Attack Methods are getting Smarter:Threat actors are using some common methods including compromised word Macros opened up by an unsuspecting user:

​

• Phishing with Word-enabled Macro, Most Malware is able to:

  • Determine if running in sandbox  and/or with and without privileg

  • Change the service description to something innocuous

  • Collect system information such as process name and system information
  • Encrypt system information such as the process name and system information
  • ​Encrypt collected information
  • Encrypt the information and POST to the Command and Control Server
  • Download additional malware (sometimes)
  • Start the malware service
  • Create a new service as auto start to make malware persistent 

​​

Living off the Land

• Attackers and developers of penetration-testing frameworks are increasingly leveraging Windows PowerShell to conduct their operations. By default, PowerShell does not leave many artifacts of its execution in most Windows environments. The combination of impressive functionality and stealth has made attacks leveraging PowerShell a nightmare for enterprise security teams*

​

Threat Fatigue

• Threat Fatigue Leads to delayed Incident Response:  On average clients see 17,000 malware alerts per week, with less than 5% investigated, per Verizon report.

​​

Threat Detection and Remediation

• Per the same Verizon report, it typically takes 170 days to detect and 39 days to remediate a compromise once it is found. In other words, its greater than 200 days from compromise to remediation, giving the bad guys lots of time to move laterally.

​

​

Common Threats

We understand the world as it is today (and what we think it will look like tomorrow) including:

• Improving nation-state, hacktivist, insider evasion and cybercriminals that, once they have a foothold within your network, are moving laterally within hours OR lying dormant for months or years

  • Many are moving away from signature-based attacks, leveraging Operating-System native tools (living off the land)

  • Most run their campaigns like a software development shop, verifying their code’s ability to evade defenses

​​

• Expanding attack surfaces for clients as they move away from the legacy on-prem, perimeter-based approach to explosion of data and endpoints via IoT devices, BYOD, cloud, Saas, hybrid, etc.

​​

• Increasing statutory requirements (and penalties) for compromises along with decreasing time to respond to compromises

​​

• Increasing compromises via  “Upstream” and “Downstream”

  • 50% of compromises in 2018 were due to partners being compromised FIRST

 

• Insider threats STILL represent close to 40% of compromises to-date

  • See UK-based dev-ops resource recently imprisoned for destroying firm’s infrastructure