This document discusses cybersecurity threats and strategies for mitigation. It covers topics like advanced persistent threats, zero-day attacks, exploit kits, and common attack vectors involving social media, email, mobile apps, and the web. The document also summarizes traditional threats compared to more advanced threats, outlines a 7-stage threat model, and emphasizes the importance of prevention, detection, and rapid response for effective cybersecurity.

1. Information Technology Services Division , ITSD
- Abhinav Biswas
ECIL Hyderabad

2. Information Technology Services Division , ITSD


- Corporate Threat Landscape

- Multi-Phase (7 Stage Model)

- Signature Based(Known )

Analytics based (Sandboxing & GTI )

- Log Correlation & Big Data Analysis

- Nessus, Acunetix


3. Information Technology Services Division , ITSD
 Gathers information secretly and sends to another entity
without the user's consent.
 Stops from using your PC until you pay a certain
amount of money (the ransom).
e.g. Encryption Ransomware, CryptoLocker
 Psychological manipulation of people into
performing actions or divulging confidential information.
 Act of attempting to acquire
information such as usernames, passwords, and credit card details by
masquerading as a trustworthy entity in an electronic communication.
 Voice-over Phishing

4. Information Technology Services Division , ITSD
 A weakness which allows an attacker to reduce a system's
information assurance.
 A possible danger that might exploit a vulnerability to breach security
and thus cause possible harm.
 A piece of software or a sequence of commands that takes advantage of
a bug or vulnerability.
 An attempt to destroy, expose, alter, disable, steal or gain unauthorized
access to or make unauthorized use of an asset.
(A realized Threat using an Exploit on Vulnerability is an Attack.)
 An observable change to the normal behavior of a system, environment,
process, workflow or person.
 An event attributable to a root cause. All incidents are events but
many events are not incidents.
(An Attack is a series of security incidents.)

5. Information Technology Services Division , ITSD

- Advanced Persistent Threats (APT)
- Zero-day Attacks (ZDA)
- Smart Mobile Malware (SMM)
- Web-based Plug-in Exploits (WPE)

- Free availability of Root-kits, SpamBots, Phishing Tools etc.
- Digital Currencies (BitCoin) & Anonymous Payment Services.

- Strategic Government institutions.

- Polymorphism, Dynamic URLs, Virtualization, Cloud, Smart Phone/
Mobiles, Social Sites, BYOD, Internet Of Things (IOT/IPv6)

6. Information Technology Services Division , ITSD
Lure Redirect Exploit
Kit
Dropper
File
Call
Home
Data
Theft
Recon

7. Information Technology Services Division , ITSD
Traditional Threats APTs
Signature Based Zero-Day: No signature  Rule-based
Reactive Response Proactive/Predictive/Adaptive Response
Opportunistic/Generic attack Targeted/Customized Attack
Visible Stealthy- Low-flying
Short-term & Bursty Long-term & Persistent
Static - Relatively easy to detect (based on
signature)
Polymorphic - Take months to detect (no
specific pattern)
Getting attention/Bragging is motive Data-exfiltration & Disruption of services
is motive
Limited Resources (people, money,
technologies)
Sponsored by Nation States – Large no. of
quality resources
Eg: Common Cold Eg: Cancer

8. Information Technology Services Division , ITSD
8
Social
Media
Email
Mobile
Attack Vectors
Web
Redirects
Malware
Recon
XSS
Dropper
Files
C
n
CExploit
Kits
Phishing

9. Information Technology Services Division , ITSD
 1a) Identify target
 1b) Determine browsing habits
 2) Select favorite website
 3) Compromise and host
exploits
 3)Drop malware
 4)Determine target profile
 4)Wait for opportunity to
further compromise

10. Information Technology Services Division , ITSD
Internet
Customer
Attacker
Vuln. ADSL Router
Changes the DNS server entries in the
modem to rogue DNS servers and changes
the password of the DSL router
Rogue DNS Server
Attacker scans for the DSL router and logs onto
Admin console via WAN interface by exploiting
vulnerabilities in the router firmware or
configuration flaws; or by infecting connected
computer

11. Information Technology Services Division , ITSD
3 FORWARD FACING ONLY,
LACK OUTBOUND PROTECTION
No contextual analysis of Internal Threats.
2 LACK OF REAL-TIME
INLINE CONTENT ANALYSIS
No Byte-Range Data Packet Analysis for
Data Loss/ Theft Detection
4 LACK OF ADVANCED ANALYTICS
& ANOMALY DETECTION
No Sandboxing in existing UTMs, NGFWs.
No SSL packet inspection.
1 PRIMARILY BASED ON
SIGNATURE & REPUTATION
Signature history cannot keep up with the
dynamic future of threats

12. Information Technology Services Division , ITSD

13. Information Technology Services Division , ITSD

14. Information Technology Services Division , ITSD
WEB
 Content Analysis
 Malware
Sandbox
 Forensic Reports
 SSL Inspection
 Video Controls
EMAIL
 Spear-Phishing
 URL
Sandboxing
 Anti-Spam
 TLS Encryption
 Image Analysis
DATA
 Content Aware DLP
 Drip Data Theft
Detection
 OCR of Image Text
 Geo-Location
MOBILE
 Cloud Service
 Malicious Apps
 BYOD Policy
 Reporting/Invent
ory
Monitor
Discover
Classify
DISCOVER
MONITOR
CLASSIFY
PROTECT
WHERE
WHATWHO
HOW
ESSENTIAL
INFORMATION
PROTECTION
External Risks Internal Risks

15. Information Technology Services Division , ITSD
(Similar to Bomb Detonation Sandbox)
- Tightly controlled access to resources
- URL sandbox/File sandbox - Isolated environment/network
- Multiple Detection Environment (Virtual Machines)
- Customizable & Realistic Virtual environment
- Behavior based classification & Risk scoring
- Instrumented Forensic Data Collection
- Big log Data interpretation
- Post-incident data (SIEM - Security Incident Event Management)
- Real-time Threat Intelligence (GTI)
- Integration with other sources (local/national/international)
- PCAP (Packet Capture) & Replay

16. Information Technology Services Division , ITSD

- Content & Context Aware logs
- Device & Application logs, Authentication & IAM log,
Endpoint security devices, user identity, location, VA scan data,
Netwrk flows, OS events, DB transaction logs

- Remove redundancy.

- Threat Intelligence & Risk Analysis



17. Information Technology Services Division , ITSD

18. Information Technology Services Division , ITSD

19. Information Technology Services Division , ITSD
 is better than (Old Proverb)
 Prevention is
& is a Must
followed by quick

20. Information Technology Services Division , ITSD
 Use Legal software only
 Keep upto-date patches and fixes of the Operating System and
Application Software
 Exercise caution while opening unsolicited emails and do not click on a
link embedded within
 Open only email attachments from trusted parties
 Use latest browsers having capability to detect phishing/ malicious
sites
 Harden the Operating System
 Whitelist the Applications
 Deploy software for controlled use of USB Pen Drives.

21. Information Technology Services Division , ITSD
“Failure is not when we fall down, but when we
fail to get up”

22. Information Technology Services Division , ITSD