Author: Dr. Philip Cao

Malware is code that is written to accomplish a malicious purpose. In most cases the malware also has the ability to spread or infiltrate other systems or programs. Sometimes the malware’s purpose is just to show off the author’s hacking prowess, but more recently the purpose has typically been to make money, steal information or cause damage. In some cases, the scope of the malicious intent and damage has been to such an extent that we call it cyberterrorism or cyberwarfare. Think of the recent attack on Sony, which appears to be prompted by the film The Interview.

Over the years, types of malware are often given colorful and even scary names. Viruses, worms and Trojan horses were terms coined in the 1980s for various types of malicious code. More recently, we have described certain attacks as advanced persistent threats (APTs) and advanced malware. Advanced malware tends to be targeted, stealthy, evasive and adaptive. This compared to previous types of malware that generally tried to spread to as many programs or systems as possible, often in an indiscriminate and “noisy” fashion.

APTs are advanced malware which The US National Institutes of Standard (NIST) defines as follows:

An adversary that possesses sophisticated levels of expertise and significant resources which allow it to create opportunities to achieve its objectives by using multiple attack vectors (e.g., cyber, physical, and deception). These objectives typically include establishing and extending footholds within the information technology infrastructure of the targeted organizations for purposes of exfiltrating information, undermining or impeding critical aspects of a mission, program, or organization; or positioning itself to carry out these objectives in the future. The advanced persistent threat: (i) pursues its objectives repeatedly over an extended period of time; (ii) adapts to defenders’ efforts to resist it; and (iii) is determined to maintain the level of interaction needed to execute its objectives.

The definition is a bit heavy, but completely in line with the concept that advanced malware has a clear “who” behind it that is writing the code to attack a specific target and carry out a specific mission. The attack is likely to be against a targeted enterprise or even certain individuals like systems administrators within an enterprise. Moreover, the malware is likely to be multipronged with a variety of different ways and techniques to infiltrate a system and extract the desired information. It can be patient and wait for some time before attacking. Also, it will adapt to conditions and try different methods automatically.

Finding and blocking this type of code can be difficult for traditional antivirus software because chances are the attack will never have been seen before. This means that no antivirus signature will have been created for the malware. Behavior blocking and reputation-based antivirus techniques might be somewhat effective. For instance, since the malware will likely try to extract and send confidential data somewhere, that type of unusual behavior might be discoverable and blocked. However, the people creating advanced malware are likely to test their creations’ evasive and stealth capabilities against most popular antivirus and security products.

So who writes this stuff? While individual hackers might write advanced malware, more often it is the product of dedicated teams from nation states, organized crime groups or terrorist organizations. Advanced malware is built and tested with a degree of professionalism and dedication similar to that found in legitimate software product teams.

Scared? You’re not alone. One in five respondents noted that their organization has already experienced an APT attack in a recent ISACA survey, and 66 percent believe it is only a matter of time before their organization is hit by one. Additionally, 92 percent believe that APTs are a serious threat.

So what can an organization do to protect against advanced malware? Improved training and multiple layers of security are clearly part of the answer, and ISACA’s Cybersecurity Nexus (CSX) has a helpful guide on the subject available.

I also discussed the reality of advanced malware in an article for Processor. Read the full article here.

Rob Clyde, CISM
CEO, Adaptive Computing

[ISACA]

Today marks Data Privacy Day, and ISACA is proud to be a champion of this initiative. The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. The debate over privacy seems to have shifted to a larger discussion about new types of personal information, such as location information, browsing history, Internet of Things data, individual rights and enterprise use of personal data. This expanding debate results from the proliferation of technologies, opportunities for enterprises to gain value by leveraging new data items and government’s interest in e-government initiatives. This includes taking action to protect citizens and promoting the economic opportunities that personal data use brings. The volume of personal, and often sensitive, data being collected and shared by organizations today is growing exponentially—largely because of technology advances, lower data storage costs, the rise of the Internet of Things and the emergence of major data brokerage companies.

Currently, there is a global set of privacy principles in the OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (2013) . In the last couple of years, the principle of accountability has received renewed attention as a means to promote and define organisational responsibility for privacy protection.

To help the global community implement a corresponding privacy management program, ISACA created a Privacy Guidance Task Force. Its first task was to conduct a survey regarding enterprises’ privacy governance structures and how various privacy issues and concerns are addressed. Clearly, one of the main obstacles is the complex international legal and regulatory landscape. While everybody may be in agreement on the principles, their implementation through laws and/or regulation differs across the world and, in some cases, in the same country, by state and industry sector. Obviously, business may only influence the lawmakers to try to harmonize their position. This will be difficult as privacy is a cultural issue. ISACA’s survey was recently conducted, and results will be published in the near future.

Enterprises need to embed privacy as an integral component of their overall governance, risk management and compliance (GRC) frameworks. Embedding privacy into GRC frameworks requires a holistic approach. COBIT 5 defines a set of enablers to support the implementation of a comprehensive governance and management system for enterprise IT and information.

As a result, the next Task Force action is to create practical guidance explaining how the COBIT 5 enablers may be used for implementing privacy in practice. It will provide specific guidance related to all enablers:

1. Information privacy policies, principles and frameworks
2. Processes, including personal data privacy—specific details and activities
3. Privacy-specific organisational structures
4. In terms of culture, ethics and behaviour, factors determining the success of privacy governance and management
5. Privacy-specific information types for enabling information security governance and management within the enterprise
6. Service capabilities required to provide privacy and related functions to an enterprise
7. People, skills and competencies specific for privacy

This will constitute a framework that can be tailored to any organization. Large companies with locations in multiple jurisdictions may need to consider different internal oversight mechanisms than small or medium sized companies with a single establishment. Similarly, programs for companies that deal with large volumes of personal data will need to be more comprehensive than those of companies who handle only limited amounts of personal data. The sensitivity of the data processed may also impact the nature of a privacy management program, as even a very small company may handle extremely sensitive personal data.

With the survey and practical guidance targeted to be published in 2015, ISACA will continue on its mission to contribute effectively to the promotion of privacy and data protection best practices.

Yves LeRoux, CISM, CISSP
Principal Consultant at CA Technologies

[ISACA]