Cyber Defense eMagazine December 2019

108
Drive, AWS, Office 365, etc. It used to be the case that you could generally trust a link
like “docs.google.com” and generally distrust a link like “byg7fewiuv347vscdahgf7vt832.com,” but this is
no longer the case, as attackers are increasingly using Google Docs and Office 365 to launch attacks.
A great example of this is the 2016 election hacking wherein much of the compromise originated by
stealing passwords via a fake Gmail page. This type of attack, referred to as cache poisoning or DNS
(Domain Name System) hijacking, exploits vulnerabilities in the DNS to reroute traffic from legitimate
servers, among other things. Research indicates there has been a strong emergence of similar DNS
attacks in recent years, from rerouting and intercepting email, to stealing cryptocurrencies, and so on.
Now imagine what an intern or volunteer with a legitimate inside account could do, such as setting up a
fake website to reroute unsuspecting traffic. That would likely be far more difficult to discover or
investigate than the Clinton incident was, but it’s a very real threat we must entertain.
This raises difficult questions about trust. Organizations need to really understand that their networks,
whether self-managed or outsourced, are not only no-trust, they’re likely hostile. We need to be honest
about these realities because doing so allows us to develop a plan for remediating potential risks and
threats. Ideally, organizations will have safeguards in place to ensure people or computers can only
access information they truly have the appropriate trust level for; those trust levels are granularly defined;
the controls are configured conservatively; and the controls work perfectly.
Of course, recognizing these hidden or seemingly trusted threats can be nearly impossible to achieve,
even for mature organizations. As such, monitoring and auditing for every user, device and application –
whether managed or unmanaged – is paramount. Being able to quickly detect and understand the intent
of every threat allows teams to respond accordingly. If all resources in a high-risk network aren’t
monitored for appropriate behavior and information access patterns, your next breach may come sooner
than expected.
About the Author
Gary Golomb is co-founder and chief scientist of Awake Security. He
previously served in the United States Marines 2nd Force Reconnaissance
Company. Gary can be reached online on LinkedIn and at
https://awakesecurity.com.