Attackers Aren't Invincible & We Must Use That to Our Advantage

Sixth and final installment in a series about the human element in cybersecurity. 

As we close out this series, we look outside of organizations to explore the human weaknesses of attackers. Unlike previous articles, in which we looked introspectively at the defenders and how to reduce mistakes, this installment examines the other side of the equation and how we can use attacker mistakes to our advantage.

Attackers
Attackers are humans just like defenders and so are subject to the same errors and imperfections that we are. They can be single operators, members of a larger crime syndicate, nation-state actors, rogue organizations, or any one of a number of other "hackers." Their intent can be financial gain; retribution to an organization, individual, or employer; disruption or destruction; global dominance; or a variety of other motives. In this article, we use "attackers" to refer to the malware authors who develop the malware used in attacks, and the human hackers at the keyboard who utilize malware, social engineering, and other techniques to conduct cyberattacks on infrastructure, networks, applications, servers, data, and devices.

Common Mistakes
From the defender's perspective, one of the most advantageous mistakes that attackers make is writing a bug, error, or vulnerability into their code. Malware authors, who are programmers like the ones we discussed in our previous article, are not perfect. Prime examples of their imperfections include the "kill switch" found in early WannaCry ransomware malware and, more recently, exception handling errors in LockerGoga ransomware.

In addition, attackers often rely on the same or similar attacks. Attackers who are constrained by resources, time, or capabilities may turn to standard exploit kits and regularly use the same malware. Even when the malware files differ, segments of the malware code are often recycled and reused. Different malware files often point to the same infrastructure, such as the same command and control IP in multiple attacks. Moreover, even when entirely novel malware is used, attackers consistently use the same tactics, techniques, and procedures (TTPs).

Repercussions
When attackers make mistakes, they sometimes simply fail at achieving their desired goals of stealing, spying, exploitation, or disruption and are forced to spend more resources on a given attack. Furthermore, they provide a weakness that defenders can use to their advantage to better prevent, detect, and respond to attacks.

Maximize Mistakes
While our series has been focused on helping defenders understand how to minimize their mistakes, now we want to turn the tables and maximize attacker mistakes.

We can best capitalize on attacker mistakes of coding errors, malware, and TTP reuse and recycling by aggregating and sharing this threat intelligence. With the right data, defenders can build dossiers on threat actors, identify attacker motives and means, and then use this knowledge to limit attacker opportunity through threat modeling. While organizations can, and often do, develop their own threat intelligence, the fast and frequent exchange of threat intelligence among defenders amplifies the positive impact of this work.

For example, if an organization hit with an attack immediately shares that information with its peers, it can essentially help create a "cyber vaccine" that prevents other organizations from falling victim to the same attack. This can be particularly critical in cases of attacker coding errors because identifying these errors often requires malware analysis. Many organizations lack those advanced capabilities and must rely on more sophisticated teams for that analysis. Some security vendors have already begun to incorporate this exchange. When one customer sees a new attack, the associated threat intelligence is extracted and then incorporated into the product for the benefit of every customer.

Organizations can also encourage attacker mistakes and make the cost of an attack higher for the attacker by deploying advanced capabilities such as deception technologies and moving target defenses, which force the attacker to run in circles looking for the target and allow defenders to learn attacker TTPs in the process. Overall, by understanding attackers and their attack profiles, defenders can create an environment where attackers must invest more to make an attack successful.

Change the Paradigm
While society is beginning to understand that cybersecurity attacks are common and difficult to prevent, some organizations are still reluctant to reveal attack details out of fear that doing so would reflect poorly on the organization. As the subject matter experts on cybersecurity, we defenders have the responsibility to educate non-cybersecurity folks on the inevitability of attacks — and breaches — so that both are viewed as part of the cost of doing business in today's environment, and not weaknesses that were a result of someone dropping the ball. Organizations must be able to speak freely about attacks and incidents, without legal counsel restricting information-sharing out of concern that the data can and will be used against the organization in the future. With information sharing, we can collectively make the most out of attacker mistakes.

Conclusion
Cybersecurity is like an arms race. As we grow ever more dependent on technology and billions of interconnected devices, while generating an exponentially increasing volume of data (2.5 quintillion bytes of data at our current pace), we know that attackers will evolve and advance. Therefore, we defenders must evolve and advance as well. And we can make great strides toward doing so, toward getting better at our game and leveling the playing field, by recognizing and minimizing the inevitable human error of end users, security leaders, security analysts, IT security administrators, and programmers — and maximizing inescapable attacker error.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.