Download to read offline
Uploaded byPriyanka Aash
Your Sector Doesn’t Matter: Achieving Effective Threat Prioritization
The document discusses the complexities of cyber threat prioritization, emphasizing that organizations often rely on simplistic criteria related to their sector or region, which can lead to missed opportunities for prevention. It outlines factors influencing the selection of cyber crime, cyber espionage, and hacktivism targets, including accessibility of resources, public perception, and the prominence of information. Ultimately, organizations are encouraged to assess threats based on a broader perspective, considering how various adversaries may target them beyond traditional boundaries.
More Related Content
Similar to Your Sector Doesn’t Matter: Achieving Effective Threat Prioritization
Your Sector Doesn’t Matter: Achieving Effective Threat Prioritization
- 1.
- 2.
- 3.
- 4.
- 5.
- 6. #RSAC The Problem … BUT Threat actors don’t consistently select their victims that way. THE RESULT: Organizations miss opportunities to prevent loss rather than remediate damage. UPNEXT: What factors actually influence which threats affect who?
- 7.
- 8.
- 9.
- 10.
- 11. #RSAC Cyber Crime Target Selection: Footprint Ransomware: Targeting • Campaigns typically indiscriminate; group victims by country due to social engineering, ransom payment logistics, ransom amount • Associated self‐proliferation capabilities allow infection expansion without regard to target •eCrime market models focus on maximizing user bases Risk influenced by: Your accessibility via malware delivery mechanisms (email) and ability for malware to run (OS types used)
- 12.
- 13. #RSAC Cyber Crime Target Selection: Services Trade‐Based Laundering: Background • Many eCrimeoperations purchase and resell goods and services continuously to launder stolen funds • Mule networks (may be for‐hire) move physical goods • Gift cards offer rapid laundering mechanism • Hospitality, travel, entertainment tickets booked just before event • Resold to unsuspecting consumers, other criminals • Resold in underground, grey‐market sites, multi‐vendor sites
- 14.
- 15. #RSAC Cyber Crime Target Selection: Resources Corporate Account Takeover: Background • Advanced credential theft malware compromises organizations’ accounts with variety of services for fraud • Leverage advanced authentication bypass techniques •Tactic offers higher value per compromise than stereotypical consumer account takeover • Potential examples: Dridex, TrickBot, GozNym…
- 16. #RSAC Cyber Crime Target Selection: Resources Corporate Account Takeover: Background Service Compromised Potential Monetization Card ManagementMonetary Theft Cash Management Monetary Theft Corporate Banking Monetary Theft Data Security Data Theft Fulfillment Shipping Diversion or Abuse Recruiting Money Mule Recruiting Technology Fraudulent Purchases
- 17. #RSAC Cyber Crime Target Selection: Resources Corporate Account Takeover: Targeting • Distribution leverages combination of mass spam with tailoring (can be automated) to recipient •Compromise services offering opportunity to capitalize on perpetrators’ monetization and laundering capabilities Risk influenced by: Your use of typically‐outsourced platforms for finance, HR, shipping, etc.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27. #RSAC Hacktivism Target Selection: Associations Dyn DDoS: Background • Mid‐October: DynManaged DNS suffers repeat attacks disrupting service to many customers • Attacks use Mirai botnet, variant of Gafgyt Linux bot • Followed reports of attacks up to 1.5 Tbps using same capability • Multiple links to hacktivist activity
- 28. #RSAC Hacktivism Target Selection: Associations Dyn DDoS: Targeting •Dyn DDoS was directly attacked, but other high‐profile organizations suffered downtime and associated potential losses • Critical service providers an attractive target in many cases Risk influenced by: What external providers victims depended on
- 29. #RSAC Hacktivism Target Selection: Image OpIcarus: Background • Hacktivist activity against financials to protest alleged corruption • Diverse financials affected; heaviest DDoS concentration against central banks •Key actors include “Harvey Harris,” “Ghost Squad Hackers”
- 30.
- 31. #RSAC Hacktivism Target Selection: Exposure OpRussia: Background • Anti‐Russia hacktivist campaign •Mass defacement of Russian websites • Indications of DDoS attacks
- 32. #RSAC Hacktivism Target Selection: Exposure OpRussia: Targeting • Many Russian sites potential targets • Mirrors targeting characteristics of many hacktivist campaigns based on narratives consistent with disparate attacks Risk influenced by:Any connection, however tangential, to Russia; website vulnerability
- 33.
- 34. #RSAC Application Evaluate threat probability for your organization based on the factors shaping adversaries’ targets from adversaries’ perspective What significant threats exist? Who are they affecting and why? Particularly, who are threats affecting outside where organizations typically look – “my sector,” “my region”? How much does the “why” apply to me also? Assume internal risk‐related conversations and decision‐making may require initial level set
- 35.
- 36. #RSAC Application Associations Image Exposure What are your actual or presumed relationships? What are public perceptions of you? How hardened are you to threat activity? Information Access Prominence or Criticality Presence What is accessible from your environment? How would attacking youaffect others? Where are you located or active? Footprint Services Resources What infrastructure do you have? What do you provide? What do you depend on internally?
- 37.