Your Sector Doesn’t Matter: Achieving Effective Threat Prioritization
•
1 like•129 views
Many organizations’ security functions determine what threats they care about based on what threats are known to be affecting their sector, or comparably simple criteria. In reality, this approach is poorly suited to dealing with the significant security issues of today. Malicious actors scope their victims based on multiple factors, and understanding these factors is essential to managing risk. (Source: RSA Conference USA 2017)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Your Sector Doesn’t Matter: Achieving Effective Threat Prioritization
Similar to Your Sector Doesn’t Matter: Achieving Effective Threat Prioritization (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Your Sector Doesn’t Matter: Achieving Effective Threat Prioritization
- 3. #RSAC The Problem 3 Probability Impact Risk Today’s focus: What influences probability of cyber threats?
- 6. #RSAC The Problem … BUT Threat actors don’t consistently select their victims that way. THE RESULT: Organizations miss opportunities to prevent loss rather than remediate damage. UP NEXT: What factors actually influence which threats affect who?
- 11. #RSAC Cyber Crime Target Selection: Footprint Ransomware: Targeting • Campaigns typically indiscriminate; group victims by country due to social engineering, ransom payment logistics, ransom amount • Associated self‐proliferation capabilities allow infection expansion without regard to target • eCrime market models focus on maximizing user bases Risk influenced by: Your accessibility via malware delivery mechanisms (email) and ability for malware to run (OS types used)
- 13. #RSAC Cyber Crime Target Selection: Services Trade‐Based Laundering: Background • Many eCrime operations purchase and resell goods and services continuously to launder stolen funds • Mule networks (may be for‐hire) move physical goods • Gift cards offer rapid laundering mechanism • Hospitality, travel, entertainment tickets booked just before event • Resold to unsuspecting consumers, other criminals • Resold in underground, grey‐market sites, multi‐vendor sites
- 15. #RSAC Cyber Crime Target Selection: Resources Corporate Account Takeover: Background • Advanced credential theft malware compromises organizations’ accounts with variety of services for fraud • Leverage advanced authentication bypass techniques • Tactic offers higher value per compromise than stereotypical consumer account takeover • Potential examples: Dridex, TrickBot, GozNym…
- 16. #RSAC Cyber Crime Target Selection: Resources Corporate Account Takeover: Background Service Compromised Potential Monetization Card Management Monetary Theft Cash Management Monetary Theft Corporate Banking Monetary Theft Data Security Data Theft Fulfillment Shipping Diversion or Abuse Recruiting Money Mule Recruiting Technology Fraudulent Purchases
- 17. #RSAC Cyber Crime Target Selection: Resources Corporate Account Takeover: Targeting • Distribution leverages combination of mass spam with tailoring (can be automated) to recipient • Compromise services offering opportunity to capitalize on perpetrators’ monetization and laundering capabilities Risk influenced by: Your use of typically‐outsourced platforms for finance, HR, shipping, etc.
- 27. #RSAC Hacktivism Target Selection: Associations Dyn DDoS: Background • Mid‐October: Dyn Managed DNS suffers repeat attacks disrupting service to many customers • Attacks use Mirai botnet, variant of Gafgyt Linux bot • Followed reports of attacks up to 1.5 Tbps using same capability • Multiple links to hacktivist activity
- 28. #RSAC Hacktivism Target Selection: Associations Dyn DDoS: Targeting • Dyn DDoS was directly attacked, but other high‐profile organizations suffered downtime and associated potential losses • Critical service providers an attractive target in many cases Risk influenced by: What external providers victims depended on
- 29. #RSAC Hacktivism Target Selection: Image OpIcarus: Background • Hacktivist activity against financials to protest alleged corruption • Diverse financials affected; heaviest DDoS concentration against central banks • Key actors include “Harvey Harris,” “Ghost Squad Hackers”
- 30. #RSAC Hacktivism Target Selection: Image OpIcarus: Targeting • Virtually any financial a target consistent with narrative • Others involved in alleged corruption also affected (e.g. energy) Risk influenced by: Perception of alleged corruption
- 31. #RSAC Hacktivism Target Selection: Exposure OpRussia: Background • Anti‐Russia hacktivist campaign • Mass defacement of Russian websites • Indications of DDoS attacks
- 32. #RSAC Hacktivism Target Selection: Exposure OpRussia: Targeting • Many Russian sites potential targets • Mirrors targeting characteristics of many hacktivist campaigns based on narratives consistent with disparate attacks Risk influenced by: Any connection, however tangential, to Russia; website vulnerability
- 34. #RSAC Application Evaluate threat probability for your organization based on the factors shaping adversaries’ targets from adversaries’ perspective What significant threats exist? Who are they affecting and why? Particularly, who are threats affecting outside where organizations typically look – “my sector,” “my region”? How much does the “why” apply to me also? Assume internal risk‐related conversations and decision‐making may require initial level set
- 36. #RSAC Application Associations Image Exposure What are your actual or presumed relationships? What are public perceptions of you? How hardened are you to threat activity? Information Access Prominence or Criticality Presence What is accessible from your environment? How would attacking you affect others? Where are you located or active? Footprint Services Resources What infrastructure do you have? What do you provide? What do you depend on internally?
- 37. #RSAC Discussion