Story image

Carbon Black claims there's a link between geopolitics and cyberterrorism

25 Jul 18

China, North Korea, and Russia are responsible of many of the world’s cyber attacks, and according to Carbon Black those countries are both operationalizing and supporting advanced cyber militias.

Those are some of the findings from the company’s Quarterly Incident Response Threat Report, which points the finger at the link between geopolitical tensions and increasing cyber warfare efforts.

“Geopolitical tensions manifest in cyberspace. There is a direct link between the failures of diplomacy and cyberespionage and cyberterrorism. The cold war adversaries have colonised wide swaths of Western cyberspace. This is compounded by the reality that organised crime syndicates have migrated their criminal conspiracies online,” says Carbon Black’s chief cybersecurity officer, Tom Kellermann.

According to the report, Russia is the origin point for most attacks, but China follows close behind. North America, Iran, North Korea, and Brazil also round out the top six.

Those intrusions are no longer reserved for select targets and they are a threat to all organizations, he continues.

According to the report, 31% of incident response professionals say that the reasons behind cyber attacks are not just financial gain or data theft, but also espionage.

Attackers are also moving laterally throughout systems – 59% of attacks use this tactic, which means they aren’t targeting one part of a system. Instead, they are moving around and seeing more targets as they go.

PowerShell is a popular tool of choice for attackers seeking lateral movement.

Attackers are also getting wise to organisations’ incident response strategies.

The report says that 46% of respondents say they’ve experienced instances of counter incident response.

“The cyber intrusions of today have evolved from burglary to home invasion. Today’s cyber intrusions are more persistent and more destructive.  In fact, the Cb Incident Response Threat Report noted that over 46% of cyber intrusions experiences counter-incident response e.g. The adversary was fighting back to remain in the system.  The same study noted that 10% have experienced destructive attacks,” Kellermann says.

Carbon Black also notes that because criminals can sniff out incident response strategies, those strategies must now evolve to become stealthier.

Finally, 36% of respondents say attackers now use victims for ‘island hopping’.

“In these campaigns, attackers first target an organization’s affiliates, often smaller companies with immature security postures. This means that not only is your data at risk, but so is the data at every point in the supply chain, including customers and partners,” Kellermann concludes.

The Quarterly Incident Response Threat Report quizzed 37 leading incident response organisations, all of which were Carbon Black partners.

Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.