Are you Protected against These Common Types of Cyber Attacks?

The types of cyber-security attacks that businesses need to protect themselves from are continually growing and evolving. Keeping your company secure means having insight into the most common threats, and the categories of cyber attacks that might go unnoticed. From how to use the principle of least privilege to which connections you need to be monitoring, we look at the top types of network attacks and how to level up your security for 2019.

Watering Hole Attacks

A watering hole attack is an infected website, where vulnerabilities in software or design can be leveraged to embed malicious code. One well-known example is MageCart, the consumer website malware campaign. There are at least half a dozen criminal groups using this toolkit, notably in a payment-card information skimming exploit that has used JavaScript code on the checkout pages of major retailers to steal credentials.

Last year, Guardicore Labs discovered Operation Prowli, a campaign that compromised more than 40,000 machines around the world, using attack techniques such as brute-force, exploits, and the leveraging of weak configurations. This was achieved by targeting CMS servers hosting popular websites, backup servers running HP Data Protector, DSL modems and IoT devices among other infrastructure. Consumers were tricked and diverted from legitimate websites to fake ones, and the attackers then spread malware and malicious code to over 9,000 companies through scam services and browser extensions. This kind of attack puts a whole organization in jeopardy.

More effective watering hole attacks can be achieved if an attacker homes in on the websites that you and your employees use regularly. On top of this, always make sure that your software is up to date so that attackers cannot leverage vulnerabilities to complete these types of cyber attacks. Lastly, ensure you have a method in place to closely watch network traffic and prevent intrusions.

Third-Party Service Vulnerabilities

Today’s surge in connectivity means that enterprises are increasingly relying on third party services for backup, storage, scale, or MSSP’s, to name a few examples. Attackers are increasingly managing to infiltrate your network through your connection with other businesses who have access to your data center or systems. According to the Ponemon Institute, more than half of businesses have suffered a breach due to access through a third-party vendor, one example being the devastating Home Depot breach where attackers used a third-party vendors credentials to steal more than 56 million customer credit and debit card details.

As well as current suppliers, businesses need to be aware of previous suppliers who might not have removed your information from their systems, and breach of confidentiality where third-parties have sold or shared your data with another unknown party. As such, your company needs visibility into all your communication flows, including those with third-party vendors, suppliers, or cloud services, as well as in-depth incident response to handle these kinds of attacks.

Web Application Attacks

When it comes to categories of cyber attacks that use web applications, SQL injection is one of the most common. An attacker simply inserts additional SQL commands into a application database query, allowing them to access data from the database, modify or delete the data, and sometimes even execute operations or issue commands to the operating system itself. This can be done in a number of ways, often through client-server web forms, by modifying cookies, or by using server variables such as HTTP headers.

Another example of a web application attack is managed through deserialization vulnerabilities. There are inherent design flaws in many serialization and deserialization specifications that means that systems will convert any serialized stream, into an object without validating its content. At an application level, companies need to be sure that deserialization end points are only accessible by trusted users.
Giving web applications the minimum privilege necessary is one way to limit these types of cyber-security attacks from breaching your network. Ensuring you have full visibility of connections and flows to your database server is also essential, with alerts set up for any suspicious activity.

What Can Attackers Do Once They Have Access to Your Network?

Ransomware: Attackers can use all types of network attacks to withhold access to your data and operations, usually through encryption, in the hope of a pay-out.
Data destruction/theft: Once attackers have breached your perimeter, without controls they can access critical assets such as customer data. This can be destroyed or stolen causing untold brand damage and legal consequences.
Crypto-jacking: These types of cyber attacks are usually initiated when a user downloads malicious crypto-mining code onto their machine, or by brute-force using SSH credentials, like the ‘Butter’ attacks monitored by Guardicore labs over the past few years.
Pivot to attack other internal applications: If a hacker breaches one area, they can leverage user credentials to escalate their privileges or make lateral moves to another more sensitive area. This is why it’s so important to isolate critical assets as well as take advantage of easy and early wins like separating the production arm of your company from development.

The Most Common Types of Cyber-Security Attacks are Always Evolving

With so many types of cyber attacks risking your network, and subtle changes turning even known quantities into new threats, visibility of your whole ecosystem is foundational for a well-protected IT environment.

As well as using micro-segmentation to separate environments, you can create policy that secures end points and servers with application segmentation. This helps to stop a breach from escalating, with strong segmentation policies that secure your communication flows with the principle of least privilege.

On top of this, complementary controls that include breach detection and incident response with visibility at their core ensures that nothing sinister can fly underneath your radar.

The cost of over-compliance

A few weeks ago I visited a prospect who presented me with an interesting business case.
They are a financial services company with all their applications hosted on their premises.
As expected from a financial services company, they are heavily regulated – having to meet PCI DSS and other standards and requirements.

When they started their business ~10 years ago, the core set of their applications were under that or another regulation. At that time a plausible solution was to define all of their production environment as “regulated” and implement all the requirements there. The overhead was small and it made a lot of sense to simplify the management of segregation of regulated from non-regulated.

But over the years the situation has changed quite a lot. In addition to financial applications that remain regulated, they added tens of other applications to their production environment and now the situation is that in fact fewer than 50% of their servers run regulated applications, and the overhead becomes quite big. They estimated a few hundreds of thousands of dollars annually “wasted” on compliance where it is not needed (from licenses on software, auditing hours, and time of compliance oriented engineers internally etc.)

So “why not separate the irrelevant applications from the regulated data-center?” you might ask, and so did I. But here are a few challenges that the prospect presented me with:

  1. The data center is quite complex today, spanning a few different virtualization solutions, networking equipment etc, so separating them into different VLANs will require quite a lot of networking effort.
  2. The regulated and non-regulated applications are interconnected – mapping those dependencies (for identifying the FW rules) is a very complex task without the right visibility.
  3. Some applications are business critical and they cannot afford the down-time associated with moving them to another VLAN, changing their IPs etc – just the thought of that scares away everyone from application owners to leadership.
  4. When looking deeper into the regulation requirements – they would like to separate the “regulated part” even further into separate segments, thus driving the compliance and auditing costs event further down. So take all the problems above and multiply them…
  5. As with all modern organizations, they would like to embrace “new” technologies such as cloud – so they would like to enable this easily within any change they implement in their IT and plan for future expansions.

What a perfect use-case for an overlay segmentation solution as Guardicore!!! We can help implement any size of segments, across any infrastructure, without any downtime, and help save quite a lot of money in the process of uplifting their security posture.

Want to hear more – talk to us.

Understanding and Avoiding Security Misconfiguration

Security Misconfiguration is simply defined as failing to implement all the security controls for a server or web application, or implementing the security controls, but doing so with errors. What a company thought of as a safe environment actually has dangerous gaps or mistakes that leave the organization open to risk. According to the OWASP top 10, this type of misconfiguration is number 6 on the list of critical web application security risks.

How Do I Know if I Have a Security Misconfiguration, and What Could It Be?

The truth is, you probably do have misconfigurations in your security, as this is a widespread problem, and can happen at any level of the application stack. Some of the most common misconfigurations in traditional data centers include default configurations that have never been changed and remain insecure, incomplete configurations that were intended to be temporary, and wrong assumptions about the application expected network behavior and connectivity requirements.

In today’s hybrid data centers and cloud environments, and with the complexity of applications, operating systems, frameworks and workloads, this challenge is growing. These environments are technologically diverse and rapidly changing, making it difficult to understand and introduce the right controls for secure configuration. Without the right level of visibility, security misconfiguration is opening new risks for heterogeneous environments. These include:

  • Unnecessary administration ports that are open for an application. These expose the application to remote attacks.
  • Outbound connections to various internet services. These could reveal unwanted behavior of the application in a critical environment.
  • Legacy applications that are trying to communicate with applications that do not exist anymore. Attackers could mimic these applications to establish a connection.

The Enhanced Risk of Misconfiguration in a Hybrid-Cloud Environment

While security misconfiguration in traditional data centers put companies at risk of unauthorized access to application resources, data exposure and in-organization threats, the advent of the cloud has increased the threat landscape exponentially. It comes as no surprise that “2017 saw an incredible 424 percent increase in records breached through misconfigurations in cloud servers” according to a recent report by IBM. This kind of cloud security misconfiguration accounted for almost 70% of the overall compromised data records that year.

One element to consider in a hybrid environment is the use of public cloud services, third party services, and applications that are hosted in different infrastructure. Unauthorized application access, both from external sources or internal applications or legacy applications can open a business up to a large amount of risk.

Firewalls can often suffer from misconfiguration, with policies left dangerously loose and permissive, providing a large amount of exposure to the network. In many cases, production environments are not firewalled from development environments, or firewalls are not used to enforce least privilege where it could be most beneficial.

Private servers with third-party vendors or software can lack visibility or an understanding of shared responsibility, often resulting in misconfiguration. One example is the 2018 Exactis breach, where 340 million records were exposed, affecting more than 21 million companies. Exactis were responsible for their data, despite the fact that they use standard and commonly used Elasticsearch infrastructure as their database. Critically, they failed to implement any access control to manage this shared responsibility.

With so much complexity in a heterogeneous environment, and human error often responsible for misconfiguration that may well be outside of your control, how can you demystify errors and keep your business safe?

Learning about Application Behavior to Mitigate the Risk of Misconfiguration

Visibility is your new best friend when it comes to fighting security misconfiguration in a hybrid cloud environment. Your business needs to learn the behavior of its applications, focusing in on each critical asset and its behavior. To do this, you need an accurate, real-time map of your entire ecosystem, which shows you communication and flows across your data center environment, whether that’s on premises, bare metal, hybrid cloud, or using containers and microservices.

This visibility not only helps you learn more about expected application behaviors, it also allows you to identify potential misconfigurations at a glance. An example could be revealing repeated connection failures from one specific application. On exploration, you may uncover that it is attempting to connect to a legacy application that is no longer in use. Without a real-time map into communications and flows, this could well have been the cause of a breach, where malware imitated the abandoned application to extract data or expose application behaviors. With foundational visibility, you can use this information to remove any disused or unnecessary applications or features.

Once you gain visibility, and you have a thorough understanding of your entire environment, the best way to manage risk is to lock down the most critical infrastructure, allowing only desired behavior, in a similar method to a zero-trust model. Any communication which is not necessary for an application should be blocked. This is what OWASP calls a ‘segmented application architecture’ and is their recommendation for protecting yourself against security misconfiguration.

Micro-segmentation is an effective way to make this happen. Strict policy protects communication to the most sensitive applications and therefore its information, so that even if a breach happens due to security misconfiguration, attackers cannot pivot to the most critical areas.

Visibility and Smart Policy Limit the Risk of Security Misconfiguration

The chances are, your business is already plagued by security misconfiguration. Complex and dynamic data centers are only increasing the risk of human error, as we add third-party services, external vendors, and public cloud management to our business ecosystems.

Guardicore Centra provides an accurate and detailed map of your hybrid-cloud data center as an important first step, enabling you to automatically identify unusual behavior and remove or mitigate unpatched features and applications, as well as identify anomalies in communication.

Once you’ve revealed your critical assets, you can then use micro-segmentation policy to ensure you are protected in case of a breach, limiting the attack surface if misconfigurations go unresolved, or if patch management is delayed on-premises or by external vendors. This all in one solution of visibility, breach detection and response is a powerful tool to protect your hybrid-cloud environment against security misconfiguration, and to amp up your security posture as a whole.

Want to hear more about Guardicore Centra and micro-segmentation? Get in touch.

Want to learn more about securing data centers and clouds? Check out our white paper.

Read More