Low Tech Threats: Protecting the People Side of Security · 2019. 4. 22. · BetaBot: Powersystems...

transcript

Low Tech Threats:Protecting the People Side of SecurityRyan KalemberMarch 16 2019

Attacks increasingly target people, not infrastructure

$12.5B+

78,617incidents worldwide

direct losses worldwide(Oct 2013 – May 2018)

Source: FBI.

99%+Rely on user to run

malicious code

300%+Increase in corporate credential phishing

(Q2 to Q3 2018)Source: Proofpoint Threat Data.

EMAIL FRAUD IS ABOARD-LEVEL ISSUE FOR ALL INDUSTRIES

INFRASTRUCTURE SHIFTS CREATE NEW

THREAT VECTORS, DATA EXPOSURE

THREATS USE SOCIAL ENGINEERING, NOT VULNERABILITIES

Source: Proofpoint Threat Data.

Orgs exposed to targeted attacks63%Orgs detected

successful breach37%

Account takeover is a growing problem

It’s all about the credential!

And it doesn’t work if the target doesn’t click (or

you block it)

What About the Lowest Tech Threat of All?

What Attacker Innovation Looks Like

IT STARTS WITH AN EMAIL.WHICH CONTAINS A PDF.THE PDF HAS A LINK.WHICH POINTS TO SHAREPOINT.THE SHAREPOINT HOSTS A PDF.AND THAT PDF HAS A LINK.AND IF YOU CLICK THAT LINK...YOU GET PHISHED.

STAY AHEAD OF THE THREAT ACTORS

Defenders don’t focus on people, attackers do

Attack VectorsIT Security Spending

Source: 2018 Verizon DBIRSource: Gartner (2017 forecast)

Network62%

Endpoint18%

Email 8%

Web 12%

93%all breaches are attacks

targeting people, 96% via email

Defensive strategy needs to rival attacker tactics

LEGACY APPROACH CURRENT ATTACKER TACTICS

Protect channels, devices, data Target people, across all channels

Assessing the Human Attack Surface:Who are your VAPs?

Attack

Vulnerability Privilege

Access to Valuable Data

Work in High Risk Ways

Targeted by Threats

Receive highly targeted, very sophisticated, or

high volumes of attacks

Clicks on malicious content, fails awareness training, or uses risky devices or cloud

services

Can access or manage critical systems or

sensitive data

Not All Threats Are Created Equal: Scoring via Indexes

#1 Target: public-facing shared mailbox for aerospace heat exchanger BUActor: TA470/Subaat/Gorgon GroupTargeting: broad (hundreds in campaign)Payload: drops RAT or stealerScore: 960/1000

Sophistication

Volume

Type of attack

• Variable weighted composite score• Trended over time• Comparable across users, groups

and organizations

Targeting

ATTACK INDEX

Focusing on the 10X User Risk

PEOPLE-CENTRIC ATTACK VECTORS: INITIAL COMPROMISE

External Email

Cloud Accounts

Internal Email

Personal Webmail

Delayed action URLs

Malware

PhishSpoofing/BEC

Targeted passwordattacks

MalwarePhish

Attack Index

BetaBot: Powersystemscampaign61 targeted organizations, known actorFake order lureDrops stealer

Lure: “Interested in your product”45 targeted organizationsDrops keylogger

Lure: “Metal quote”10 targeted organizationsDrops stealer

PEOPLE-CENTRIC CONTROLS: POST-COMPROMISE

PEOPLE-CENTRIC CONTROLS: ECOSYSTEM

External Email

Internal Email

Cloud Accounts

Web Browsing

IdentityDeception

Exfiltrate data

Exfiltrate dataMove laterally

Exfiltrate dataEstablish persistence

Upload malwareBECData loss

MalwarePhish

SocialEmail fraudLookalike

domains

Key VAP:Pre-sales engineer in vibration sensor BU

Example campaign:7 targeted organizationsUnknown actorFake RFP/RFQ lureHost in DropboxDrops RAT

PEOPLE-CENTRIC CONTROLS: POST-COMPROMISE

PEOPLE-CENTRIC CONTROLS: ECOSYSTEM

External Email

Cloud Accounts

Internal Email

Personal Webmail

External Email

Internal Email

Cloud Accounts

Web Browsing

IdentityDeception

Delayed action URLs

Malware

PhishSpoofing/BEC

Brute force attacks

MalwarePhish

Exfiltrate data

Exfiltrate dataMove laterally

Exfiltrate dataEstablish persistence

Upload malwareBECData loss

MalwarePhish

SocialEmail fraudLookalike

domains

Scaling People-Centric with AD/Privilege

The Attacker’s POV

Monica HallCustomer Service Mgr127 connections

mhall@car.co

Jack BarkerExecutive at Car Co500+ connections

jbarker@car.co

Richard Hendricks • 3rd

Senior System Admin

rhendricks@car.co

Laurie Bream • 2nd

Financial Analyst500+ connections

lbream@car.co

The VIP VAP Clickers The One with Access The IT Insider

Persona Example: Executives (the VIP VAP)

Jack BarkerDeputy Secretary at Agency500+ connections

jbarker@agency.gov

VAP ScoresVULNERABILITY

MEDIUM HIGHPhish sim result: no actionRisky device / network use: yesMFA: inconsistent

ATTACK

Max threat: 850 (top 5%)Attack Index: 9,143 (top 10%)

HIGHPRIVILEGE

VIP: yesSensitive data: yes, email and CASB DLP data

Adaptive Controls

+ Training Control

+ Access Control

+ Threat Control

Cloud: steps up authentication

Email: Circle of Trust classifier

Training: data protection

Persona Example: Support ClickersVAP Scores

VULNERABILITY

HIGH LOWPhish sim result: clicks everythingRisky device / network use: yesMFA: partial

ATTACK

Max threat: 350(bottom 50%)Attack Index: 5,120 (bottom 50%), high with aliases

MEDIUMPRIVILEGE

VIP: noSensitive data: yes, PII

Adaptive Controls

+ Information Control

+ Access Control

+ Threat Control

Cloud: examine logins/user agent for risk factors

Email/network: Isolation for shared mailboxes

Cloud: restrict high volume downloads

Monica HallSupport Manager127 connections

mhall@agency.gov

Persona ExampleVAP Scores

VULNERABILITY

MEDIUM MEDIUMThreatSim result: no actionRisky device / network use: yesMFA: PAM

ATTACK

Max threat: 930(top 1%)Attack Index: 1,830 (top 20%)

HIGHPRIVILEGE

VIP : noSensitive data: yes, email and CASB DLP violations

Adaptive Controls

+ Access Control

+ Threat Control

Auth: integrate with SAML gateway to step up

Email/network: Isolate inbound URLs/webmail

Training: anti-phishing training based on APT lure

Laurie Bream • 2nd

Policy Analyst500+ connections

lbream@agency.gov

Persona Example: The IT InsiderVAP Scores

VULNERABILITY

MEDIUM MEDIUMThreatSim result: no actionRisky device / network use: noMFA: PAM

ATTACK

Max threat: 150(top 40%)30 day total: 465 (top 50%)

HIGHPRIVILEGE

VIP in TAP: noSensitive data: yes, email and CASB DLP violations

Adaptive Controls

+ Access Control

+ Threat Control

PIM: integrate with PIM in case of clicks

Protection: IMD for internal email

CASB: restrict high volume d/l

Richard Hendricks • 3rd

Senior System Administrator

rhendricks@agency.gov

PEOPLE-CENTRIC ATTACK VECTORS: POST-COMPROMISE

PEOPLE-CENTRIC ATTACK VECTORS: ECOSYSTEM

External Email

Cloud Accounts

Internal Email

Personal Webmail

External Email

Internal Email

Cloud Accounts

Web Browsing

IdentityDeception

GatewayEmail sandboxing

Phish response automationInternal MailScanning

Cloud Account Defense

Isolation

Encryption

Internal Mail Scanning

Web IsolationDigital Risk

DMARC, Email FraudDetection

Protection across the key people-centric

threat vectors

Minimize the damage from compromises that

do occur

Stop people-centric attacks across the broader ecosystem

Make users more resilient against threats

Proofpoint overview

The leader in protecting people from advanced threats and compliance risk

19 consecutive years of MQ leadership across:

The most trusted partner to protect the

#1 threat vector

Fortune1000

Fortune100

Seamless integration with other next

gen leaderscybersecurity

company

Email protection

Information protection

Awareness training

50,000+ global organizations

#1fastest growing public

cybersecurity company for 3 years

The only one focused on

protecting people

Low Tech Threats: Protecting the People Side of Security · 2019. 4. 22. · BetaBot: Powersystems...

Documents