The document discusses the need for a multi-layered approach to cybersecurity due to the rapid growth of cyber threats, including insider threats, advanced human attacks, and ransomware. It emphasizes the importance of leveraging machine learning and analytics for incident response and threat detection, as well as the necessity of collaboration between government agencies and the private sector to improve information sharing and defensive measures. A unified effort is required to track and respond to cyber threats while balancing the need for security and individual privacy.

1. Information Security
find an article online discussing defense-in-depth. List your source and provide a paragraph
summary of what the article stated.
Solution
Abstract
The exponential growth of the Internet interconnections has led to a significant growth of cyber
attack incidents often with disastrous and grievous consequences. Malware is the primary choice
of weapon to carry out malicious intents in the cyberspace, either by exploitation into existing
vulnerabilities or utilization of unique characteristics of emerging technologies. The
development of more innovative and effective malware defense mechanisms has been regarded
as an urgent requirement in the cybersecurity community. To assist in achieving this goal, we
first present an overview of the most exploited vulnerabilities in existing hardware, software, and
network layers. This is followed by critiques of existing state-of-the-art mitigation techniques as
why they do or don't work. We then discuss new attack patterns in emerging technologies such
as social media, cloud computing, smartphone technology, and critical infrastructure. Finally, we
describe our speculative observations on future research directions.
A multi-layered approach to cyber security utilising machine learning and advanced analytics is
essential to defend against sophisticated multi-stage attacks including:
Insider Threats | Advanced Human Attacks | Supply Chain Infection | Ransomware |
Compromised User Accounts | Data Loss
Prepare for a cyber security incident or attack and how to adequately manage the aftermath with
an organised approach to Incident Response – coordinating resources, people, information,
technology and complying with regulations.
INSIDER THREATS
Insider threat can originate from employees, contractors, third party services or anyone with
access rights to your network, corporate data or business premises.
The challenge is to identify attacks and understand how they develop in real-time by analysing
and correlating the subtle signs of compromise that an insider makes when they infiltrate the
network.
Traditional security measures are no longer sufficient to combat insider threat. A more
sophisticated, intelligence-based approach is required. Cyberseer uses machine-learning
technology to form a behavioural baseline for every user to determine normal activity and spot
new, previously unidentified threat behaviours. The move to a more proactive approach towards

2. security will enable companies to take action to thwart developing situations escalating into
exfiltrated information or damaging incidents.
ADVANCED HUMAN ATTACKS
Advanced threats use a set of stealthy and continuous processes to target an organisation, which
is often orchestrated for business or political motives by individuals (or groups). The “advanced”
process signifies sophisticated techniques using malware to exploit vulnerabilities in
organisations systems. They are considered persistent because an external command and control
system is used to continuously monitor and exfiltrate data from the specific target.
Distinguishing between an employee going about their normal work and an imposter
impersonating an employee can be challenging. Understanding the attacker artefacts such as file
names and data transfers can help a security team gain visibility of affected systems and devices
on the network. Cyberseer uses smart technology in conjunction with a variety of research and
analysis techniques, to determine when a user is exhibiting unusual and risky behaviour. Track
user behaviour wherever it leads – across devices, VPN connections, source IP address, account
names, geographies and credentials.
SUPPLY CHAIN INFECTION
The supply chain is the silent threat that can lead to loss of sensitive customer information,
disruption to manufacturing process and damage to the company’s reputation. The security of
any one organisation is only as strong as that of the weakest member of the supply chain.
Criminal organisations operate a sophisticated information gathering exercise to understand the
supplier network associated with a target. They identify the organisations with the weakest
security within the supply chain and gain access to either the target company or other members
of the supply chain.
Supply chain attack threat poses a significant risk to modern day organisations and attacks affect
all industries with a complex supply network.
Cyberseer look at the potential weaknesses in the supply chain by monitoring the actions of users
and attack vectors those vulnerabilities could introduce. Track user behaviour across devices,
VPN, connections, source IP addresses, account names, geographies, and credentials to secure
supply chain systems.Assess whether your supply chain is safe from cyber-attacks.
RANSOMWARE
Ransomware is making headlines – lurking in ads on popular websites and shutting down
hospitals. It enters a network and moves undetected from system to system using asymmetric
encryption to hold a victim’s information at ransom. Ransomware is a highly persistent and
organised criminal activity in full deployment with ransomware-as-a-service (RaaS) at its core.
Having advanced steadily in sophistication, the prevalence of Ransomware is now wide spread

3. and by the time of detection it’s too late.
Using intelligent defences, Cyberseer detect anomalous behaviour and apply research-driven
knowledge of ransomware file-extensions, names, etc. to determine whether anomalous activity
matches the characteristics of known malware.
Early detection enables Cyberseer customers to prevent disruption to business operations and
data security. Safeguard your operations with early detection using an advanced endpoint
security tool that provides prevention as well as a unique journaling approach to this invasive
threat.
COMPROMISED USER ACCOUNTS
Privileged users such as database or system administrators have escalated access rights meaning
they are prime targets for hackers. In addition, the increasing adoption of virtualisation, cloud
services and big data implementations creates new layers of administration access privileges
expanding organisations risk of compromise.
With Cyberseer’s suite of security solutions and threat intelligence organisations can gain the
comprehensive, robust, and granular controls they need to detect unusual behaviour within
privileged and shared accounts and guard against abuse of privileged user access.
Guard against the risks posed by privileged users and compromised credentials.
DATA LOSS
Data loss and theft is a major concern for organisations today. Cyber criminals target data for its
inherent financial value (credit card details), its economic and competitive value (manufacturing
designs) or political insights (classified documents).
Once an attacker gains a foothold within your organisation they potentially have the ability to
extract and change data without being detected. Ensuring data integrity is essential for
businesses.
Today’s challenge has shifted from the unrealistic goal of total information security to
developing the ability to identify the aspects of your information infrastructure that are in
jeopardy of being attacked. Cyberseer fuses machine-learning technology and the knowledge of
skilled Analysts to identify unusual movements of data and files across your network.
Anomalous data transfers and file amendments are interpreted to determine threat severity and
the organisation’s associated risk.
Detect and prevent confidential and sensitive data from being accessed for unauthorised use.
INCIDENT RESPONSE
Incident response teams face challenging times with growing numbers of incidents, the
escalating cost of cyber-attacks and increasing demand for skilled employees.
By leveraging metrics and analytics, organisations can continually evaluate and improve their
incident response abilities and react more quickly, effectively and intelligently to cyber incidents.

4. Cyberseer uses smart incident response technology that enables our customers to thrive in the
face of cyber attacks or business crisis.
Take an organised approach to using best practise in the face of a security breach.
Limit the damage and reduce recovery times and costs with the best in-class response
capabilities.
summary
To better prepare to mitigate the emerging threats and improve the cybersecurity of this country,
two overarching goals should be pursued continuously:
• First, enable substantially better information sharing and collaboration among key departments
and agencies (Department of Justice, Department of Homeland Security,Department of Defense,
and Office of the Director of National Intelligence) and the private sector. The Cybersecurity
Information Sharing Act of 2015 was a needed, but
small and careful, step toward this goal, in part because it encourages the private sector(via
liability protections) and U.S. government to share knowledge of cybersecurity threats, including
classified vulnerabilities, best practices, and defensive measures. This law could better enable the
community to anticipate attacks and have a more proactive
defense posture.
• Second, achieve unity of effort across the U.S. government. Today, different government
agencies have different cyber responsibilities. This makes perfect sense in many ways, because
different agencies have different capabilities, so they should be tasked to do what they are good
at doing. The trick is to harness all the capabilities to a common end, and therein lies the
problem. Cyber defense requires a coherent response,and the bureaucratic responsibilities as
currently articulated hinder progress toward that goal. President Obama’s appointment of a Chief
Information Security Officer for the country—part of his newly announced Cybersecurity
National Action Plan28—is another careful small step toward some needs.
Ultimately, perhaps ideally, what is needed is the ability to track cyber intruders, criminals,and
other hostile actors in cyberspace with the same freedom of maneuver (and speed) these
adversaries enjoy. Achieving this goal will require a sustained, long-term effort. New authorities
will be required, along with substantial revisions to the U.S. Code (a daunting challenge). Public
debate will be lively. Indeed, I have long argued that public debate is a critical
first step:
Government intrusion into private affairs, even for reasons of the common defense, evokes an
emotional response. . . . A first step requires an honest, public debate [that] calls into question the
very firewalls between public and
private sectors that are intrinsic to democracy.Furthermore, what is needed is a discussion of
how to best balance the need for security and privacy. There are many ways to facilitate this kind

5. of discussion, and the proposal put forth by Full Committee Chairman Michael McCaul and
Senator Mark Warner is one way to move forward, though there could be others. It is fair say
that today’s debate about whether device makers should be required to build “backdoors” into
operating systems so law enforcement and intelligence agencies can collect data has jumpstarted
this much-needed discussion. This is a good thing. In the short term, the next steps are
multipronged. Congress needs to continue to develop strong, smart policies and laws designed to
improve cybersecurity—laws like the Cybersecurity
Information Sharing Act of 2015. Although there is an immediate need for such policies and
laws,Congress would be well advised to incrementally design these policies and laws, and
communicate them to the public, to earn the public’s confidence in the government’s ability and
intentions. Specifically, the public must be convinced that the government’s information needs
are balanced with individuals’ desire for privacy. At present, many ideas for, and approaches to,
using
technology to improve cybersecurity—such as pooling and mining vast stores of data—alarm
those who believe in a right to privacy from government intrusion. There is no simple solution to
the threat posed by adversaries in cyberspace. However, one critical challenge that must be
overcome—soon—is determining how to protect the cybersecurity of a democratic society that
demands both freedom and privacy in its use of computer systems
and networks from the threat posed by enemies who respect no boundaries and can act largely
with impunity, despite national and international norms and legal frameworks.