Download PDF - Codenomicon

CODENOMICON WHITEPAPER - Proactive Cyber Security: Stay Ahead of Advanced Persistent Threats (APTs)
works remotely. An abuse situation awareness system needs
to collect information from potentially unreliable sources and
produce reliable reports. Botnets are modular and resilient and
they can distribute processing. These features make a botnetinspired
architecture the ideal basis for an abuse situation
awareness system.
Benefits of a botnet-based architecture
The botnet-inspired architecture makes AbuseSA very flexible,
scalable and robust. In AbuseSA, each source is followed by its
own bot, which reports to a C&C channel. Using separate bots
for different sources makes the system flexible and resilient to
errors in the sources. The system can collect information from a
wide variety of sources; each bot can be configured to understand
the transports and formats of its source. Thus, the user
can collect information without imposing any requirements to
the feed provider. In addition, new sources can be added simply
by adding a new bot on the fly, which makes the system easy
to scale. The botnets communicate over the extensible messaging
and presence protocol (XMPP). Thus various tasks can be
distributed and even run in various geolocations.
10
Cyber Security Risks
Hobbyists, Hacktivists and Cyber Crime
Security threats have been growing in scale and sophistication
for decades. Twenty years ago, cyber attacks were primarily
the domain of hobbyists. Then, as the opportunity for profiting
from stolen information grew, criminals started taking a larger
role. More recently spies working for government and corporate
espionage are leading some of the most technically advanced
and resource intensive attacks to date. 2011 saw a significant increase
in the activity of “hacktivist” groups like Anonymous and
LulzSec [19]. The motivation for these groups is retaliation for
perceived wrongdoing. Rather than financial gain, their main
goal is embarrassing their victims. However, their attacks are
not without financial consequences.
Critical Infrastructure
Critical infrastructure networks are no longer isolated. They
are all connected to the cyberspace, the global network of
interdependent information technology infrastructures and
communication networks, and they depend on common commercial
off-the-shelf software. When SCADA systems were fist
implemented in the 1960’s, it would have been hard to image
that critical control system could be attacked remotely or that
printers in adjacent corporate networks could be used as weapons
to attack them. Nobody could envision such threats, so no
measures were taken to make the networks resilient against cyber-attacks.
Newer SCADA devices communicate using Internet
protocols, sometimes over the public Internet [20]. This helps
reduce the cost of dedicated communication links, but at the
same time it makes the networks more open to outside attacks
[20].
Power grids, telecommunication and transportation networks
are exactly the type of infrastructure that has been the target of
traditional warfare, only the weapons have changed [21]. There
have only been a limited number of reported cyber-attacks
against critical infrastructure [21]. However, it would be naïve to
assume that hostile nation states, terrorists and hacktivists are
not aware how vulnerable these networks are and how much
havoc such an attack could cause [21]. The Stuxnet was the first
publicly admitted act of cyber warfare. It demonstrated that
cyber-attacks can cause significant physical damage to a facility
[22]. The Stuxnet was a very sophisticated attack carefully
selecting its victims and remaining undetected [22]. It utilized
four different zero-day vulnerabilities. However, many critical
infrastructure networks are so vulnerable that it does not take a
sophisticated attack like Stuxnet to exploit them. In many countries,
large parts of the critical infrastructure is privately owned
and extremely vulnerable [21].
Corporate Networks
A network is only as strong as its weakest element [23]. If attackers
manage to compromise a laptop or a smartphone of a
remote user working over a VPN, then they direct access to your