On January 4, 2017 CTO Vision published a blog post titled “Are you ready for a state-sponsored cyber attack?” In hindsight, the blog post should have been titled “Are you ready for state-sponsored zombie malware attacks?”
Zombie malware combines the most deadly aspects of malware and zombie computers into one horrible mess. Typically malware gets into a compute device via phishing or email attachment which limits the scale of the attack. In contrast, zombie malware autonomously hunts for vulnerable systems across LAN, WiFi and VPN connections. Once zombie malware finds a system to infect, it utilizes the new host to scan for other systems which can be anywhere on the globe.
Another key aspect of zombie malware is the lack of a control channel to manage its destructive path (unlike zombie computers used in DDoS attack). Subsequently zombie malware just destroys anything it can connect to. For example, the NotPetya started on Ukraine government systems but then quickly spread around the globe.
Given the last three zombie malware attacks were outside the USA on older Windows XP systems one might be led to believe the American companies are safe. Unfortunately the combination of global supply chains and BYOD make American companies highly vulnerable to zombie malware. More important, the posting of CIA’s Vault 7 files on Wikileaks was designed to escalate the number of zombie malware attacks by broadcasting vulnerability information to cyber combatants. In short, America’s enemies are attempting to launch a zombie apocalypse by increasing number and lethality of malware attacks.
Countermeasure against autonomously hunting malware (or how to stop zombie apocalypse)
Building on the five countermeasures from the original January 2017 blog post, here some additional items you should be implementing to avoid the zombie apocalypse.
Deploy endpoint protection. There is a new generation of endpoint protection systems that is not reliant on signatures (and thanks to the Wikileaks the new attacks won’t have any). While you can’t do anything about BYOD or supply chain partners devices, at least the devices that manage your critical assets will be safe.
Lock down LAN, WiFi and VPN networks. A key feature of zombie malware is its lateral movement capability that allows it to autonomously traverse LAN, WiFi and VPN networks. Enabling “port isolation” which is a standard features on enterprise switches is recommended. Additionally VPN connections should be filtered so that only authorized applications can utilize them.
Limit access privileges. If you allow a user access to everything, any zombie malware on their device will also get to everything. Implement role-based access control on your data center and cloud systems. Ensure you have solid east-west partitioning in place.
Allow only application layer access. Only authorized applications from a user’s device should have access to network and application resources. Consider moving away from the older network access VPN model to newer application layer access solutions like software defined perimeter.
Backup data to offline stores. Backing up to the cloud is easy and inexpensive. But as more American assets migrate to the cloud, the bigger the target it becomes for a malware attack. You must have an offline data backup so that you can re-start your organization if there’s a catastrophic failure. And hopefully you’ve remembered to store away a few servers and laptops to do this.
Winter is here.
More on related topics:
- Enterprise Security and Functionality Benefits of the new Software Defined Perimeter (SDP) Approach
- White House Takes Action Against Chinese Intellectual Property Theft
- Board of Advisors vs. Board of Directors
