Threat Update: Wide Scale Phishing in Progress

GlobalDisplay Orig

Just a quick update about the ongoing threat from malware dropped by phishing attacks. There are a lot of phishing attacks currently in progress. Fishing has been a leading form of compromise for quite some time and indicators appear to point to an increasing amount of phishing attacks and a larger amounts of damage from successful exploitation.

Many organizations are reporting wide spread phishing using recycled, older malware including Zeus, Tepfer and other common remote access tools. In some cases, these malware are repackaged or otherwise modified to evade anti-virus detection. Attackers are showing medium to high levels of success with these attacks.

Once compromised, the normal bot installation and exfiltration of data occurs. For most organizations that don’t play a role in critical infrastructure, this likely means credentials, customer information and other commercially valuable data will be targeted. For critical infrastrcuture organizations, more specific  design, future state and architectural data is being targeted along with credentials, etc.

Organizations should be carefully and vigilantly reviewing their egress traffic. They should also be paying careful attention to user desktop space and the ingress/egress from the user workstation DMZ or enclaves (You DO have your user systems segregated from your core operations, correct???). Remember, you CAN NOT depend on AV or email filtering to rebuff these attacks at a meaningful level. Detection and response are key, in order to limit the length of time the attacker has access to your environment. Anything short of full eradication of their malware and tools is likely to end with them still maintaining some level of access and potentially, control.

Now is a good time to consider having a phishing penetration test performed, or to consider using MSISimplePhish to perform some phishing for yourself. Awareness alerts and training are also encouraged. This is going to be a long term threat, so we must begin to implement ongoing controls over the entire technology/ppolicy & process/awareness stack. 

If you have any questions on phishing attacks, malware or incident response, please let us know. Our teams are used to working with these attacks and their subsequent compromises. We also have wide experience with designing enclaved architectures and implementing nuance detection mechanisms that focus on your critical assets. Feel free to touch base with us for a free 30 minute call to discuss your options for increasing security postures.

Audio Blog Post – IT History: An Interview with Brent’s Mom

Today, I got to do something pretty cool! I got to record a quick interview about the history of IT and what some of today’s technologies look like through the eyes of someone who has done IT for the last 40 years. Even cooler than that, I got to interview MY MOM! 

Check this out; as she discusses mainframes, punch cards and tape vaults, insights about mainframe authentication and even quality control in the mainframe environment. She even gives advice to IT folks approaching retirement age and her thoughts on the cloud. 

She closes with a humorous insight into what she thinks of my career and when she knew I might be a hacker. 🙂

It’s good stuff, and you can download the audio file (m4a format) by clicking here

Thanks for listening and let me know if you have other IT folks, past or present, you think we should be talking to. I’m on Twitter (@lbhuston) , or you can respond in the comments.

HoneyPoint Security Server ICS/SCADA Deployment Example

Recently, there have been several questions about potential deployment scenarios for HoneyPoint Security Server in and around ICS and SCADA organizations. Here is a quick, high level view of what a sample deployment might look like in a utility or other ICS environment. Note that the sample environment has fully embraced enclaveing. The network is fully segmented based on function.

In organizations where segmentation or the use of enclaves has not been established, HPSS can still be used and would be deployed in much the same manner.

Please let us know if you have any questions about this diagram or about deploying HPSS in your environment. We would be happy to set up a free consultation with you to discuss how the tool could aid in your detection program and give you increased visibility throughout your enterprise.

PS – If the graphic is difficult to read, right click on it and select view in new tab. The theme for the site is having trouble with this particular graphic.

HighLevelEnclaves

New Project: Stolen Data Impact Model (SDIM)

This is just a quick announcement about a new project we are starting at MSI. The name of the project is the Stolen Data Impact Model (SDIM).

The goal of the project is to identify a methodology for scoring the impact of data stolen in a breach. We believe the scoring mechanism will be some kind of curve, based on the impact of the loss over time. Currently, we are spreading that loss over four time frames: immediate, short term, intermediate term and long term.

We also believe that there are more than one facet of impact that could be in play and we are currently discussing how to handle the multiple facets.

We are just starting the project, and plan to work through it with the input f the community. We searched for models to address this, but were unable to identify any. If your organization has a model, methodology or process for this and you are open to sharing, please get in touch. You can always contact us in the comments or via Twitter (@lbhuston) or (@microsolved).

Thanks and we hope to present more on this topic shortly.

CMHSecLunch for February

J0289893

This month’s CMHSecLunch is February 11th, at the Polaris Mall food court. It starts at 11:30 am Eastern and goes to 1pm Eastern. The Twitter chat runs at the same time if you can’t join in person – use the hashtag #CMHSecLunch to get in on the virtual event.

This is a great opportunity to meet with friends, peers and folks you may not have gotten to hang out with in a while. It is open to the public, there is no cost or registration hassles. You just go to the mall food court for lunch and sit down with friends to talk or maybe even make some new friends.

Turn outs have been great and the group of folks participating is growing. Each month, on the second Monday, we rotate between mall food courts around town so everyone gets a chance to be “close to home”. Seriously, it’s worth coming out. Think of this as the best part of security conferences (the chance to hang out and chat in the hallways), without the con flu or need to travel on an airplane.

Hopefully, the Twitter hashtag will grow as well and we can use it for folks that are/were in our community, but can’t get to the physical event for whatever reason. 

As always, thanks for reading StateOfSecurity and engaging with MicroSolved. We love the CMH infosec community and organizing this event is just another way we hope to give back for all you have done for us over the last two decades! Thanks!!! 

Kicking Off an Interview Series: Three Tough Questions

Beginning in the next few weeks, we will be kicking off a new series of blog posts called 3 Tough Questions. The format will be either text or audio interviews with infosec, ICS/SCADA, government and other experts. We will be asking strong questions about where we are today in infosec, how we got here and we are going tomorrow. 

Who would you like to see us interview? Drop me a line on Twitter (@lbhuston) or via email/comments and let me know. If you have a burning question or two as well, send them over! 

Thanks for reading and we hope you enjoy the new series! 

Event Announcement: ICS/SCADA Security Briefing

MSI, along with the teams at NexDefense and Critical Intelligence, will be participating in an online webinar about ICS/SCADA Security. The date of the event is February, 6th and you can learn more about it here

The event is free to attend, though registration is required. You can earn a CPE for participating! 

We hope you will tune in and check us out!

Overview of the event: 

Learning Objectives

  • Significant trends in the threat and vulnerability environment
  • Relevant trends in ICS technology
  • What proactive steps you can take
  • How to leverage security intelligence

Agenda

  • Introductions
  • ICS Cyber Security Intelligence Briefing, Michael Assante
  • ICS Threat Update, Brent Huston
  • How to Leverage Security Intelligence, Bob Huber
  • Live Q&A

Who Should View?

  • Senior Information Security Leaders, CISOs and CTOs
  • Security and Risk Analysts
  • Control system security engineers
  • Security operation leads for ICS reliant organizations