Be Yourself. By Yourself.
The Cyber Attack Lifecycle is a sequence of events that an attacker must go through to successfully infiltrate a network and exfiltrate data from it. Check out this recent eWEEK slideshow to understand how to anticipate what attackers will do and protect data wherever it resides.
Want to learn more? Download this whitepaper, “Breaking the Cyber Attack Lifecycle.”
[Palo Alto Networks Blog]
In this latest Lightboard session, Kate Taylor takes us through the three steps of the Palo Alto Networks multi-layered advanced threat detection approach: reduce the attack surface, leverage the sandbox and advanced malware detection techniques, and perform static and dynamic analysis of a file. Watch below:
[Palo Alto Networks Blog]
We modeled the Cybersecurity Canon after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite.
The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!
Book Review by Canon Committee Member, Christina Ayiotis: @War: The Rise of the Military-Internet Complex (2014) by Shane Harris
Shane Harris takes us on a journey from the Iraq War “surge” (arguably the first cyber war) to the almost weekly hacks of 2014 to demonstrate the rise of a military-Internet complex and the prescience of Eisenhower’s admonition regarding the power of a military-industrial complex. Harris ends @War by reminding us that only “an alert and knowledgeable citizenry” ensures “security and liberty may prosper together.” (EMPHASIS ADDED)
Harris is a first-rate storyteller providing just enough context (and detail) to enable readers to easily follow the evolution of cybersecurity and cyberwarfare, and to make them feel like they personally know the important players. As a member of this Inside the Beltway Cyber Community (who knows at least one third of the people cited or referenced in the book), I think he’s done a terrific job of accurately representing them and their viewpoints. While not very technical, this book should still appeal to the technical community interested in understanding the bigger picture in which they operate. I’d actually make @War required reading in high school and college—the next generation needs to better understand all things cyber, and the implications of future technological capabilities, as well as their own role and the risks inherent in an increasingly interconnected, wired world.
It is particularly difficult to review a book that has already been reviewed by professionals at major news outlets and Think Tanks (not to mention Amazon or goodreads). I will not regurgitate what they’ve already said—I encourage all to read those very good reviews. My bent is looking at the book’s value as part of the Cybersecurity Canon. Since I take a broad view of the definition of cybersecurity professional, I consider @War to be foundational, enabling those who comprise the cybersecurity community to better understand the larger geopolitical and economic context in which they live and work. The headlines of the past few years provide the outline of a story and @War fills in many of the details. This is a book that any cyber professional can have family members and friends read; once read, they can all have lively, informed discussions on the hot topics of surveillance, espionage, power grabs, etc.—it is that readable and engaging.[1]
By starting the book with the story of a war hero’s success using signals intelligence (SIGINT), Harris predisposes the reader to want to use such techniques to succeed in other contexts. (Most do not know this backstory regarding reduced IED deaths in Iraq, though they probably should—it solidified the “new” way wars are fought.) He doesn’t shy away from highlighting the dubious legal validity of certain data-gathering processes and provides much historical context (sometimes from the 2013 “unauthorized disclosures”). He pinpoints exactly when “[t]he military-Internet complex was born.”[2]
Harris chronicles in detail how the Cyber Army was built, including the role of the private sector. He persuades us that the Internet has become militarized and is now a legitimate battlefield. His detailed account of the creation and evolution of U.S. Cyber Command, including its complicated relationship with the NSA, is important in understanding how the military-Internet complex came about and is evolving. The internecine feuding between the various branches of government responsible for cybersecurity is worthy of its own soap opera.
The book gives great context to understand today’s major controversies around encryption, bug bounties, and surveillance programs/capabilities negatively impacting U.S.-based technology multinationals. Harris covers the established players, as well as the disruptive upstarts. He drills down into various scandals from Hunton & Williams’ proposed cyber propaganda operation that “killed” HBGary[3] to LabMD’s FTC woes because of Tiversa.[4]
Finally, Harris provides unprecedented detail on the role private sector entities play in the “business of defense”—whether it’s the commoditization of cyber services for both government and private sector customers (Lockheed’s “Cyber Kill Chain”[5]) or how threat intelligence services and marketing strategies can influence U.S. policy (Mandiant’s APT1 Report—“The government would never have been so bold as to come out with such a report.”[6]).
My only criticism is on the editing front—there should have been no typos (and, in acronym-obsessed D.C., there should not have been a “HIPPA”-like mistake regarding the important classified Presidential Policy Directive).
This book tells a compelling story about where cybersecurity is headed, given the “rise of the military-Internet complex,” and enables cybersecurity professionals to understand their place in the ecosystem. It should be part of the Cybersecurity Canon, as well as required reading for students and CEOs alike. Technological capability is evolving exponentially, and we all need to be prepared to meet the challenges and opportunities presented—@War will help on that front.
As someone who believes in the importance of expressing gratitude (early and often), I was struck by how thoughtful and heartfelt Harris’ three-and-a-half pages of acknowledgements are.Cyber as a discipline and a profession is ever-evolving; understanding it requires having many diverse, trusted relationships. Properly and creatively recognizing and appreciating them is an art form.
[1] As a cyber-professional/corporate attorney/former GWU Adjunct Professor of Information Policy, I can attest to the importance of books that read like best-selling thrillers.
[2] Shane Harris, @War: The Rise of the Military-Internet Complex (Houghton Mifflin Harcourt 2014), p. 31.
[3] Ibid., p. 116.
[4] Ibid., p. 117.
[5] Ibid., p. 199.
[6] Ibid., p. 207.
[Palo Alto Networks Blog]
Regular readers of this blog have heard all about the infamous Kuluoz malware. This family was the latest evolution of the Asprox malware and at its peak in 2014 it accounted for 80% of all malware sessions we observed in WildFire. When the team published our Threat Landscape Review in December of last year, we highlighted this family as a scourge that impacted nearly every company Palo Alto Networks protected in 2014. Kuluoz was primarily distributed through e-mail, which means we saw large numbers of SMTP sessions, but also downloads over a variety of webmail clients.
Even if you didn’t read our blogs, you probably dealt with Kuluoz. Throughout 2014, most of the waves of spam e-mails carrying fake court notices, voicemail messages and package delivery alerts carried a Kuluoz attachment. If you opened these attachments you quickly became part of the botnet, sending copies of the malware to other victims while the botmaster silently installed additional malicious software on your system.
Given all of this activity, we were quite surprised when the malware all but disappeared at the end of December 2014.
The screenshot above shows the number of malware sessions per week that we tagged as “Kuluoz” in the AutoFocus service. When we first noticed the drop-off, our suspicion was that we were “missing” the new Kuluoz samples. Just weeks earlier we published a report that highlighted their tactics — a tactical shift in response would not have been unprecedented.
As weeks turned into months, we found that Kuluoz didn’t return. We weren’t the only ones who noticed; Brad Duncan wrote a blog for the SANS indicating that the e-mails which had previously carried Kuluoz were now just…spam.
Based on the data we’ve collected, the Kuluoz command and control infrastructure largely shut down in January and the botnet is no more. We continue to capture new samples of Kuluoz in WildFire as orphaned infections continue sending out newly-crypted variants of the malware, but the numbers are a tiny fraction of Kuluoz at its peak.
The original Asprox botnet has gone through multiple incarnations since it came online in 2007. We’ve not yet seen any indication that the individuals behind these attacks have been arrested or forced to stop operating, so it’s likely that they’ve shut down this botnet to regroup and redeploy after they’ve found ways to evade the detections deployed by the security industry. After all, sending 80% of all malware puts you pretty high on everyone’s list of priorities.
If you are wondering what malware has replaced Kuluoz as our top family, the reigning champion is Upatre, which is a downloader that typically installs the Dyre banking Trojan or the CryptoWall Ransomware. It’s not nearly as prevalent as Kuluoz, but it’s certainly making an impression:
[Palo Alto Networks Blog]
Research shows that the majority of employers—nearly 7 in 10—are requiring cybersecurity job candidates to hold a certification. They are also looking for candidates with hands-on skills. When a prospective employee has CSXP, it indicates that they fulfill both of those criteria and that he or she has the skills needed to help protect the organization.
To earn CSXP, candidates must pass an exam in a state-of-the-art, adaptive, performance-based cyber laboratory environment. The exam measures skills and abilities in a virtual setting using real-world cyber security scenarios. Registration is now open for the exam, and a beta test rate is available for those who take the exam and complete a survey by 1 October 2015.
Very soon, ISACA’s CSX will offer cyber training and certifications for all skill levels and specialties:
It is an exciting time of opportunity for cyber professionals. Companies and government organizations need you more than ever. As you grow your career in this area, know that we are here for you—we will help you stand out, grow your career and connect with a global community of cybersecurity experts.
Christos Dimitriadis, Ph.D., CISA, CISM, CRISC
2015-2016 ISACA International President
[ISACA]
