Techknow+

Controls to Address Advanced Persistent Threats & Information Warfare: Preventive Controls: These are the controls which prevent loss from occurring. For example, this control that applies separation of responsibilities like one employee can submit a payment request and second employee must authorize that request, it will minimizes the chances that employee can submit fraudulent payments. Detective Controls: These controls are especially for the monitoring activity to find out the cases where correct practices were not followed. For example, business might settle the general payment request audit logs to identify fraud payments logs Corrective Controls: Corrective controls are designed to restore the system back to the state prior to a destructive event. For example, business may apply full refurbishment of a system from backup tapes after evidence is found that someone has inappropriately altered the payment data. Advanced persistent threats usually target victims at...

Lately, a slight change in possible targets and technology used has been witnessed. An interesting research by Kaspersky Lab’s Global Research and Analysis Team (GReAT) has highlighted how the growth of cloud technology and its use have actually given APT hackers another way to attack systems and hide more effectively between the cyber-folds. Another interesting trend is the creation of smaller hacking groups. Rather than large organized sets of individuals, smaller groups will be forming, effectively multiplying the number of attacks, the locations from which the attacks are carried out and number and type of targets. This fragmentation makes it harder for organizations to defend themselves and is in itself a threat.  Also to be noted is the way targets are sought out. APT hacking groups are using a variety of techniques, including, for example, the targeting of high-level executives when staying at hotels. As technology advances, information security managers have more to...

Advanced persistent Threats attacks are systematically planned and accurately executed. These attacks can be break down into four stages or phases:  Incursion  Discovery  Capture  Ex-filtration 1: Incursion In these targeted attacks, hackers enter into the organization's network. During this attack they will be making use of SQL injection attack, zero-day vulnerabilities, social engineering methods, targeted malicious software called as malware, etc. There is a fundamental difference between normal attack and APT. While normal targeted attacks use short-term methods, APTs are designed to launch covert operations over long period of time. Other characteristics of APT incursions are as follows: • Reconnaissance: This is a kind of an information gathering phase. In APT attacks often engage large number of researchers who spend months together studying their targets and making themselves comfortable with target systems, people and processes. • Social ...

APTs are different from other targeted attacks in the following ways: Customized attacks:  Advanced Persistent Threats (APTs) frequently use highly customized methods, tools and access gaining techniques. These techniques are developed specifically for a particular purpose or campaign. These tools include viruses, zero-day vulnerability exploits, rootkits and worms. In addition, APTs often launch series of threats or “kill chains” continuously to attack their targets and ensure continuing access to targeted computers, sometimes including a "sacrificial" threat to trick the target into thinking the attack has been successfully repelled. The objective of Cyber Kill Chains is to enhance visibility into an attack and enrich an analyst’s understanding of an adversary’s tactics, techniques and procedures. The Cyber Kill Chain framework is part of the Intelligence Driven Defense model for the identification of attack. Low and slow:  Advanced Persistent Threat attacks occur...

An APT (Advanced Persistent Threat) is a type of a targeted attack. Targeted attacks use a wide variety of techniques, including drive-by downloads, malware, spyware, phishing and spam, etc. An APT is always a targeted attack, but a targeted attack is not necessarily always an APT. APTs, described as being ultra-sophisticated cyber-attacks against an organisation and its assets, are digital assaults launched by highly skilled cybercriminals that harvest valuable information over the long term; attacks are orderly and persistent. APTs are specific threats that are targeting messaging and content delivery servers, where an attacker delivers targeted malware in attempt to leverage information from the source. The attacker’s objective may be the theft of sensitive and proprietary information or exploitation fraud. The perpetrator applies techniques to get into an organization’s system to exploit it, hanging about as long as possible and attempts to retain control while going unnotice...

Negotiating contracts with the potential cloud vendors is complex but crucial for success in the cloud. While click-through agreements seem to make the work easier for low risk applications momentarily, organisations must consider opting for tailored contracts to ensure that all future applications to be hosted in the cloud are completely safe and devoid of legal issues. Some of the common issues that arise due to contracting pitfalls are: (i). Vendor Lock-In More than 75% of enterprises feel that moving to the cloud comes with some percentage of vendor lock-in. While the convenience to shop at one stop, draw a single tailored contract and the standardization of technology seem alluring, things may not look the same in the long run. Vendor lock-in hinders the path to rapid innovation and ultimately knocks down organisational health. Examining the exit options in the contract or opting for an open source cloud stack such as Open Stack may mitigate these problems. (ii). Unilatera...

Any organisation dealing with sensitive/personal information must regulate this information carefully to avoid legal disputes in case of any discrepancies. Legal contracts must be drawn to ensure that the liability of data is shifted to the side of the user and the organisation is insulated from any issues pertaining to content such as copyright infringement, illegal data, and classified information. Businesses need to have expectations right when it comes to legal issues related to the cloud. What kind of information does the user/employees of a company store in the cloud are to be strictly monitored and regulated. If the company does not have such resources to mediate, then it should have Terms and Agreements duly signed by the user - so that the liability of content/data stored on the cloud is on the user. This way, the business can avoid legal issues. Content issues that may arise includes Copyright infringement, illegal data, classified information etc. One classic example c...