Beyond the Horde: The Uptick in Targeted Attacks (And How to Fight Back)

In the TV series The Walking Dead, zombies move with no clear direction, searching for food, and looking for their next victim. When the zombies find a point of vulnerability, they lock in on it and attack. Over the past two years, malware — including WannaCry and NotPetya — have invaded vulnerable targets in a similar way, scanning the Internet to find weak spots and causing considerable damage.

Beyond these somewhat random attacks, we're also seeing a dramatic rise in targeted attacks on large organizations. The first quarter of 2019 saw a 195% increase in the number of ransomware attacks compared with the last quarter of 2018, and up to the time of writing this, the year has seen an increase of 500%. In other words, malware attacks now tend to operate less in a manner of "horde waves" and more as a targeted process, with advanced tools that can cause massive damage.

Information security managers are on alert, as too often attacks happen without any warning and can affect the organization quickly, leaving the security team with an urgent need to resolve problems that can expand and worsen by the second.

Unfortunately, the possibility of receiving real-time intelligence and indications of compromise (IoCs) during a direct point attack is slight to nonexistent. Information security platforms must now include real-time capabilities, including advanced robotic patch processes, artificial intelligence, and quick incidence response to new threats. These are the basis of the steps suggested below. I believe there are other solutions, but this protocol has been applied in practice and proven to be effective.

Back to Basics
Those who are responsible for cybersecurity must build a robust security patch process that can be implemented rapidly. Along with standard processes, we need an outbreak patch process that will allow organizations to react fast to critical vulnerability. This is no easy task for large enterprises, which have complicated enterprise resource planning systems and OT environments.

When we can't react quickly or when the cycle of patch updates is long, we must develop compensatory controls that will help manage the exposure to risk. These controls must be tested to ensure their effectiveness.

Though this patch management effort may be regarded as complicated and Sisyphean — perhaps even as archaic and dated — when such endeavors are operated correctly, many organizations see success with them.

Real-Time Governance
In addition to the robust array of updates and compensatory controls, we must develop the ability to understand the exposure associated with specific vulnerabilities in real time or near real time. To support this task, organizations can build a governance platform that will scan networks and devices on a regular basis, along with maintaining a data lake that can run an analytic search for potential and real-time threats that have shown up.

Intelligence and Immediate Actions
Prior knowledge of intentional targeted attacks is almost nonexistent; nevertheless, there is quite a lot of information about recent known attacks throughout the network, when there is an IOC accessible.

Using the services of intelligence companies is mandatory, and we are obligated to gather information on every lead of an attack/new vulnerability, analyze its features and look for defense methods that will suit the revealed exposure. Closing and tightening a gap will not always be a technological option; therefore, enforcing an intermediate policy is needed to reduce time gaps that can lead to fast-spreading viruses and other attacks. 

"Special Forces" Team
Enterprises need a solid protocol for responding to threats that goes beyond the IT department and enlists the support of business units throughout the organization. During the early 1970s, during the Cold War, the White House held daily morning meetings with authorized officials in order to conclude whether or not the Russians would attack. Having daily briefings — or as needed — is as relevant today, when we are armed with exponentially more information, as it was over 50 years ago.

Daily risk analysis works best when the organization creates a special task force. Decision support systems should be embraced daily by this team and should include skilled functionaries from the different IT units and representatives from key business units whose data may be at the most risk of attack. By meeting daily (or ad hoc because of a new possible threat) and reviewing intelligence information alerts, these mission-critical teams can gather intel, analyze, and apply control tools to map and assess different risks. Once data analysis is established, the team should apply a solution/actions and follow up protocols through the different IT units and business units.

Cyber war is not a cold war. It is made up of continued threats, and it's an extremely dynamic 24/7 challenge. As such, there is no replacement for teams, tools, and constant, daily vigilance.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Active Directory Security Tips for Your Poor, Neglected AD"