FireEye Email Security Webinar: Responding to Unknown Threats

©2019 FireEye©2019 FireEye
Supported by Community Partner
Global Webinar Series,
Hosted by Prime Infoserv

Ishtiyaq Ahmad Shah is a Security Consultant with more
than 15 years of experience in the security industry,
Ishtiyaq is currently Security consultant at FireEye India,
based out of New Delhi. Ishtiyaq specializes in Advance
Persistent Threat Management, Data Security and
Security management solutions. Prior to joining FireEye, he
served as
security consultant at RSA, Wipro & HCL Technologies.
Ishtiyaq holds a Bachelor's degree in computer science,
Diploma in Cyber Law & other Industry certifications
Ishtiyaq Ahmad Shah, FireEye
2
Presenter

Ishtiyaq Shah
Sr. Solution Architect
Responding to Unknown Threats
FireEye Email Security – Everyone is a Target

Current Scenario
– Everyone trying to work from home
Email Security
– Rise in targeted Emails with Covid19 themes
– How we protect our Email users?
– Expertise on Demand
– eLearning
What can Customers do NOW?
– Technical or operational
– General Awareness
Q&A
Agenda Overview
4

Reminder:
No Sales or marketing pitch

– Sudden move to a distributed
workforce with no field movement
– Staff shortages, in general or due to
sickness
– Ransomware shutting down
organizations worldwide.
– COVID-19-related spear phishing
– Information operations spreading
misinformation
– Targeted attempts to steal
intellectual property from
healthcare-focused research
institutions
– Impact on supply chain disruptions
on the flow of medical supplies,
teams, or material, including
manufacturing
– Fake News upsurge
– Demanding uptick for latest
information by masses on Covid-19
situation
Present Scenario & Concerns
6

 Mandatory working from Home for all employees unless extremely urgent to be in Data Center
 Multiple Solution apps and infrastructure are SaaS or hosted in public cloud infrastructure providing
resiliency and scalability as needed
 Cloud security Solutions for AWS, GCP and Azure infrastructure
 Internal Security Operations Centers working as a remote model across the world
 Service and Support operations are fully operational though shifted largely to remote working
mode
 Mandiant team helping customers respond to any breaches or incidents via different modes
 Managed Defense team keeping customers security afloat remotely
Business Continuity @ FireEye
7

• Malicious actors have always exploited users’ sense of urgency, fear,
goodwill and mistrust
• Threat actors exploiting current crisis is not new.
• Attackers simply take advantage of a particularly overtaxed target set
that is urgently seeking new information.
• Users who are aware of this dynamic, and who approach any new
information with cautious skepticism will be especially prepared to meet
this challenge.
Current Situational Implications

Email is a primary attack vector
Social Distancing - Target via Email
10

 Few LURE DOCUMENT VISUALS
Spur in COVID-19 based Spear-Phish mails
11

 COVID-19 has rapidly taken over the
headlines
 Increased risks due to users working from
home en masse.
 Threat actors aligning with the COVID-19
topic for Targetted campaigns
– Financial crime, cyber espionage and
information operations.
– Increasing attack by financially
motivated threat actors seeking to
exploit their sense of urgency, fear,
goodwill and mistrust.
– Attackers use email to deliver malware
in an effort to establish a foothold
– Siphon account credentials through
phishing tactics.
There are viruses, and then there are viruses
12
Example of a COVID-19 phishing email used by TEMP.Warlock threat group.

Real Impact - Phishing Campaign
13
• Emails Sent with the subject line “Internal Guidance for Businesses Grant and loans in response to respond to COVID-19”
• Emails had OpenDocument Presentation (.ODP) format attachments
• If opened in Microsoft PowerPoint or OpenOffice Impress, display a U.S. Small Business Administration (SBA) themed message
• Uses an inline link that redirects to an Office 365 phishing kit hosted at https://tyuy56df-kind-giraffe-ok.mybluemix[.]net/.
Example Phishing Campaign

Real Impact - Malware Distribution Campaign
14
• March 18 - individuals across a broad set of industries and geographies received emails with the subject line “COVID-19 Payment”
• Intended to distribute the SILENTNIGHT banking malware (also referred to by others as Zloader)
• Mails sent from a large pool of different @gmx.com domain
• Had password protected MS Word document attachments with file name “COVID 19 Relief.doc”
• emails appear to be auto generated and follow the format <name>.<name><SevenNumberString>@gmx.com
• Upon opening and enabling macros a .JSE script crafted to download and execute an instance of SILENTNIGHT from
http://209.141.54[.]161/crypt18.dll would drop and execute.
• Attackers increasingly leverage lures tailored to the new
economic stimulus bill and related Covid-19 recovery
efforts
• Threat actors with varying motivations are actively
exploiting the current pandemic and public fear of the
coronavirus and COVID-19.
• Security researchers at FireEye already begun to identify
and report on COVID-19 themed campaigns
Example Malware Distribution Campaign

FireEye Advanced Persistent Threat Groups
16

Phishing Attack Landscape
17
Personal Identity,
Financial
Credential
Access
Organization
Access/Data
W2, BEC,
High Profile Accounts
BROAD ($$) ($$$$) TARGETED
DOMAIN SPOOF PHISHING ATTACHMENTS USER IMPERSONTION
TEXT LURES CREDENTIAL PHISHING LINKS DOMAIN IMPERSONATION
LINK TO SaaS APPS
SUPPLY CHAIN
IMPERSONATION
Attack Spectrum
Attack Lures/Payloads
Source: ENISA (January 2019). Threat Landscape Report 2018, 15 Top Cyberthreats and Trends.

Are You Confident Your Team Won’t Click?
18
1 2 3 4
Impersonation Timeline
Identify A Target Grooming
Exchange of
Information Wire Transfer
Bad actors social
engineering tactics.
(Using Covid-19 Theme)
Fraudulent emails get
past traditional email
security.
Users susceptible to take action
when context is relevant and fear
consequences of failing to react.
Mission accomplished.
*Source: National Institute of Standards and Technology (2018), User Context: An Explanatory Variable in phishing Susceptibility.

Email Security Key requirements
19
Full Security Stack
Internet
FireEye Email Security
Cloud Edition with AV/AS
Customer Email Server
Gartner Requirements
✓ Advanced threat detection
✓ Deep relationship analysis
✓ AV/AS filtering
✓ Impersonation Detection
Secure Email Gateway

Email Security in Action
20
Receive
Message received
by inbound mail
server
Retroactive
analysis
Detect
Spam and
impersonation
scanning, known
malware
and malicious URLs
Analyze
MVX and
Advanced URL
Defense for
advanced
threats
Alert
Admin informed
that message
blocked and why
Deliver
Message is clean
and delivered to
recipient’s inbox
✓
Block
Malicious messages
quarantined for
further review
✘
Inbound Protection

Email Security—Cloud Edition in Action
21
Send
Message sent by
Outbound mail
server
Deliver
Message is clean
and delivered to
recipient’s inbox
✓
Detect
Spam scanning,
known malware
and malicious URLs
Analyze
MVX and
Advanced URL
Defense for
advanced
threats
Block
Malicious messages
quarantined for
further review
✘ Alert
Admin informed
that message
blocked and why
Retroactive
analysis
Outbound Protection

©2019 FireEye
Auto Remediate for Office 365 Actions
22
Auto Remediate
Email becomes weaponized post-delivery
(retroactively). Policy action quarantines,
moves or deletes malicious message from inbox
Move
Moves malicious email from the inbox to any
administrator-defined folder
Quarantine
Removes malicious email from the inbox and
places it in quarantine within Cloud Edition
for review
Delete
Permanently deletes malicious email
from the inbox

Protection Against Advanced Threats
23
New Phishing
Sites
(URL credential
phishing)
Impersonation
(CEO fraud, sender
spoofing)
Unknown
Malware
(attachments, links,
zero day)
Advanced
URL Defense
(URL inspection)
Smart DNS
(deep relationship
analysis)
MVX Engine
(attachment& URL
detonation)
40M+ Mailboxes
ThreatsCapabilities
Intelligence
(frontline
investigations,
email specific
threat intel)

Key Benefits
24
Protect Email Users
Stop threats before it reaches the inbox.
Detect advanced threats and spam.
Block inline Threats.
Prevent Incidents
Enable near real-time response to attacks.
Identify risk level of malicious content.
Customize policies.
Surface Threats
Minimize false positives.
Prioritize events based on risk.
Apply contextual intelligence.

Reduce
the risk of security incidents becoming serious.
Business Value
25
Improve
team productivity through the correlation of threats.
Consolidate
email security vendors for greater cost efficiency.

Expertise on Demand
26
You see a campaign.
You want to know what
FireEye knows about it
• Provides context and
overviews
• Highlights available
Insight reports
Self-
service
Single Report /
Answer
Limited
Duration
Scoped
Engagement
Context Inquiries Insight Analyst Investigation Full Services Portfolio
The campaign
is targeting my
organization or
industry vertical
You now know enough
to be nervous. You want
to investigate the
campaign more
Yes, there is impact. I
need help.
• Access the
referenced Intel
report, or
• Brief analyst
commentary
• Request analyst
evaluation of the
campaign
• Determine impact if
email was delivered
• Transition to IR
• Provide a tailored
threat briefing
• Engage Mandiant for
security posture
review
Ask an Analyst Pairings with Email Security

 Enforce Multi-factor Authentication (MFA)
 Configure Spoof Protection Controls (SPF, DMARC etc)
 Validate Email Security Gateway Implementation
 Implement Automated Email Warning Reminders
 Formalize Phishing Reporting Process
 Block Macros in Microsoft Office Documents
 Validate Web Proxy or URL Filtering Configurations
 Implement Strong Password Policies
 Ensure Sufficient Logging and Alerting is in Place
 Develop and Operationalize Phishing Incident Response Playbooks
 Authenticator App
instead of SMS
 DMARC, SPF, DKIM
 Scan and block both
malicious attachments
and embedded URLs
 Automatically embed an
“External Email”
disclaimer to each email
received
 Block macros from
running in Office files from
the Internet
 All files downloaded from
external websites
analysed
 Reduce Social
Engineering attempts for
password reset
 Central logging& alerting
platform
 Operationalization of an
IR Playbook
What Can Organization do?
27
Technical & Operational
Source: FireEye Research Blog: How to Manage Email Phishing Risks

 Continue to focus on both building user security
awareness
 Hardening technical mitigative and detective
controls
 Enhance user awareness
 Communicate the risks posed by COVID-19 phishing
and social engineering campaigns
 Provide users examples of what to watch out for and
what to do if they come across such emails
 Reminding users to remain vigilant to both phishing
emails and potential payment fraud scenarios
Security-awareness-work-home-
deployment-kit
 Free Awareness workshop and
material for refernce
– SANS:
https://www.sans.org/security-
awareness-training/sans-
security-awareness-work-home-
deployment-kit
– US CERT:
https://www.us-
cert.gov/ncas/current-
activity/2020/03/06/defending-
against-covid-19-cyber-scams
What Can Organization do?
28
General Awareness and Vigilance

Remote Work in an Age of COVID-19 — Threat Modeling the Risks
With COVID-19 Themed Campaigns on the Rise, Here’s How to
Manage Email Phishing Risks
Social Engineering Based on Stimulus Bill and COVID-19 Financial
Compensation Schemes Expected to Grow in Coming Weeks
FireEye Email Security - Datasheet
FireEye Expertise on Demand - Combat the Cyber Skills Shortage -
Datasheet
FireEye Technical Webinars - Cyber Tech Live
The 3 Ts of An Email Attack - TACTICS, TECHNIQUES, TARGETS
Email Threat Report
Key Resources to refer
29

Thank You
• Social Distancing
• Work on starting more communication with colleagues, friends, peers
• Work from Remote like you do in office
• Keep yourself healthy
• Start Upskilling yourself
• Work on Time Management
• Cleanup your computers and mobiles of unwanted files & Software's
• Arrange data and Apps on your digital equipment’s
• Make yourself aware of all guidelines released by Authorities
• Keep you and family safe
• Keep All software up to date with latest patches
• Always use licensed software

 Thank you for your attendance and kind co-operations
 Please submit your feedback from which you will receive
by mail.
 The session video, presentation etc. will be available on
Prime YouTube Channel, Slideshare and Facebook
 There are upcoming interesting sessions in the coming days,
if you have not yet registered, please register soon.
Thank you
32

2nd April (4pm - 5.30pm)
Application Delivery - Scaling
Capacity & Availability: Mr.Tarun
Verma, A10 Networks
Webex Link:
https://meetingsapac.webex.com/mee
tingsapac/j.php?MTID=m41f69a4efcf4
901a59479ec0dec96501
Meeting number: 577 492 175
Password: adc@123
Stay Tuned for the upcoming programs
3rd April (4pm - 5.30pm) ONE
Platform - Connecting Everything:
Mr.Vivek Srivastava, Soti
Webex Link:
https://meetingsapac.webex.com/meeting
sapac/j.php?MTID=m3ffe0d1ccd19b819d
fe80e1d6083bfc9
Meeting number: 576 456 660
Password: soti@123

FireEye Email Security Webinar: Responding to Unknown Threats

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to FireEye Email Security Webinar: Responding to Unknown Threats

Similar to FireEye Email Security Webinar: Responding to Unknown Threats (20)

More from Prime Infoserv

More from Prime Infoserv (20)

Recently uploaded

Recently uploaded (20)

FireEye Email Security Webinar: Responding to Unknown Threats