Talk by James Ryan.
An Advanced Persistent Threat is basically a massively coordinated long term hack attack, often accomplished by nation states or other “very large” organizations, like a business looking for intellectual property and information. They try to avoid getting caught because they have invested capital in the break in and want to avoid the re-break in. APTs are often categorized by slow access to data. They avoid doing things rapidly to avoid detection.
Targets. There is a question about targets and who is being targeted. Anything that is crucial infrastructure is targeted. James Ryan says that we are losing the battle. We are now fighting (as a nation) nation states with an organized crime type of feel. We haven’t really found religion to make security happen. We still treat security as a way to stop rogue 17 year old hackers.
The most prevalent ways to engage in APT is through spear phishing with malware. The attacker at this point is looking for credentials (key loggers, fake website, …). Then damage by doing data exfiltration, data tampering, shutdown capabilities. One other way to avoid getting caught is have the APT get hired in the company.
APT uses zero-day threats and sits on them. They them it to stay on the network.
We should think that the APT is always going to be on our network and they are going to get there regularly. We can avoid risk to APT by doing the following.
- Implement PKI on smartcards, enterprise wide (PKI is mathematically proven to be secure for the next 20 years)
- Hardware based PKI, not software
- Implement network authentication and enterprise single sign on eSSO with PKI
- Remote access tied to PKI keycard/smartcard
- Implement Security Event Information Management and correlate accounts and run triggers on multiple simultaneous session trigger. Also tie this with physical access control.
- Implement PKI with privileged users as well (admins, power users)
- Decrease access per person and evaluate and change
- Create email tagging from external (avoid spear phishing)
- Training and testing using spear phishing in the organization
- Implement USB control to stop external USB
- Background checks and procedures
James Ryan spent time talking about PKI and the necessity of using it. I agree that we need to have better user management and if you operate on the assumption that Advanced Persistent Threat operators try to go undetected for a long amount of time and also try to get valid user credentials then it is even more so. The thing that we need to do is control users and access. This is our biggest vector.
Takeaways:
- APT is real and dangerous
- Assume network is owned already
- Communicate in terms of business continuity
- PKI should be part of the plan
- Use proven methods for executing your strategy
the agile admin 