Story image

Carbon Black claims there's a link between geopolitics and cyberterrorism

25 Jul 18

China, North Korea, and Russia are responsible of many of the world’s cyber attacks, and according to Carbon Black those countries are both operationalizing and supporting advanced cyber militias.

Those are some of the findings from the company’s Quarterly Incident Response Threat Report, which points the finger at the link between geopolitical tensions and increasing cyber warfare efforts.

“Geopolitical tensions manifest in cyberspace. There is a direct link between the failures of diplomacy and cyberespionage and cyberterrorism. The cold war adversaries have colonised wide swaths of Western cyberspace. This is compounded by the reality that organised crime syndicates have migrated their criminal conspiracies online,” says Carbon Black’s chief cybersecurity officer, Tom Kellermann.

According to the report, Russia is the origin point for most attacks, but China follows close behind. North America, Iran, North Korea, and Brazil also round out the top six.

Those intrusions are no longer reserved for select targets and they are a threat to all organizations, he continues.

According to the report, 31% of incident response professionals say that the reasons behind cyber attacks are not just financial gain or data theft, but also espionage.

Attackers are also moving laterally throughout systems – 59% of attacks use this tactic, which means they aren’t targeting one part of a system. Instead, they are moving around and seeing more targets as they go.

PowerShell is a popular tool of choice for attackers seeking lateral movement.

Attackers are also getting wise to organisations’ incident response strategies.

The report says that 46% of respondents say they’ve experienced instances of counter incident response.

“The cyber intrusions of today have evolved from burglary to home invasion. Today’s cyber intrusions are more persistent and more destructive.  In fact, the Cb Incident Response Threat Report noted that over 46% of cyber intrusions experiences counter-incident response e.g. The adversary was fighting back to remain in the system.  The same study noted that 10% have experienced destructive attacks,” Kellermann says.

Carbon Black also notes that because criminals can sniff out incident response strategies, those strategies must now evolve to become stealthier.

Finally, 36% of respondents say attackers now use victims for ‘island hopping’.

“In these campaigns, attackers first target an organization’s affiliates, often smaller companies with immature security postures. This means that not only is your data at risk, but so is the data at every point in the supply chain, including customers and partners,” Kellermann concludes.

The Quarterly Incident Response Threat Report quizzed 37 leading incident response organisations, all of which were Carbon Black partners.

Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).