Q&A: How can Threat Intel Help Your Organization? (Part 2)

Cyber threat intelligence offers an in-depth look at the potential threats and attack vectors facing an organization. Each organization is different, and in these differences there are a variety of ways cybercriminals can exploit a company. Security tools such as firewalls and antivirus software protect against several of these threats, but they cannot protect an organization from everything. This is where cyber threat intelligence plays a crucial role.

Threat intel gives an organization the ability to identify threats, understand where any lapses in security have already occurred, and gives direction on how to proceed concerning these vulnerabilities. This is a lot of information for any organization to handle on their own, especially since the cyber landscape continues to change.

“The field is constantly growing and evolving; there is no shortage of cyber information, which means it can be very easy to get overwhelmed with it,” said Aaron Bay, chief analyst at SurfWatch Labs. “We sometimes forget to take a peek at what is going on with the rest of the world.”

Yesterday we talked with Bay about the role of the cyber threat analyst. Today we finish our conversation, and focus on how threat intelligence can help organizations.

Why does a company need to implement threat intelligence on top of their existing security?

Having security tools such as firewalls and antivirus software is critical; you have to have them. If you don’t have these tools, you are already at a disadvantage. These security tools are paramount, but the information derived from them can be overwhelming.  From what I have seen, a lot of time companies will simply buy these tools, plug them in and forget about them. From a threat analyst perspective, what we do when we give companies information about threats affecting their industry is show them the known mitigation of the threat. We can only lead the horse to water; we can’t make it drink. But if we can give organizations enough pertinent information where they are asking, “Does my defense actually protect us against this?” that goes a long way.

A lot of the time companies are putting up boundaries to stop threats from getting in, but they might not necessarily know when information gets out. They may be breached, and their information could have been compromised. They could also be attacked at a point they weren’t protecting such as point-of-sale systems. A bank has credit and debit cards, and the bank itself is usually pretty well protected against direct attacks. All of that can be defeated by a skimmer on an ATM. Knowing these attack vectors and knowing this is another way cybercriminals can get to your customers’ data can really help mitigate risks. If we as threat analysts are looking for these attack vectors and alternative methods, then we can help an organizations be better prepared and protected against threats.

Cyber threat intelligence is a relatively new avenue in cybersecurity. Are companies seeing value in this?

Cyber threat intelligence is still a growing field; it is definitely still evolving — as it should be. Threats are evolving, so this field that focuses on these threats is evolving as well. I think, for the most part, everybody is doing the best job that they can. It’s hard for a business to feel like they are getting a return on their investment from IT security in general. When you get that big win, when you catch something that no one else caught, either protecting some data or helping stop something before it became a big deal, then it is easy to see the value of it. For companies, as long as everything is working, the people who make decisions about IT and their infrastructure don’t necessarily want to know what goes into keeping everything running. They just want it to work. If everything is working, it is easy to not respond and spend money on keeping everything running. In their mind, everything is working. It appears that not much has to be done to keep things running, why would they spend more money on it?

How can companies providing cyber threat intelligence improve?

If there is a way to improve our field it is really just to work together as a community to make sure companies understand the value of cyber threat intelligence. I feel like we are doing a good job, but I feel that the industry isn’t ready for the message. These companies are being attacked left and right, and it feels like all we are doing is showing up and telling them they need to be doing security better. To actually translate everything that is going on, distill it and focus it on the company specifically is really the best approach. I am glad that SurfWatch Labs is going down this road. Showing companies why they need to care about this information that is being presented to them is very valuable.  

I also think that internally, for our customers, we sit between business operations and the IT department. We aren’t just supporting IT security or just enabling compliance with the various IT regulations a business must adhere to. A Cyber Threat Intel Analyst should be assisting the translation between business units — and the various IT and cyber risks they face — and helping them understand sometimes how two separate threats are actually part of a larger threat against the company. I believe that is when we can really show our value.

For example, let’s say an attacker breaks into a company and steals credentials to the gaming platform that is hosted by that business. The network defense team should detect that and stop it. If a new attack is being used that has never been detected before and no signatures have been created for it yet, it’s possible the attack may go unnoticed. Soon after this undetected attack, separately, your cyber threat intel analyst discovers that someone dumped some credentials to your game on the dark web or is selling them. If that credential dump is only passed on to a third group such as customer service in order to reset accounts, but the network defense team isn’t made aware, then the source of the leak may not be plugged. Or if the developers are not notified, and the vulnerability came from a bug in the software that the company created, then again the problem will still be there.

What are some of the achievements cyber threat intelligence has accomplished. Is it changing the game?

It is changing the game for sure. Some of the big wins cyber threat intelligence has gotten comes from exposing malicious activity in general. When you can find those hidden gems and expose what is going on those are the big wins. Seeing the new carding efforts and all the things that are going into combating organized crime is very rewarding. The big ones are of course things like uncovering STUXNET, and all of the pieces that went along with that. The Mandiant APT1 report I think spawned a whole new movement with regards to CTI, some good some bad, but it got a lot of people to sit up and take notice, and that’s really what we want.

Final thoughts?

We talked about how new the field of cyber threat intelligence is, but that is also exciting. Being in a field with all of this different stuff going on makes cyber threat intelligence a very exciting field to be a part of and stay focused on. I look forward to the future.   

Q&A: What Does a Cyber Threat Intelligence Analyst Do? (Part 1)

As cybercrime continues to grow and evolve at a rapid pace, organizations are faced with difficult decisions in finding solutions to this problem. Deploying security tools to combat cybercrime is a crucial part of this dilemma, but this brings with it the herculean task of attempting to process massive amounts of data in order to keep up in the game defending against cyber-attacks.

In order to get the most up-to-date and accurate cyber threat intelligence, SurfWatch Labs employs talented analysts with a focus on threat intelligence. These threat analysts are the backbone to a new and developing field of cyber threat intel, providing valuable information to organizations that go well beyond identifying threats.

“Being a threat analyst often requires being a chameleon or wearing many hats,” said Aaron Bay, chief analyst at SurfWatch Labs. “You need to be able to understand the technical side of security, navigate among the various hacker and cybercrime forums on the dark web, understand business risk, and then distill all of that information into valuable intelligence that can be easily understood by business executives. It’s not an easy role, but it is one that is becoming increasingly important to organizations.”

We spoke with Bay to get some insight about the role of a threat analyst and how cyber threat intelligence can benefit organizations.

Tell us a little bit about being a threat intelligence analyst.

Being a threat analyst feels a little bit like a cross between a weatherman, an interpreter and someone trying to find a needle in a haystack. It’s not just about knowing the latest attacks and staying up on the latest jargon. There is a lot of translation that has to take place to get that information to the decision makers in such a way that they can actually make a decision based on it. So being able to speak “cyber” but also being able to translate that to someone who is not a cyber person takes some work as well. Powerful Google-fu is also helpful in this position; even though Google is not the only source, knowing how to find data using it and other tools is invaluable.

Describe your typical day.

Aaron Bay, Chief Analyst at SurfWatch Labs

My typical day is probably a little bit different than most cyber threat intel analysts. Because SurfWatch Labs focuses on the bigger picture, we aren’t typically gathering the latest signatures from the latest malware or putting together snort rules for all the new bad stuff that’s been detected by various sensors or honey pots.

I spend a lot of time reading blogs, Twitter, various forums and general Web searching. To support SurfWatch Labs’ customers, a lot of my focus is on them: what they’ve said is most important to them, things they want to stay aware of, constantly looking for information that may be of interest to them in general, keeping track of that and reporting it to them, and then getting their feedback on what we’ve told them to tailor our internal processes so that we constantly evolve and stay current with their needs, as well as stay current with the threats out there.

Is being a cyber threat intel analyst mostly about IT security?

Firstly, I think the term IT Security is becoming archaic. When it is used, the person who hears it or uses it has a preconceived notion about what IT Security is. Computers and routers and switches and firewalls and all things traditionally associated with IT security come to mind. But our businesses and our personal lives have become so connected and dependent on technology, that just calling it “IT” seems to leave out things that should be included, but aren’t.  I have to say that I am not a fan of the term “cyber” or “cybersecurity,” but I can understand the reason for having a new term that’s a little more ambiguous.  

Credit cards used to just be numbers printed on plastic read by zip-zap machines until magnetic strips were created and used to save information in a way that could be read by a computer and transmitted via telephone back to your bank. Forty years later, those are being replaced by sophisticated memory cards that keeps your information encrypted. Do you consider your credit card to be IT? You should. Credit card fraud has been around as long as credit cards, and the more IT we throw at the problem, the more it becomes an IT security problem. I know that banks and organizations like Visa consider this an IT security issue, but most people still do not, I would assume. And that’s just one example.

For a Cyber Threat Intel Analyst to do their job correctly, they need to understand that it really is about IT security, but the scope is usually bigger than most people realize. The analyst needs to be aware of that, but they need to help their employer or customer understand that as well.

What is one of the biggest things to understand about cyber risk?

Typically, cyber threats enter an organization by way of something every user touches: browsing the web, reading their email, opening files, etc. Traditional IT security has been tasked with solving that. But that’s not the only way cyber threats can harm an organization. As soon as you do business with another organization, the scope of your risk increases. You have to send and receive information from them, send and receive money from them. This information is at risk if one organization protects it less than the other. If pieces of the business are outsourced, whatever that is, it’s now at risk to however that third party protects its business or its infrastructure.

Some of this even just comes in the form of what software a business chooses to use for its customer portal, where customers can post questions or the business otherwise interacts with its customers. Any vulnerabilities in that software or where that software is hosted translates to risk to the primary organization. Again, none of this is meant as a reason not to function this way, only as a way to say that these risks need to be understood and monitored. As new threats or attacks or vulnerabilities are discovered, an organization needs to be made aware of them so actions can be made to mitigate or remove them.

What are some cybersecurity trends you are seeing as a threat analyst that are concerning?

The biggest trend I am really starting to see is the continuation of cybercriminals using cyber means to make money.  They steal credit card numbers, people’s personal identities, and the profits from these crimes and frequency of attacks continues to grow. Ransomware is now growing. It’s not growing because people think it is funny to do. It’s growing because people are making a lot of money off of these attacks. In these attacks, cybercriminals don’t care about obtaining information from our computer. All they care about is getting you into paying them money to get back your information. This is a scary trend, because it is really working.

Denial-of-service is still going on; people will pay to conduct denial-of-service attacks or pay ransoms to have these attacks stopped. It will be interesting to see what attack shows up next in an effort to make money.

To encapsulate that trend, it is becoming a lot more organized. In years past, the traditional “organized crime” groups were the only ones really making money off of cyber attempts. Today, however, all parts of cybercrime are becoming more accessible, and as it becomes easier a lot more people are going to be doing it.

Along that vein, attacks that produce the most results are of course going to trend. Ransomware as I mentioned, but a lot of businesses are getting better at detecting and eliminating threats … but don’t quite understand or monitor threats coming from their third-party suppliers, so attacks will start to come from that angle.

What is your biggest fear as a threat analyst?

My biggest fear is people not taking this information seriously or people not thinking it is useful information. I am fearful that people view this information as no big deal, viewing it as just another report and moving on. I hope that companies feel this information is useful, and it is taken seriously instead of thinking they don’t need the information anymore. Some of that could be that an organization doesn’t quite have a mature enough cybersecurity program so it can’t properly digest and protect against what an analyst may be telling them. The failure of the analyst to correctly translate risks and threats and trends into something meaningful could also contribute to the message being lost.

In the next post, Aaron shares his thoughts about how cyber threat intelligence can help your organization.

Will Your Internal Sharing of Data Cause a Breach?

On May 4 the United Kingdom’s Information Commissioner’s Office (ICO) announced a £185,000 fine against a health trust for inadvertently publishing the personal details of 6,574 staff members on its website.

Blackpool Teaching Hospitals NHS Foundation Trust is required to post annual equality and diversity metrics. Unfortunately, the published spreadsheets contained “hidden data.” Simply double clicking on the posted tables revealed the sensitive information behind them. This included employees’ names, pay scales, National Insurance numbers and dates of birth as well as other volunteered information such as ‘disabled’ status, ethnicity, religious belief and sexual orientation.

The incident is just one of many examples of data breaches resulting from the inappropriate sharing of data within an organization. In fact, the ICO recently published a guide about how to safely disclose information due to a string of similar incidents.

One of the drivers behind those breaches is business intelligence moving away from a locked-down, data-silo approach and back towards the the freewheeling, self-serving nature of the early 1990s as tools like Tableau empower analysts, said Datawatch chief product officer Jon Pilkington, who was a guest on this week’s Cyber Chat podcast.

In its monetary penalty notice to Blackpool Teaching Hospitals NHS Foundation Trust, the ICO noted that the trust:

  1. Did not have any procedure governing requests for information around electronic staff records
  2. Did not provide the team with training on the functionality of the Excel spreadsheets
  3. Had no guidance in place for the web services team to check those spreadsheets for hidden data before making them public

“[Analysts] are offloading data from its originating source for the purposes of getting their job done,” Pilkington said, adding that this approach is revealing potential data governance gaps within organizations.

The Big Concern is a Data Breach

Internally sharing data without the proper precautions may result in a highly publicized exposure, said Dan Potter, chief marketing officer at Datawatch, which helps businesses users prepare and analyze data from a variety of sources.

“The big concern, the big risk, is around data breach because now you’ve got data being moved from governed systems — like a database or data warehouse that are well-managed and well-governed and controlled — to something that is now living on the desktop of an analyst and therefore being shared with other people in a non-governed way.”

Take the recent breach at retailer Kiddicare. Earlier this month the company notified nearly 800,000 customers that their names, addresses and telephone numbers may have been stolen after a test website using real customer information was compromised.

However, using real data on a test site tends to be a bad practice, noted security blogger Graham Cluley. As a test site, things are expected to go wrong, and in the case of Kiddicare, they did.

“Unfortunately, time and time again it’s seen that companies can be sloppier about the security of their test sites than their official sites — opening opportunities for data thieves and hackers,” Cluley wrote. “For that reason it’s usually much safer to generate fake data for testing purposes – just in case.”

Importance of Data Masking

Redaction and data masking can provide the best of both worlds: analysts across all departments are free to examine the data they want, and the sensitive information is removed or replaced with innocuous data.

This can help ensure you’re staying compliant with both government regulations and corporate policy. For example, if the employees names and insurance numbers had been masked in the data behind the trust’s equality and diversity metrics, the mistaken disclosure of that information would have been much less significant.

Potter added, “There’s a whole host of other kinds of data that people need to be very, very careful with in making sure that they’re masking it in some way because as you move to self-service analytics it does create more risk.”

Listen to the full conversation with Datawatch for more about business intelligence and data masking.

About the Podcast
In early May Blackpool Teaching Hospitals NHS Foundation Trust was fined £185,000 by the United Kingdom’s Information Commissioner’s Office for inadvertently publishing the personal details of 6,574 staff on its website. And last week retailer Kiddicare announced that 800,000 customers were impacted after a test site using real customer information was compromised by hackers. The incidents highlight a growing problem. Organizations have more data than ever, and that sensitive data is often being shared with other departments or with third parties for a variety of purposes.

On today’s Cyber Chat we talk with Datawatch chief product officer Jon Pilkington and chief marketing officer Dan Potter about business intelligence, the importance of data masking and how businesses can protect their sensitive information when it’s being shared both inside and outside of the organization.

Talking PowerShell and Stealth Attacks with Carbon Black’s Rico Valdez

Malicious actors are increasingly using legitimate tools such as PowerShell in order to lessen their digital footprint and evade detection, and the use of such ubiquitous and legitimate technology can be a problem for organizations when it comes to defending against those threats.

That’s according to Carbon Black senior security researcher Rico Valdez, who joined us for this week’s Cyber Chat podcast to discuss recent research on PowerShell, including a new report examining more than 1,100 security investigations in 2015.

Windows PowerShell is an automation platform and scripting language that Microsoft describes as “providing a massive set of built-in functionality for taking control of your Windows environments.”

The legitimate use along with the built-in functionality makes it a perfect tool for attackers to exploit.

“It used to be the kind of thing where only really sophisticated adversaries would use it, but it’s gotten to the point now where it’s being incorporated in a lot of commodity malware,” Valdez said. “It’s another way to stay under the radar and try to remain undetected.”

Utilizing PowerShell fits into the overall trend of attackers avoiding dropping a lot of tools onto a system; instead, they utilize what’s already there in order to further their goals.

“Monitoring it can be very tricky,” Valdez said. “I don’t think it’s very well understood even by the larger SOCs (security operations centers). Its one of those things that’s a little bit further down on the list for a lot of these organizations to really dig into.”

How are criminals using PowerShell?

When looking at the data from a variety of Incident Response and MSSP partners, 38% of confirmed cyber incidents used PowerShell. This included all industries and multiple attack campaigns.

PowerShell is used for a variety of malicious purposes, according to Carbon Black’s report.

“It’s quite powerful in that it can pretty much touch any part of the system, and if you’re running it with the right privileges it can pretty much do anything on the system,” Valdez said.

For example, last month a new family of ransomware was discovered dubbed “PowerWare.” PowerWare uses the popular technique of duping users via phishing messages containing a macro-enabled Microsoft Word document. The malicious macros then use PowerShell to further the attack.

Eighty-seven percent of the attacks leveraging PowerShell  were commodity malware attacks such as ransomware, click fraud, fake antivirus, and others. Only 13% were described as “advanced” attacks.

This technique is a good example of how attacks tend to evolve, Valdez said. First they’re discovered by sophisticated actors and used in targeted attacks. Then — if they work well — they become mainstream.

“This is a real risk in your environment and you need to be aware of it, because, again, most people aren’t watching it, monitoring it, anything like that.”

Listen to the full conversation with Carbon Black’s Rico Valdez for more about PowerShell and how organizations can protect themselves.

About the Podcast
A new ransomware was recently discovered dubbed PowerWare, which targets organizations via Microsoft Word and PowerShell, and just last week Carbon Black released a report looking at how PowerShell is being utilized for malicious intent. They wrote in the report that “the discovery of using PowerShell in attacks such as PowerWare is part of a larger, worrisome trend when it comes to PowerShell.”

On today’s Cyber Chat we talk with Carbon Black senior security researcher Rico Valdez about the company’s recent findings and how cybercriminals are increasingly using PowerShell to remain under the radar while targeting organizations.


Talking Cyber-Terrorism and ISIS with Morgan Wright

U.S. Cyber Command has its “first wartime assignment” in the fight against ISIS, Secretary of Defense Ashton Cater told an audience at the Center for Strategic and International Studies last Tuesday. That cyber fight includes techniques to disrupt the group’s ability to communicate, organize and finance its operations.

On the same day, head of U.S. Cyber Command Admiral Michael Rogers told the Senate Armed Services Committee that among his biggest fears are the possibility of groups like ISIS manipulating electronic data records, impacting critical infrastructure such as the electrical grid or air traffic control systems, and using cyber tools “as a weapons system.”

The week’s news capped off a period of increasing discussion around cyberwarfare and cyber-terrorism.

It’s an issue that organizations need to be aware of, said cybersecurity and counter-terrorism expert Morgan Wright, who discussed the topic on this week’s Cyber Chat podcast.

“It is a different animal,” Wright said. “Companies really need to understand the implication of the difference between just cybercrime and cyber-terrorism because it will make a difference in how you respond.”

The Cyber-Terrorism Threat

The December 2015 cyber-attack in Ukraine, which affected electricity for 225,000 customers, was unique in that it’s the first confirmed attack to take down a power grid. In addition, just last month the U.S. officially charged an Iranian with access to a computer control system for New York’s Bowman Avenue Dam. Luckily, a gate on the dam had been disconnected for maintenance issues; otherwise, the hacker could have operated and manipulated the gate, authorities said.

Wright agreed with other experts that the BlackEnergy malware used in the Ukraine attack is a bigger issue than other often-cited critical infrastructure threats such as Stuxnet.

“It’s in this country, and we talk about it but we don’t really take it seriously,” Wright said. “[BlackEnergy] could actually be a terrorist — a cyber-terrorism — type of tactic. … Let’s say that a group like Al-Qaeda or ISIS gets ahold of this and they decide they want to take out part of our power grid.”

But it’s not just critical infrastructure operators who need to be concerned about cyber-terrorism, he added. Organizations, particularly those with ties to often-targeted states such as Israel, need to be aware of those risks.

Businesses need to examine their geopolitical footprint, Wright said. Where are you operating, what types of things may be impacted if you are targeted by some of these organizations, and how can you better prepare to defend against those potential threats?

The Researchers Who Cried Wolf?

There have been a few headline-grabbing events tied to cyberwar and cyber-terrorism, but when compared to traditional cybercrime events, the former threat can appear rather sparse.

When asked about fatigue or backlash from researchers warning of these types of threats, Wright attributed the problem to lack of imagination.

“Plots can take years to develop,” he said. “What I tell people is that just because you can’t imagine it happening right now doesn’t mean it’s not being worked on — it’s not being plotted for.”

As an example he highlighted the recent cybersecurity issues facing the automobile industry. Years before, he said people accused him of fear mongering for bringing up those very issues.

“Now the entire automotive industry is up in arms,” he said.”Guess what? Three years ago they couldn’t imagine that happening, and for 15 years the automotive industry did absolutely nothing.”

In the end though, although cyber-terrorism motivations may be different from cybercrime, the defense is similar.

“You still respond to it. You still prepare. Only later do the motivations really make a difference in terms of what could we have done detect this or prevent this.”

Listen to the full conversation with Morgan Wright for more about cyber-terrorism, the threat of groups like ISIS and his cybersecurity “rules of the road”:

About the Podcast
In an interview last week, U.S. Secretary of Defense Ashton Carter confirmed he had given U.S. Cyber Command its first wartime assignment and that the team would start launching online attacks against ISIS. The announcement comes after several months of news and debate about the issue of cyber-terrorism.

On today’s cyber chat we talk with cyber-terrorism expert Morgan Wright, who has nearly two decades in state and local law enforcement and has previously taken on roles such as a senior advisor for the U.S. State Department Anti-terrorism Assistance Program. We talk about the threat of cyber-terrorism, recent attacks against critical infrastructure, and how groups such as ISIS are impacting the cyber threat landscape.