Invincea

Editor’s note: As an advisor to Invincea I closely track not only their capabilities but the context they provide the community. Anup Ghosh, CEO of Invincea published well reasoned context on the Sony Hack at the Invincea blog, it is reposted below for your consideration. – bg

UPDATED: on 12/19/14, the FBI officially declared North Korea to be the aggressor behind the Sony Pictures Entertainment hack. The evidence published is circumstantial and probably would not stand up to scrutiny in a court of law. However, we do not know what other out-of-band information, such as SIGINT, HUMINT, and intelligence from other nations’ intelligence agencies may have played into this determination. We do know it is highly unusual to conclusively determine attribution of an attack, especially this soon after the attack has occurred. A good treatment on this topic is covered in this KrebsOnSecurity post.

Let’s be honest. As wild as this year has been in InfoSec, none of us, and I mean nobody, anticipated the events that unfolded this week with the Sony hack:

• A major studio cancels a theatrical release with big time Hollywood actors because hackers threatened violence in movie theaters.
• The White House declares it’s a national security issue and leaks intelligence that North Korea is behind the attack.
• An attack that began as an extortion attempt against Sony for money becomes an international incident, where now the White House and Congress are talking about “proportional responses”.

Really? It sounds like a Hollywood script, a movie in a movie type movie.

As this was still unfolding, I was asked to appear on Fox Business with Maria Bartiromo on 12/17/14 — prior to Sony canceling the theatrical release and prior to the White House declaring it was North Korea on background — to comment on Cyber Terrorism aspects of this. For what it’s worth, I don’t think this rises to the level of cyber terrorism.

 See the interview here:

Tactics Not Malware Are the Story

The #SonyHack was not a run-of-the-mill corporate hack, like we see every week in just about every sector. Most corporate hacks we see are focused on either customer data (credit cards, medical records, social security numbers, passwords, bank account information, email addresses) or company proprietary documents. The former for fraud, the latter for corporate espionage.

The #SonyHack was that unusual bird, a black swan if you will, that was designed to destroy the Sony brand via name & shame tactics. Tactics that played brilliantly to the media, an industry that is all too eager to publish salacious details, no matter how inappropriate, to draw eye balls.

The #SonyHack is the equivalent of detonating a nuclear bomb on a network that employed four key stratagems: capture, destroy, extort, and publish. The hackers captured and exfiltrated hundreds of terabytes of data then torched the network with wiper malware. After extorting Sony, they leaked pre-release movies, published sensitive files and then corporate email. This is HBGary (name & shame) meets CryptoLocker (extortion) meets Edward Snowden (publish through leaks and media sensation) meets Shamoon/DarkSeoul (destroy infrastructure).

This is not to say the exploits or the malware were sophisticated — they are not. The software and components employed are readily available. No zero-days are known to have been used, no animals harmed in this production. However, the tactics employed — capture, destroy, extort, publish — combined with a savvy campaign to name & shame Sony executives, while lathering the media into a frenzy over salacious details, public extortion, leaked movies, an ever changing agenda and demands, threats of violence invoking 9/11, shows a mastery of American psyche and media while creating utter chaos for crisis management.

The story that will be told about the #SonyHack — and surely there is a Hollywood script being written as we speak — will be one of a savvy band of hackivists likely with insider help executing a well thought out plan hell bent on destroying a great consumer electronics brand.

Game Change

In a field that is still in its infancy — Information Security — the #SonyHack I believe will emerge as a Game Change moment. A defining moment that causes significant change in behavior. The last major ones we had were the Mandiant APT1 report in Feb 2013 and the RSA Security keys compromise in 2011 before that, both of which caused companies to stand up and notice something called APTs and introduced nation-state sponsored cyber espionage to many Board rooms.

You ask, why not Target, Home Depot, and the other big breaches of the past year? Not to diminish the significance of these events, but the reality is corporations, and now the public, are conditioned to loss of customer data. Customers typically do not experience the losses themselves. Corporations absorb losses beyond insurance coverage for fraud. The awareness rises, but not enough to cause companies to change established patterns of behavior: check the box compliance-driven security.

The #SonyHack is different — the Black Swan of attacks that may become the new norm. It is different because extortion is involved. It is different because the intent was to destroy the company, not just steal its sensitive data. It is different because the networks were torched. It is different because email was leaked and executives publicly humiliated, and because ultimately Sony capitulated. Capitulation will embolden hackers. And there is little doubt in my mind this same attack can be replicated over and over again at will against other companies because:

(1) most companies are not equipped to deal with targeted attacks, let alone {capture, destroy, extort, & publish} Sony-style attack tactics,

(2) the likelihood of being properly attributed and caught is slim, and

(3) the aggressors’ efforts worked and demands were met.

The impact will be far reaching beyond Sony. I expect at the first Board meeting of the New Year at every major corporation, the question will be asked “What are we doing to make sure we don’t become the next Sony?” I suspect that checking compliance boxes won’t answer the mail. I suspect that doing the same as we’ve always done will not suffice.

Rather, CISOs, Chief Risk Officers, and Chief Executive Officers will need to think outside the box about how to protect their company, and ultimately their shareholders’ value, from Sony-style attacks. This will involve a combination of getting better talent, better intel on threats, understanding the risk for their enterprise against targeted attacks, establishing processes for incident response and crisis management, and upgrading technology to meet the threat of targeted attack.

If you are a CISO, be prepared to answer the Board how you will need to upgrade to defeat Sony style attacks in 2015 and beyond. They will be all ears.

Anup Ghosh is founder and CEO at Invincea, Inc an Advanced Threat Protection company that provides protection from targeted attacks against enterprises including 0days, Web-based Drive-by aattacks Spear-Phishing and Watering Hole style attacks. Invincea has the largest global footprint of any endpoint security company in the Advanced Threat Protection space with over 35,000 organizations running our software. Named one of Top 5 Most Admired CEOs in Technology by the Washington Business Journal.

Related Posts:

Vulnerabilities In Almost Every Chip: “Could Something Like This Really happen?”

Sun Tzu: Strategy without tactics is the slowest route to victory. Tactics without strategy is the noise before defeat

Invincea: Advanced malware threat detection, breach prevention and forensic threat intelligence

Editor’s note: This post by Invincea CEO Anup Ghosh first appeared at LinkedIn. We knew this would be of interest to you and posted it here with the author’s permission.-bg

I’ll say it up front, your security program does not work because it is based on three common myths we hold as unquestionable truths in enterprise security:

Myth 1: We can patch our way to security

Myth 2: We can train our users to not do “stupid” things

Myth 3: We can defeat targeted attacks by sharing signatures.

Don’t act surprised. We are in a technology field that is hyper-accelerated not just by technology advancement, but by adversaries constantly shifting tactics. If you held these truths in the year 2010, it’s time to update not only your security program, but also your thinking.

If you already accept these as the myths they are, then you can stop reading now, or absorb them to dispel them with your enterprise security colleagues. If you hold these myths as truths, read on.

Myth 1: We can patch our way to security

Let’s face it — the foundation of every major enterprise security program begins and ends with patching. If you haven’t patched your software, then the conventional wisdom is you are negligent (by corporate governance, compliance, and reputationally) in your job. It makes such perfect sense: if you know you have a vulnerability and a patch exists, then patch it already. Better yet, it is the one security vulnerability and control we can measure: what percentage of vulnerabilities lie unpatched? Not only does it make it measurable — a rarity in security — but it also can be used in performance evaluations. These are the very reasons why patching is the foundation of many security programs, compliance regimes, and ridicule when your software lies unpatched.

So why can’t we patch our way to security? Start with this chart:

Notice that Java 1.7x remains 42% unpatched even with 145 vulnerabilities. That doesn’t even cover all the Java 1.5, 1.6 that is running in enterprises. Is it criminal negligence on the part of CISO and IT staffs that Java remains unpatched, especially given the vast majority of exploits are Java based? If you live outside the enterprise operations space, this seems ridiculous and negligent, especially since most software is auto-updating and it represents an obvious attack surface. In fact, the numbers 1, 3, 6, 7, and 8 top un-patched software programs also correspond to the top attack surfaces today on endpoints (not a coincidence of course). Clearly if we kept these programs patched, we would have much more secure enterprise networks.

Well it turns out, this is not a human behavior or motivation problem for enterprise IT. The reality of enterprise IT is these programs are not patched because application incompatibilities with legacy enterprise server apps forces enterprises to run unpatched older versions of software on the desktop. Java is the biggest culprit of this as so many back-office applications such as payroll, timesheets, finance, CRM and intranet applications were developed on versions of Java that are no longer current and incompatible with current versions.

Two take-aways:

1. Many applications in the enterprise space, including the most exploited ones, remain unpatched for enterprise IT application compatibility reasons. We cannot patch our way to security for this reason.
2. A security strategy based on patching software is inherently flawed. Enterprises must find ways of running unpatched software such as Java, Adobe plug-ins, Adobe Reader, and Internet Explorer while mitigating the risk of this attack surface. See isolation and containerization strategies to mitigate this risk.

Myth 2: We can train our users to not do “stupid” things

Most large enterprise security programs have Security Training for users. Many have posters on walls that show them what a phishing email looks like. Computer based training (CBTs) and CBT platforms and campaigns, and the cottage industry of spear-phish training, have emerged specifically to train and test users to recognize phishing campaigns.

The popularity of security training is predicated on the myth that we can teach users to make the Internet a safer place, if only they won’t be, well, humans. And since this is Cyber Security Awareness Month, this makes me the bearer of bad news for all the CSAM people who think focusing on security this month will make our networks, oh so much more secure. And better yet, victim blaming and shaming is all the rage in security and convenient to point the finger at the user. So rather than having to put in a security program that works, we can deflect by blaming the victim — users — for doing what comes natural — clicking on links and opening attachments — and in many cases is expected in their roles.

We cannot untrain millenia of human psychology evolutionary development to get humans to ignore fundamentals that phishing and spear-phishing campaigns appeal to:

• trust in other humans
• fear that not acting will result in something bad
• greed that by taking some action they will become richer or better
• desire that leads us to do things that fulfill us in, well, other ways.

Effective spear/phishing adversarial campaigns take advantage of these human emotions/frailties to get users to click on links and open attachments. In fact, as the chart below from Verizon Business data shows, the odds of getting a user to click on a link as part of a phishing campaign approaches 100% asymptotically as the number of emails (targeted users) reaches 17.

Two take-aways:

1. Users will click on links or an attachment. It is only a question of when. Phishing and spear-phishing campaigns are always successful for this reason. You are guaranteed a click or open with little marginal cost for each additional email sent.
2. A security strategy based on training users to not click on links or opening attachments will fail. You must find a security solution that accounts for the fact that users will click on links and open attachments, because they will. Strategies that defeat attacks regardless of what links a user clicks on address this problem.

Myth 3: We can defeat targeted attacks by sharing signatures.

The final myth that most large enterprise security people don’t want to hear today is that we can defeat targeted attacks by sharing signatures. I am a big advocate for sharing threat intelligence and full disclosure on the back of breaches. However, the myth to pierce is that sharing signatures of targeted attacks will defeat these attacks against organizations elsewhere.

Let’s face it, most of the public-private consortia is based on the notion of sharing attack signatures. The anti-virus industry was predicated on the notion that an attack signature taken from one victim can be used to protect the rest of the herd that has not yet been victimized by that attack. And these are very large consortia, public policy, and an industry predicated on this one myth: that by sharing attack signatures we can defeat an adversary elsewhere.

Unfortunately, this does not apply to targeted attacks — attacks specifically targeting an organization. When organizations are targeted, exploit toolkits are used to generate unique payloads that defeat anti-virus engines as well as network based signature scanning. Capturing the signature and sharing it among other institutions will only stop the laziest or most ignorant of attackers. The rest simply develop another unique payload rendering the shared signatures useless. This is why the security industry has moved to detection of compromise (post-breach) instead of prevention, because prevention-only approaches based on signatures no longer work.

However, all is not lost from sharing. Rather, what is shared is more important. Sharing tactics, techniques, and protocols (TTPs) is more important than sharing signatures. Sharing code can be equally useful — not just the signature. Sharing human intelligence about the adversary, if any is available and vetted, is valuable. Sharing network command and control can be useful, though this is diminishing with time as domains and exploit landing pages are becoming transient with half-lives measured in hours.

Two important take-aways:

1. Sharing signatures of attacks is not particularly useful in defeating targeted attacks. If you are in a sector (finance, defense, government, healthcare, manufacturing, technology, energy, critical infrastructure, among others) that is targeted, sharing signatures of attack is insufficient.
2. Building off of point 1 above, demand useful intelligence from public/private consortia, including TTPs, code, HUMINT, and adversarial command and control infrastructure. Better yet, demand or incentivize real-time intelligence from breach victims.

Share if you agree. Leave comments below if you don’t.

Anup Ghosh is founder and CEO at Invincea, Inc an Advanced Threat Protection company that provides protection from targeted attacks against enterprises including 0days, Web-based Drive-by aattacks Spear-Phishing and Watering Hole style attacks. Invincea has the largest global footprint of any endpoint security company in the Advanced Threat Protection space with over 35,000 organizations running our software. Named one of Top 5 Most Admired CEOs in Technology by the Washington Business Journal.

Related Posts:

Dispelling myths around AI within cyber security

Myths and realities of cloud security