Download - Bitpipe

More documents

Recommendations

Info

| EMERGING THREATSExplorer and Enhanced Mitigation Experience Toolkit (EMET) tools can assist with thisprocess.• Limit the local privileges that users have on their workstations, making it harder formalware to reach its full potential on the host. This often involves removing administrativerights from users who don’t need them, or stripping the more sensitive privileges fromadministrative groups. User Account Control (UAC) capabilities of Windows Vista and 7offer similar advantages even to users logged in with local administrative rights.• Assess capabilities of the security tools you use to protect web browsing activities atnetwork and endpoint levels. Consider deploying products that have features specificallydesigned for identifying malicious activities in web traffic and protecting the browser.UNDERSTANDINGMODERN ATTACK ANDDEFENSE TECHNIQUESSPONSOR RESOURCESCOMPROMISING WEB APPLICATIONSAs our infrastructure security practices mature, attackers are turning their attention toWeb applications. In some cases, the attackers’ goal is to compromise websites so thatthey can be used to target client-side vulnerabilities through visitors’ browsers. Attackersalso commonly pursue Web applications that process or store valuable data. Such application-levelattacks, which have been very successful at bypassing defenses, include thefollowing tactics:• SQL injection attacks, which bypass the application’s input filters to gainunrestrained access to the underlying database• Business logic flaws, which exploit the weaknesses in workflows implemented bythe application, such as a way to identify all valid usernames by using the passwordreset page.• Password brute-forcing methods, which use automated tools to guess passwordsthat use known dictionary words or that are otherwise predictable• Cross-site scripting (XSS) attacks, which bypass the application’s input or outputfilters to execute malicious scripts in the browser of the application’s userThe list of effective application-level attack vectors is too long to be included here.For more details, take a look at the OWASP Top Ten Project. Why are so many applicationsvulnerable to such tactics? Partly, it’s because many developers aren’t trainedto write attack-resistant code. Moreover, developers’ incentives prioritize features anddeadlines over the application’s defensive posture. Yet another reason is the infrastructurefocus of many security programs, which don’t provide the necessary focus on applicationlevelissues.Here are a few suggestions for tackling the challenges of application-level threats andvulnerabilities:• Break down the wall between infrastructure and application security teams in yourorganization, encouraging collaboration and making sure the company pays dueattention to application-level security issues.• Understand the business purpose of the applications, combining that knowledge6SEARCHSECURITY.COMTechnical Guide on Emerging Threats
| EMERGING THREATSwith the details regarding how sensitive data flows through the applications and theinfrastructure. Use this information to prioritize your security efforts.• Include application components in your penetration testing projects to mimic thelikely actions of attackers seeking to bypass your defenses. Be sure to incorporate manualtesting, since fully automated techniques are likely to produce numerous false positivesand false negatives.• Include application logs as part of your log management or security information andevent management (SIEM) efforts. Incorporate security alerting and logging specs intoyour application development requirements to support this.• Incorporate application-related steps into your incident response plan. Too often,organizations focus on only system or network-level actions when preparing to dealwith security incidents.• Establish a practical and comprehensive Web application security program, whichshould include security coding and application architecture guidelines, developer trainingfor secure coding practices and automated ways of identifying at least some vulnerabilitiesduring code creation, testing and deployment.UNDERSTANDINGMODERN ATTACK ANDDEFENSE TECHNIQUESSPONSOR RESOURCESATTACKERS WITH LONG-TERM INTERESTSWhile a fair number of intrusions can still be classified as quick hit-and-run incidentsmany attackers have demonstrated the desire and ability to invest into long-termcampaigns for achieving financial and, in some cases, political objectives. Such focusedactivities are typically comprised of a series of events that are spread over a period ofmonths and even years. Recently, attacks with long-term interests took on the forms:• Attackers deploy malware that acts as a crimeware platform diverse activities,including data exfiltration, distributed denial-of-service (DDoS) attacks and spamcampaigns. For instance, the Conficker worm spread quickly without a “business”purpose that was initially observable; the for malware was later used for variousmoney-making schemes.• Attackers research the people and technologies that comprise targeted organizations.This helps ensure the success of the initial compromise and follow-up actions. Clientsideattacks might be directed at specific individuals to target the software installed ontheir workstations in the context that wouldn’t arouse suspicions. Another illustrationof the preparation exhibited by attackers was evident in the Stuxnet incident.• Attackers adjust tactics in response to defenders actions. For instance, the groupbehind the Koobface worm modified the manner in which its malware uses socialnetworks to adjust for those sites’ security improvements. Similar characteristicswere exhibited by attackers in identified advanced persistent threat (APT) incidents.• Attackers maintain persistent presence in the compromised environment. As a result,even if the organization discovers some of the compromised systems, the attacker is ableto continue operating within the organization’s infrastructure. These characteristicshave been described in the context of APT scenarios.7SEARCHSECURITY.COMTechnical Guide on Emerging Threats
Page 1 and 2: SEARCHSECURITY. COMtechnicalguide o
Page 3 and 4: | EMERGING THREATSCYBERCRIMEUnderst
Page 5: | EMERGING THREATSTARGETING WORKSTA
Page 9 and 10: | EMERGING THREATSTECHTARGET SECURI
Page 11: RESOURCES FROM OUR SPONSOR• Webse

Download - Bitpipe

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?