Major cyberthreats were viruses, worms, and Trojan horses.

Cyberattackers started getting inside enterprise networks.

Once inside, cyberattackers operated surreptitiously:

In 2011, RSA’s enterprise was breached, and the security keys for many of its customers were believed to have been stolen.

In 2013, Target’s point of sale network was compromised, resulting in the loss of personal information and credit card numbers for over 40 million customers.

In 2014, a German steel mill was affected by a hacking incident that caused one of its blast furnaces to malfunction, resulting in significant physical damage to the plant and its facilities.

In 2015, Anthem reported its IT systems had been breached and personal information on over 80 million current and former health care network members was compromised.

The nonfunctional computers displayed a message from the Guardian of Peace.

By the end of the day, most computers had been completely disabled, which impacted the company’s business—or lack thereof.

The cyberattacker published proprietary data to include salaries and personal e-mails of Sony’s senior executives.

Attackers did what cyberattackers have been able to do all along, but have chosen not to—they put the reality of the Sony hack in full view of the press and public.

It is reasonable to assume Sony’s cyberdefenses were consistent with industry norms, but reflected what is and what is not being done at companies around the world.

Effectiveness of the Sony hack was likely amplified by the consolidation of IT systems administration that has occurred over the past 20 years.

Professional attackers, who understand how modern IT works and how it is managed, can effectively turn an enterprise’s IT infrastructure against the enterprise.

IT infrastructures are largely designed for functionality—not security—and often lack compartmentalization to contain an attack.

If their objective is to break into a company and steal corporate secrets, attackers persist until they succeed.

If their objective is to break into a government and steal national security information, they persist to find a weakness to exploit.

Defenses only need to block the malware and the attacker will move on to other targets.

To stop an APT attacker, the defenses have to work perfectly and be maintained perfectly.

An APT attacker will exploit any mistake.

Commodity Threats

Hacktivists

Organized Crime

Espionage

Cyberwar

are undirected and opportunistic;

may exploit cyberdefense vulnerabilities;

do not adjust or adapt in order to work their way around protections that are in place;

can be destructive, but limited;

be stopped if defenders block the commodity threat’s attack vector, making the defenders safe.

For other cyberattack threat categories, simply blocking the initial attack vector is only a start.

These cyberattackers may start their efforts by going to botnet operators and purchasing access to computers and servers that are already compromised inside the target environment.

Purchasing access can make the attackers’ initial entry into the enterprise easier and save them valuable time and money.

make public or political statements;

are used against individuals, enterprises, or governments;

seldom set out to hurt anyone or do significant physical damage;

are simply looking to get a message out and draw attention to a cause;

tend to use mostly commodity tools and techniques that are widely available on the Internet; and

take advantage of vulnerabilities that are unpatched or open.

Easy Access

Lack of Attribution

Wholesale Data

Stolen credit cards or social security numbers typically sell for $1 each.

Medical records can sell for $10 or more.

Stealing one million records can make real money, which can be used to support an entire shadow industry willing to lend their services for a piece of the action.

Business banking accounts

Ransomware

Payroll accounts can be relatively easy to carry out

Direct deposits

It may be financially driven, but other drivers are much less forward.

It centers on stealing trade secrets for commercial advantage or national secrets for political or military advantage.

Blueprints, formulas, or software code that is considered critical for success

Plenty of other information such as organization charts, budgets, project schedules, and meeting minutes that are vitally useful to the competition

Why hack the CEO’s laptop when, for the same amount of effort, you can get control of every laptop in the enterprise?

conducted at the nation-state level; and

can be made up of multiple parts or phases (stepping stones).

Overwhelming, overloading, disabling, or destroying IT systems used by victims

Using victim IT systems to cause physical systems to malfunction and damage themselves or their operators

Denial of service

Data destruction

Control system manipulation

confidentiality by stealing data;

integrity by modifying data; and

availability by denying access to data, services, or systems.

Phishing / Spearsphishing

Drive-By / Watering Hole / Malvertising

Code Injection / Webshell

Keylogging / Session Hijacking

Pass-the-Hash and Pass-the-Ticket

Credential Harvesting

Gate-Crashing

Malware / Botnet

Distributed Denial-of-Service (DDoS)

Identity Theft

Industrial Espionage

Pickpocket

Bank Heist

Ransomware

Webnapping

Hijacking

Decapitation

Sabotage

Sniper / Laser / Smart Bomb

Smokeout / Lockout

Infestation / Whack-a-Mole

Burndown

Meltdown

Defamation

Graffiti

Smokescreen / Diversion

Fizzle

Social security numbers

Credit card numbers

Bank account information

Electronic health records

Confidential corporate secrets and executive correspondence

Databases

Backups

Application Servers

Systems Administrators

Reputational impacts if the data is public-facing such as web sites

Financial reporting impacts, particularly for publicly traded corporations

Losses of actual money if data is bank-routing numbers or financial command to banks handling corporate accounts

Hijacking

Sarbanes-Oxley

Online Banking

Direct Deposits

Vandalism

Can be difficult to diagnose, especially if systems are impaired but not disabled

Can cause failures by overwhelming systems and infrastructure

Distributed Denial of Service (DDoS)

Targeted Denial of Service

Physical Destruction

Hackers actually take control of computers and accounts inside of victim enterprise.

It is helpful to work out steps required for intrusion to succeed.

An attack tree begins with the objective of the cyberattack (such as stealing enterprise data).

Then the attack tree works backward to consider the various ways the objective could be achieved and the steps involved to accomplish the objective.

Attack steps can trigger an alarm and cause the entire attack to be detected.

Defenses can also add steps the attack must take before it can succeed.

Defensive steps don’t make stealing the data impossible, as no defense is perfect, but they can make the attack significantly more difficult, time-consuming, and expensive.

A graph is just like a tree , except the dependencies can loop back on themselves.

Research shows how vulnerabilities interconnect and how attackers can step from one compromised computer to another until they reach their target.

This research is of limited use.

Attack-tree and attack-graph methodologies provide a generalized model of the sequence of cyberintrusion activities.

Successfully performing multiple steps

Defeating potential defenses and defensive technologies

No single or simple answer exists.

A number of factors, when taken together, is making it harder for cybersecurity defenses to succeed.

The Explosion in Connectivity

Consolidation of Enterprise IT

Defeat of Preventive Controls

Failure of Detective Controls

Compliance over Capability

The Gap in Cybersecurity Effectiveness

Enterprises were fairly simple.

Today, the architecture is complex.

Everything is interconnected in a myriad of ways.

Administrators can now manage ten or a hundred times as many computers rather than a relatively few computers.

Enterprise data centers can now contain thousands or tens of thousands of computers vs. a hundred servers.

Opportunities for mistakes and glitches have grown significantly.

Layers of virtualization and abstraction add complexity.

Specialized administration areas are difficult to understand, troubleshoot, and protect.

In a virtualized environment, successful server administration depends on multiple administrators for network, storage, virtualization, servers, and applications.

Achieving proper configurations across all layers of the computing environment is difficult and complex, and it requires collaboration.

reducing risk probability;

reducing risk impact;

detecting occurrences of risk incidents;

collecting evidence to support security evaluations and incident investigations; and

providing validation that risks are being mitigated adequately.

Preventive Controls

Detective Controls

Forensic Controls

Audit Controls

Most IT systems can log activity, but the activity is often in the form of cryptic text files or event codes that require significant expertise to decipher.

Enterprises must integrate these logs, correlate across them, and then use the data to alert on activity patterns that are or may be malicious.

With terabytes of data and thousands of servers, there can be hundreds or thousands or even millions of events per day calling for investigation.

In practice, a cyber analyst can thoroughly investigate perhaps a dozen events in a single day.

When people become overwhelmed with data, the enterprise is just as blind as it was when it had nothing.

First, standards must necessarily focus on the presence or absence of technologies or controls, but it is hard for standards to specify the level of resistance of those technologies or controls to deliberate attack by skilled attackers.

Second, the requirement for standards compliance can take enterprise resources away from “real cybersecurity.”