransomware threats, especially through their third-party providers. Read the full story here…

Beware! Online Stores Susceptible to BEAST SSL Attacks

online shopping, International Fraud Awareness Week

A new security analysis from CyberNews revealed that many popular online stores are vulnerable to SSL vulnerability that could allow threat actors to exploit and steal sensitive information. In an official statement, CyberNews stated that it analyzed web servers of 2,620 popular e-commerce domains for SSL configuration security and their exposure toward known vulnerabilities related to the Secure Sockets Layer (SSL) encryption protocol.

“When performing our SSL configuration analysis, we also tested the online shopping servers for six known SSL vulnerabilities, including BEAST, POODLE, and DROWN, which might allow cybercriminals to carry out SSL-based attacks against the online shops and their users. We decided to test for those vulnerabilities in particular because they are well-known, have been discovered long ago, and already have patches released for them, putting the responsibility for the existence of such security holes squarely server-side,” the researchers said.

The BEAST Vulnerability

Despite most of the shopping servers having strong SSL configurations, one-third of the web servers are susceptible to the BEAST vulnerability (Browser Exploit Against SSL/TLS). The BEAST vulnerability could allow an attacker to access the information exchanged between a web server and the user’s web browser, including shoppers’ authentication tokens, payment details, and other personal information.

CyberNews recommended users to be vigilant while shopping online ahead of Black Friday and Cyber Monday.

Online Safety

To stay safe while shopping online, it is advised to employ multi-factor authentication to double-check the authenticity of digital users and add an additional layer of security to protect personal data and information. Browse with caution and be vigilant on what you are clicking, as it may be malware or phishing links.

Related story: Surge in Online Shopping is a Special Offer for Cybercriminals: McAfee

 

Endpoint Security is a Lot More Than Just Technology: Gartner

Endpoint security goes beyond technology and requires a mindset change, says Prateek Bhajanka, Senior Principal Analyst, Gartner. He says CISOs and Security leaders must be able to respond to an attack in a timely manner, and not focus only on prevention.

Speaking to CISO MAG, Prateek Bhajanka, Senior Principal Analyst, Gartner explains why endpoints have suddenly become so important in the realm of enterprise network security.

By Brian Pereira, Principal Editor, CISO MAG

Edited Excerpts from the interview follow:

According to Gartner, there were 365 million desktops used in offices in 2019. But today, more than 1 billion employees work from home. That’s tripled the number of endpoints corporate networks. And the endpoints have moved to homes. How do you see corporates coping with the risks of attacks on home networks and remote endpoints?

As the number of endpoints increased this year, the organization became boundary-less, and there is no perimeter anymore. At the same time, the attack surface of an organization has also become wider because now, you may have one associate working from Himachal Pradesh, another working from Kerala, and someone working from Assam — or any part of the country or the world. That puts endpoint security very much on the radar or makes it one of the top priorities for any CISO or any security professional.

We see a number attacks in organizations like ransomware and phishing. The entry vector for these attacks are the endpoints. When they enter the organization’s network, they create havoc. So definitely it (endpoints) is a top priority for the organization.

To your point, what is it that the organization should be doing to make sure that they keep their endpoint segments secured? It is not just technology that would drive endpoint security, or that would be able to establish a very good endpoint security posture for an organization. It goes beyond technology. And by that I mean, the mindset needs to change at the decision-making level. It’s about the kind of awareness that needs to be created, the kind of on-ground awareness and training that needs to be imparted, to all the associates of the organization.

As we keep saying, security is a shared responsibility. Consider an organization that has a thousand employees and a thousand associates. Among these thousand associates, the level of security awareness, the level of security maturity, would vary significantly across the associates and across the employee base. And that makes it all the more harder for the organization to understand, or harder for the organizations to implement endpoint security. Ultimately, everything boils down to the understanding of the end-user or the associate. Should they click on this particular link or not, that has come from an unknown source. Whether to open this particular email or not, which may not have been solicited, or which may not be expected. So you need this kind of on-ground awareness also on top of the technology.

Can you elaborate on the mindset change?

The traditional mindset of CISOs and security leaders in India has been: let’s focus only on prevention and let’s invest only on prevention and try to stop the attacks from happening altogether. But this approach needs to change. Yes, it is changing. One should acknowledge the fact that hundred percent prevention is not possible. We must be prepared for an attack or for successful attacks. And even if we are not able to prevent an attack, we should be able to detect such an attack while it is happening. And we should be able to respond to that attack in a timely manner. To prevent it from spreading to the entire organization. So, this change in mindset, when it comes to understanding that the attacks are inevitable, it may happen. We need to have controls, we need to have capabilities on the detection and response side as well.

What about technology? We have been using anti-virus software for years to protect endpoints. Is that enough to protect remote endpoints today?

When we talk about the endpoint security technology, it is not just the anti-virus that we need anymore. We need a technology stack which can protect the organization across the layers, not just endpoint, and not just from malware, but also from phishing attacks. It should protect the endpoints from malicious websites that you may be browsing on daily basis.

The attacks that are coming from the network may result in account takeover, and credential compromised. And that’s why endpoint security goes beyond antivirus. You need a technology stack, which can help you secure against the unknown, sophisticated attacks, and which also safeguards against the email and the phishing attacks.

What are some of the attacks occurring through endpoints? Especially in India.

The most common attacks, not just in India, but across the globe, are the results of using the endpoint segment as an entry vector, to get into the organization. So if I spell out some names, it is the ransomware campaigns, the ransomware infections that we generally know about —  WannaCry, NotPetya, and other ransomware campaigns and infections.

Besides ransomware, there are phishing campaigns, spear-phishing campaigns, attacks like social engineering, and business email compromise. Data breaches result in data exfiltration and these propagate through an endpoint segment.

And as you connect the endpoint to the corporate network, these attacks spread laterally.

The easiest way for bad actors to enter an organization is through the endpoint, which could be a laptop, desktop or smart phone. An employer and associate is allowed to browse internet and visits various websites for daily business operations. The employee is allowed to check emails coming from so many different sources, from outside the organization too. They can click on various links. There could be a link to make a payment for a certain procurement. That broadens the endpoint attack surface. It also increases the number of entry points for an attacker.

Trends show that endpoint security is going to be more SaaS based. Is that why Gartner forecasts cloud security spending to increase by 250.3% in 2021?  

If you look into the definition of cloud security spending, as per the forecast report that we put out, that is more on the CASB (Cloud Access Security Broker) side. That is more due to the fact the enterprise resources are getting delivered through SaaS. It is towards securing SaaS applications like CRM, ERP, etc.

Brian Pereira
About the Interviewer
Brian Pereira is the Principal Editor of CISO MAG. He has been writing on business technology concepts for the past 26 years and has achieved basic certifications in cloud computing (IBM) and cybersecurity (EC-Council).

 

More articles from this author:
“Proprietary aviation systems are getting commoditized, which opens up security risks”
Endpoint Security Extends to the Cloud

 

Operation Falcon: INTERPOL Nabs Three Nigerian BEC Scammers

Interpol

Based on the inputs from the threat hunting and analytics company, Group-IB, the INTERPOL conducted “Operation Falcon,” which saw three Nigerian BEC scammers getting arrested from the city of Lagos. The three alleged members belong to a larger cybercriminal group dubbed TMT. This group is popularly known to distribute malware through phishing; in other words they carry out business email compromise (BEC) attacks.

Nigerian BEC scammers arrested
Image Credit: INTERPOL

Operation Falcon, which was led by INTERPOL, had able and active support from the Nigerian Police Force and Group-IB’s APAC Cyber Investigations Team. The cybercriminals have been active since at least 2017 and have compromised more than 500,000 government and private sector companies in over 150 countries. The investigation continues as some of the gang members remain at large.

What is Business Email Compromise (BEC)?

BEC is a type of email phishing attack that employs social engineering techniques. As part of BEC, phishing emails can target people within an organization or send it to a particular group or department. It is often disguised as money transfer requests, HR-communications, or business proposals so that the cybercriminals can lay hands on confidential data.

About the Cartel

The data discovered on the devices of the arrested TMT members have confirmed their involvement in the criminal practice. The Nigerian Police Force has also identified the stolen data from at least 50,000 targeted victims.

Based on the infrastructure that the attackers use and their techniques, Group-IB was also able to establish that the gang is divided into subgroups with several individuals still at large. Researchers at Group-IB have already shared their findings on other suspected gang members with INTERPOL’s Cybercrime Directorate.

Modus Operandi

The analysis of their operations has revealed that the gang focuses on the distribution of phishing emails that contain popular malware strains under the guise of purchasing orders, product inquiries, and even COVID-19 aid impersonating legitimate companies.

Nigerian BEC scammers
Sample of the TMT’s phishing email; Image Credit: Group-IB

The attackers then use Gammadyne Mailer and Turbo-Mailer to send out phishing emails, which are then tracked using MailChimp to see whether a recipient victim has opened the message.

Group-IB researchers note that the cybercriminals behind these BEC operations rely exclusively on a variety of publicly available Spyware and Remote Access Trojans (RATs), such as AgentTesla, Loky, AzoRult, Pony, NetWire, etc. To avoid detection and tracking by traditional security tools the gang uses public crypters. Most often malware operated by TMT communicates with the attackers’ C&C server using SMTP, FTP, HTTP protocols. 

TMT’s end goal has always been to steal authentication data from browsers, email, and FTP clients. While the monetization methods of this gang are still being investigated, it is a known fact that PII and other critical data are sold easily on the dark web, which could be the case here as well.

Related News:

Group-IB Finds Half a Million Credit Cards of Indian Banks on Darknet

Craig Jones, INTERPOL’s Cybercrime Director said, “This group was running a well-established criminal business model. From infiltration to cashing in, they used a multitude of tools and techniques to generate maximum profits. We look forward to seeing additional results from this operation.”

Related News:

Nigeria Among Top 10 Countries Impacted by Mobile Malware: Kaspersky Lab

CISO MAG | The State of Ransomware | Cybereason

https://youtu.be/dqDwH0xbq7c?list=PLRmoLV6UOL5w5YhhAWxBS8J-ZOwp07GCV

CISO MAG | The State of Ransomware | Cybereason | Webinar

https://youtu.be/SHr3lhvHO2c?list=PLRmoLV6UOL5w5YhhAWxBS8J-ZOwp07GCV

1...139140141...409Page 140 of 409