Intelligence as the Basis for Proactive Security Risk Management

There has been a significant shift recently in the sophistication of network attacks as these morph from unstructured to structured threats. Users not only face a broader variety of security challenges but also have a tougher time in dealing with them in a cost effective manner. Those organisations which found that they were unprepared to deal with unstructured threats will have no hope now that the ante has been raised.

An example of the transition is the difference between Phishing and Spear-Phishing. Phishing plays on the law of numbers, randomly blasting out the scheme to a wide variety of potential victims. Spear-Phishing, however, is intelligence-based and targeted towards a particular establishment or victim profile. Yes, times are changing. The big question is how can we beat these adversaries?

Let’s start by putting ourselves in the position of the adversary for a second. What resources do you need and what is your end-goal? As the attacker your goal is to exploit as many machines as you can (without getting caught) and you start by acquiring knowledge about the weaknesses on the victim’s network. The advantage goes to who knows this information first, the victim or the adversary? I am grossly oversimplifying but the longer story is a whitepaper.

So the answer is simple, right? Just find all the weaknesses and fix them. Reality Check: no one can be effective working on a never-ending list of action items. The good news is that software tools can now analyse all relevant information for the potential victim before they are in the crosshairs of an active threat. By understanding what the potential threats are and how they relate to an individual network, the potential victim can protect their most valuable assets before an attack is launched.

In this game, intelligence is key.

The victim has no offence, so it is all about developing a proactive defence and reducing the target surface. As we know ‘mytob’ is noted as having 97 different variants. If you take away the line-of-site to the vulnerability, you have an advantage to the adversary even if they keep producing variations on the same theme.

The nature of the vulnerabilities and exploits is not new; it is what the adversaries do after they compromise the target that is the new and frightening challenge. The real problem is that the primary ‘point of entry’ remains a weakness in the target, allowing the attackers to fine tune their assault and hit a victim again and again. Why have the adversaries changed their behaviour? Because there is money to be made!

This problem is only going to get larger. And the reason, once again, is that it all comes down to one thing – MONEY. The adversaries can make money with your credentials – end of story. The buyers are called “Cashers’ and they live a symbiotic relationship with the “Phisher’. The big problem in the past was how to turn this intelligence in to cold hard cash.
Online gambling is starting to help these guys in a big way. It goes like this: The Casher picks up some great “dump’ of cards and then teams up with someone to do some online gambling. The Casher buys in big with the stolen credentials, loses to his cohort, and now the credit has been converted to cash.

We can call them many things (Phishers, hackers, attackers, organized crime), but let’s just call them what they really are – BAD_GUYS and recognise that the GOOD_GUYS are struggling. The business is all about intelligence. They steal it from you and sell it. But what we must remind ourselves is that the game starts well before that play. The intelligence they need to begin their plan is the same information you need to defend your network and resources. You just need to be the one that is proactive in getting and using this knowledge first.