Cloud Hosting

The recent hack of the high-profile internet-security firm FireEye included the theft of powerful hacking tools and has required a concentrated effort by European government services to mitigate damage, according to security officials in Brussels and the Baltics who specialize in counterintelligence operations.

First announced in a blog post by FireEye CEO Kevin Mandia, the hack was described as very sophisticated and was quickly blamed on Russia by US officials briefing journalists in the US.

Two European intelligence officials one who specializes in countering Russian intelligence operations in the Baltics, the other a military-intelligence officer assigned to NATO headquarters told Insider the US had determined Russia was behind the hack and had briefed US allies in Europe before Tuesday's announcement. Neither source would confirm when the first briefing took place because such information could be of value to the hackers, but both said the operation was impressive.

"Frustratingly well done," the official in Brussels said. "Targeted the very tools used to protect sites from their attacks. And stealing them from a firm considered among the very best at stopping attacks just adds to it."

Mandia's blog post described some of the tools apparently captured by Russian government hackers as designed for testing website security by impersonating attacks.

"Useful stuff to the GRU and FSB or just about anyone really," the official at NATO said.

Both officials said fast action on the part of the US and FireEye had helped mitigate at least some of the negative effects of the leak.

"The response has included patches, updates, and notes it was fast, honest, and clear, as far as these things tend to go," the Baltic official said. "I believe the immediate threat of someone using these tools on highly controlled websites has been mostly mitigated."

The longer-term dangers, the officials said, are concerns that even after the most secure government and technology sites are protected by patches, the stolen tools will pose threats to less secure sites and organizations for much longer.

"Over time these tools can get into the hands of less professional hackers who will direct them at much less secure sites," the NATO official said. "And this will be a drain on resources, but it does seem like all the software solutions to try and prevent this should help. It remains to be seen how this threat will evolve."

In many ways, the Baltic official said, the biggest win for the Russian hackers would be having had access to the files of their enemies, which would provide a benefit long after the stolen software tools were patched into irrelevance.

"The real loss here other than brutal embarrassment is the value the Russian hackers gained by seeing inside the best tools used to counter them," the official said. "Software can be patched, but knowledge cannot."

Read the original here:
Russia got access to the files of its enemies in the FireEye hack - Business Insider - Business Insider

Kazakh authorities have launched a new online security initiative, which many fear is an attempt to ramp up control over the internet ahead of next months parliamentary elections.

On Monday the Ministry of Digital Development, Innovation and Aerospace Industry announced a drive to combat cyber attacks within the country, titled Cyber Security Nur Sultan-2020. According to official statistics, attempted online breaches have almost tripled over the past year, owing to the shift to remote work caused by the coronavirus pandemic.

During the period of cyber training, various problems may arise with access to some foreign internet resources, which can be eliminated by installing a security certificate, read a statement by the ministry.

Most major websites use security certificates to prove their authenticity and create secure connections to a server when accessed through a browser. These certificates are generally approved by trusted authorities and protect users against what are known as man-in-the-middle cyber attacks.

In Kazakhstans case, the certificate authority becomes the state itself, meaning that the government controls what stands between an internet user and the services they can access. After installation, the certificate is also capable of redirecting users to other websites or reading information exchanged between them and the sites they are visiting.

Why it matters: The human rights risk here is that you are allowing the government in this case, to be candid, an authoritarian repressive government, eager to stifle dissent to have access to the things you do on websites, which you often use to relay sensitive information, said Noah Buyon, a Freedom House research associate specializing in digital rights in Eurasia.

Subscribe to Oligarchy

Sign up for our newsletter on money and power during the pandemic

Arshyn Taizhanov, a web developer and co-founder of the group Internet Freedom Kazakhstan, added that many in the country oppose the certificate. Some also believe that it has been introduced before parliamentary elections, scheduled for January 10, to increase control over internet usage and place pressure on opposition activists.

Buyon said that he considered the move to be a power play designed to send the message that the government has the capability to interfere with peoples right to access independent information.

The bigger picture: Its not the first time Kazakh authorities have tried something like this. The ministry launched a similar security certificate last summer, but major tech companies that produce browsers, including Google, Apple and Mozilla, blocked it. Shortly after, the certificate was retracted.

Kazakhstan scores 32 out of 100 and is classified as not free in Freedom Houses 2020 Freedom on the Net report. Buyon says the situation has worsened since large-scale anti-government protests last summer, which were met with internet shutdowns and the prosecution of activists under extremism charges.

The rollout of the national security certificate is part of this counter reaction, Buyon said. I think its going to be critical to look out for the reaction of tech companies here, because they really were the heroes of last summers saga. And they do have a power, in this sort of narrow line of attack that the government is launching, to make a positive difference.

Continue reading here:
Kazakhstan ramps up control of the internet ahead of elections - Coda Story

Cyberconflict is an unfortunate growing trend impacting businesses and governments. Learn the risks and possible solutions from an industry expert.

Image: iStock/Infadel

Recently, I found out the hard way that cyberattacks aren't relegated merely to high-profile businesses nor engaged in by shadowy foreign agents. They can happen right here in your town.

SEE:Zero trust security: A cheat sheet (free PDF)(TechRepublic)

That's what happened to my teenagers' school system at a town in Massachusetts when someone engaged in a distributed denial of service (DDoS) attack against the Wi-Fi network. It was so crippling and pervasive that the school system had to bring in cybersecurity experts to resolve the problem.

The consensus seemed to be that the attacker had an agenda to thwart the virtual learning the students were engaged in and apparently force all the kids back to school full time for whatever reason.

This criminal activity did not succeed, fortunately, and was brought to a halt without identifying the perpetrator(s), but it got me thinking about the concept of weaponizing cybersecurity in this manner to generate conflict.

I spoke with Michael Schenck, director of Security Services at Kaytuso, a cybersecurity service provider about the concept, and he told me about the term "cyberconflict."

Scott Matteson: What is cyberconflict?

Michael Schenck: [Cyberconflict is] cyberattacks that have a background in international relations or bring about consequences that can escalate to a political and diplomatic level.

Cyberattacks on trust are more worrying than those intended to produce physical effects. Attackers find it easier, and perhaps more effective, to weaken the bonds of military alliance rather than go after fighter jets, or corrupt financial data rather than destroy banks' computers.

Cyberattacks on trust and integrity have a much lower threshold, are harder to detect and deter, and can cascade through interconnected systems.

SEE: Social engineering: A cheat sheet for business professionals (free PDF) (TechRepublic)

Scott Matteson: When does cyberconflict escalate?

Michael Schenck:Cyberconflict is more likely to arise for political, social, and economic reasons, rather than to physically destroy infrastructure. It's more of a risk during significant political moments, such as voting times/elections.

Impulsive action, confused decision-making, or any crossed signals can trigger unanticipated and unwanted cyberattack escalations.

For example, cyberconflict escalated when the US killed Iran's Qassem Soleimani in early January. The week following Soleimani's death, there were around35 organizations attacked by cyber offensives "specifically traced" to Iran's state-sponsored hacking groups. Around 17% of those targets were in the US.

Scott Matteson: How does it affect consumers and businesses?

Michael Schenck:Cyberconflict creates greater risk for corporate information and financial information to be stolen, as well as theft of money and disruption of trading stocks. The biggest things companies worry about is the damage to their reputation if this happens and the loss of trust their customers would have with them.

There are a lot oflegal consequences businesses can face from this, too (such as fines and regulatory sanctions).

When Iran/US tensions were high, there were genuine concerns that a state-sponsored attack might be mounted against critical infrastructure (energy, transportation, finance) but also that a raft of commercial organizations in the US would see concerted attacks on data and systems, to steal or destroy.

With the elevation of these tensions, businesses and consumers need to prepare for cyber disruptions, suspicious emails, and network delays. This can come in any form of a digital attempt to access private information (from individuals, companies, and government agencies).

In January 2020, Texas Gov. Greg Abbott said state agencies had seen10,000 attempted attacks from Iran per minute in the span of 48 hours.

Scott Matteson: What should companies be doing differently to protect against cyberconflict?

Michael Schenck:If your company doesn't already have a CISO, hire a firm that offers virtual CISO (vCISO) services. This is a high-level consultant that can speak to stakeholders about the real risk to your business. They also can advise on where you currently stand on cybersecurity and where you should be. Beyond that, I can't speak to what companies should be doing differently, as some already may be following a standard of best practices provided by NIST, ISO, GIAC, or the Center for Internet Security.

Some other things I recommend that most companies we've worked with don't have is a security information and events management (SIEM) or network threat monitoring such as Cisco Talos intelligence-based network threat detection (like the Meraki advanced security license), Cisco Firepower for ASA firewalls, or Palo Alto SourceFire for next-gen firewalls. Larger companies may also be interested in solutions from FireEye.

Another big area that seems to be lacking is effective business continuity planning and response procedures. Just take a look at what's happening globally right now without a cyber event due to COVID-19. Companies need to ask themselves what would happen if key infrastructure like power or internet was disrupted? Are your vendors and service providers addressing those concerns as well? CISOs, vCISOs, and cyber teams should constantly be thinking through their plans and response procedures for cyberattacks.

SEE: Disaster recovery and business continuity plan (TechRepublic Premium)

Scott Matteson: Are there any measures that should be taken right after a political, social, or economic incident (e.g. temporarily increase logging detail)?

Michael Schenck:Vigilance should certainly be higher before planned political events (scheduled protests, elections, etc.). The best thing to do is remind everyone to exercise reasonable doubt with what they see online or receive in their email. If you have a network threat detection service, you should verify with your account representative or service provider that they are keeping up with real-time intelligence. The same goes for SIEM appliances or managed detection and response service providers.

Scott Matteson: Who are some of the key players in this space, both from a "good" and "bad" perspective?

Michael Schenck:I previously mentioned some of the key enterprise vendors with solutions that help protect against cyberconflict (Cisco, Palo Alto SourceFire, Fireye, etc.). The "good guys" are also the usual suspectsWestern intelligence and security services like the FBI. There are also big IT companies that show a focus on security including Microsoft, ESET, Cylance, Cisco, and FireEye.

As for the "bad guys," state-sponsored hackers from Russia, Iran, China, Syria, and North Korea are key players. State-sponsored hackers demonstrate the extent to which nation-states continue to leverage cyberattacks as a tool to gain intelligence or influence geopolitics. In 2019, Microsoft notified close to 10,000 people that they had been targeted by state-sponsored hackers. In many of these cases, victims were either targeted or compromised by hackers working for a foreign government.

Freelance hacktivists are also key players in this space from a "bad" perspective. Motivated by civil disobedience, hacktivists seek to spread ideologies and create total anarchy. They typically see themselves as vigilantes who use hacking to enact social justice and policy changes, but they employ the same malicious tools and tactics as typical hackers.

Scott Matteson: What are the most prevalent types of threats and activities?

SEE: Identity theft protection policy (TechRepublic Premium)

Michael Scheck: The biggest risk is people. Whether it be intentional or accidental, the insider is the biggest threat because we have to give some trust to our workforce. The threat remains similar to what we've seen over the yearsemails with malicious attachments or links. At Kaytuso, we've actually seen a significant uptick in malware being spread by email via attachment. The hackers writing these viruses are getting better at hiding from scanners. Some of these techniques include not doing anything if the malware believes it's running in a sandboxa virtual machine that executes and opens the attachments to see if it identifies anything malicious. This means that there's greater success in the distribution of malware. With the technology that's preventing and blocking malware being less than perfect, people are the biggest risk for clicking on that link or opening an attachment.

Scott Matteson: How should governments work together in order to prevent or curtail cyberconflict?

Michael Schenck:That's the tricky question, especially when talking about international politics and security. In that scope, it is always double-edged. Protection improvements can also make intelligence efforts more difficult, making it harder to protect against tomorrow's attacks. The best method here would be for more transparency from the government and revealing flaws to security vendors sooner. For example, if Microsoft had been informed about the EternalBlue vulnerability sooner, they would have been able to patch it even earlier and limit the damage from the ransomware attacks in 2017.

Scott Matteson: What are some subjective examples of cyberconflict attacks?

We've seen some examples over the years including schools and cities being locked out of their systems. There have been reports that Stuxnet and Flame malware were products of Western intelligence. Another example stems from Russia and their ongoing cyberwarfare against the US.

From a commercial business standpoint, hacktivism is a prime example of cyberconflict. I briefly mentioned hacktivism before, but it's a mix of hacking and activism, where foreign hackers are using the internet to push political agendas or social change. Economic espionage is also very real. Hackers target the theft of critical economic intelligence such as trade secrets and intellectual property in a number of areas (technology, finance, government policy).

Scott Matteson: What was the impact/result?

Michael Scheck: The result of these types of cyberconflict attacks has been increased geopolitical tensions, millions in losses, theft of sensitive intellectual property, and physical damage to industrial equipment.

Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays

Read this article:
Cyberconflict: How it can reach beyond government systems, and how to protect your business - TechRepublic

ThreatConnect released ThreatConnect Risk Quantifier 5.0 (RQ 5.0), continuing its innovation in the emerging field of cyber risk quantification.

ThreatConnect Risk Quantifier (RQ formerly Nehemiah Risk Quantifier) enables the identification of the risks that matter most to the organization by quantifying them based on potential financial and operational impact, unifying security and the business to a common goal.

This quantification relies on generally accepted risk models such as the popular Factor Analysis of Information Risk (FAIR) model, among others. It is also established in part by, and continuously informed by, your internal environment, threat intelligence, vulnerability management, operations and response data found within ThreatConnect and other integrations.

RQ is distinctly different from other approaches offered in the market as it focuses on automation and data integration, and delivers value in days and weeks as opposed to months and years.

Companies cannot effectively prioritize vulnerabilities by leveraging risk scores alone. Effective prioritization requires an understanding of the impact an unmitigated vulnerability could have to the business.

By quantifying risk, based on possible losses from business interruption and response, vulnerability exposure can be directly linked to the business services that are affected.

With RQ 5.0, security professionals for the first time have a way to understand the potential financial risk that Common Vulnerabilities and Exposures (CVEs) introduce to an organization and prioritize those CVEs that could lead to the greatest financial loss if an attacker succeeds.

RQ 5.0 takes into account existing technical scoring methods, including CVSS Scores, and uses that data as a weighting for the financial impact.

This is an important capability that businesses have been demanding and that other vendors cannot address, said ThreatConnect Vice President of Cyber Risk Strategy Gerald Caponera.

Now, through integration with your vulnerability management software, we are able to help organizations handle the flood of CVEs they get every day and prioritize them based on the quantified financial risk each introduces to the specific business ultimately bringing relevancy and focus to the security team.

RQ 5.0 also introduces support for multiple security control frameworks, including the NIST Cybersecurity Framework and the Center for Internet Security Controls. Now customers can have their prioritized recommendations based on the framework of their choice.

Businesses also need a way to identify gaps in their program and the risk those gaps represent to the organization, Caponera said. With RQ 5.0 they can show the business solid numbers that support a prioritized list of recommendations based on the framework of their choice and their organizations tolerance for financial risk by application.

Another new feature of RQ 5.0 includes a powerful what-if impact analysis tool that allows security leaders to model changes to application security control levels in a sandbox environment.

Running the models enables security leaders to communicate to the C-Suite how increasing investment in security controls can lower the annualized loss expectancy stemming from the organizations highest priority risks.

Using a risk-led approach to cybersecurity makes prioritization easy for security teams, enabling them to filter out noise and focus on what matters most. With CRQ, TIP and SOAR capabilities combined, ThreatConnect unifies the actions of the security team around the most critical risks, supports their response with streamlined and automated workflows and strengthens the entire security ecosystem through powerful technology integrations.

Read more from the original source:
ThreatConnect Risk Quantifier 5.0: Continuing innovation in the field of cyber risk quantification - Help Net Security