Palo Alto Networks Unit 42 is proud to announce that four of our researchers were named to the Microsoft Security Response Center (MSRC) “Top 100 Security Researchers List” for 2018. This is the third year Unit 42 researchers have been included in this prestigious list, which is announced every year at Black Hat. This year’s Unit 42 winners are:
Rank
Name
10
Gal De Leon
13
Hui Gao
73
Tao Yan
79
Jin Chen
Palo Alto Networks is a regular contributor to vulnerability research in Microsoft, Adobe, Apple, Android and other ecosystems. By proactively identifying vulnerabilities, developing protections for our customers, and sharing them with Microsoft for patching, we are removing weapons used by attackers that compromise enterprise, government and service provider networks.
Below is the full list of this year’s top 100. To better understand how this recognition is both important and an honor, this posting by Phillip Misner of the MSRC gives you an idea of what’s behind the program.
The dream of a cloud-enabled operational technology, or OT, environment is becoming a reality thanks to daily innovations in technology, which have the potential of turning legacy control systems into integrated IIoT instances. These changes are happening at a fast pace, and are often extraordinary in scale. Large scale ICS SCADA systems, such as those found in oil and gas are evolving; however, one thing remains constant: poor security.
Why Security Is a Challenge
As IT security professionals know, security must adapt to an ever-changing threat landscape. A fluid model does not play well with most current ICS and SCADA systems. These systems depend on availability first, making the application of security measures challenging to implement and even harder to maintain. For OT operators, security must support a model that allows technicians to connect devices first to configure and fine-tune them, and then later lock them down. There must be enough security in place to protect both the business and the process control environment from attacks, but with just enough protection that it neither overcomplicates the automation groups workflows nor stops, blocks or disrupts production.
Purpose-built and expensive to update or replace, these systems and networks do not conform to the equipment lifecycle of an IT network. The majority of oil and gas field networks and remote process control networks are archaic, but also happen to be the systems we take for granted on a daily basis. Attackers know that, when and if these systems fail, they can affect our daily lives.
What’s Next?
It is time we change our beliefs on what a secure network looks like and how it should work? As organizations adopt cloud-based infrastructures and other IIoT technologies, security does not have to be an afterthought. Our Security Operating Platform secures control system networks in several ways, including automatically preventing new and unknown threats, providing virtual network segmentation and offering role-based network access.
In recent research, Palo Alto Networks found attackers were targeting home routers to take control and use them for attacks against other websites that can bring them down. Here we explain this type of attack and what you should do.
Why should I care, what can it do to me?
These attacks could affect you in two ways:
They can slow down or disrupt your internet connection,
They can also make you an unwitting participant in attacks against other websites.
What causes this kind of attack?
Weak passwords and out-of-date software can both enable attackers to take complete control of your home router.
How can I prevent it?
Attackers target home routers like this by targeting default passwords and out-of-date software on the routers. An easy thing you can do is restart your router once a week (typically by unplugging it).
You can also stay safe by changing the password on your router and updating the software. If you’re not sure how to do this, contact your Internet Service Provider (ISP) that gave you the router for help.
How does it work?
When devices (in this case, the routers) are under someone else’s control like this, the collection is referred to as a “botnet”, a network (-net) of remotely controlled systems or devices (bot-).
When attackers have complete control of your home router, they can install attack software that they control, turning the device into a “bot”. Attacks can make all the controlled routers in a botnet do anything they want, including sending huge amounts of data to try and bring websites down.
These kinds of attacks are called “Distributed Denial of Service” or “DDoS” attacks. Attackers use them to take down websites for several reasons:
Personal or political reasons
To blackmail websites to pay money or face attack
To act as a diversion for other more serious attacks
Simply to create mischief
About
Threat Briefs are meant to help busy people understand real-world threats and how they can prevent them in their lives.
They’re put together by Palo Alto Networks Unit 42 threat research team and are meant for you to read and share with your family, friends, and coworkers so you can all be safer and get on with the business of your digital life.
Got a topic you want us to write about for you, your friends, or your family? Email us at u42comms@paloaltonetworks.com.
In this Q&A, Danielle Kriz, senior director of Global Policy, and Fred Streefland, senior manager of Product Marketing for EMEA, cover the basics of the EU’s Network and Information Security Directive and what it might mean for organizations.
Fred: Let’s talk about a new cybersecurity law in the European Union, the Network and Information Security (NIS) Directive. What is it, who does it apply to, and what do they need to do?
Danielle: It’s the EU’s first law specifically focused on cybersecurity, which I blogged about in May. Through transposition into national laws, it applies in all 28 EU member states.
The NIS Directive aims to improve the cybersecurity capabilities of the EU’s critical infrastructure by setting security and incident notification obligations across many types of organizations offering essential and digital services. The NIS Directive also requires member states to enact national cybersecurity strategies and engage in EU cross-border cooperation, among other measures.
The requirements on industry outlined in the NIS Directive are applicable to two categories of entities: operators of essential services and digital service providers. Although the directive outlines generally what is in these categories, each member state is responsible for identifying the OES established in their territories that are in scope.
Operator of Essential Services (OES): Sectors covered include energy (e.g., electricity, oil and gas companies), transportation (including air, rail, water and roads), healthcare (like hospitals and clinics), certain banking and finance (such as credit) institutions, suppliers and distributors of drinking water, and digital infrastructure (like internet exchange points).
Digital Service Provider (DSP): There are three categories: online marketplaces, online search engines and cloud computing services. The Directive has some small company exceptions for DSPs.
The directive sets security and incident notification obligations on these organizations. They must:
Take appropriate and proportionate technical and organizational measures to manage risks to the security of their network and information systems, and these measures must “have regard to the state of the art.”
Take appropriate measures to prevent incidents affecting the security of their network and information systems.
Notify competent national authorities of security incidents of particular magnitudes.
These requirements are related to the networks and information systems used to provide the covered essential or digital services. The requirements also apply whether the OES or DSP manages its own network and information systems or outsources them.
The EU’s Agency for Network and Information Security (ENISA) has details on the directive.
Fred: How is the NIS Directive rolling out?
Danielle: The NIS Directive sets out objectives and policies to be attained through legislation at an EU member state level. All 28 EU countries were required to put the directive into national law by May 2018 (although the reality is that as of August 2018, some still were behind).
The impact will vary based on how each country previously regulated companies for cybersecurity. Some member states will make big changes and introduce new laws. Other member states might have existing laws into which they will need to integrate NIS requirements.
ENISA has issued non-binding guidelines for NIS so companies may want to look there. But many member states are expected to issue their own requirements. The European Commission has published a useful “state-of-play” of member states’ implementation of the NIS Directive.
Fred: Do non-EU headquartered companies need to worry about NIS?
Danielle: Yes, if they offer any of the covered essential or digital services in one or more EU countries. Regardless of whether a company is headquartered in the EU or not, companies covered under NIS must follow the law in the EU country where they have their main establishment. In fact, even companies providing digital services in the EU with no physical presence in the EU at all may be affected by the NIS Directive.
Therefore, we recommend that organizations operating in EU countries should do research and obtain legal advice on whether NIS applies to them and the exact details of what they must do.
Danielle: Now, let me ask you some questions, Fred. Assuming you are responsible for the security of an organization that needs to comply with the EU Network and Information Security Directive, what does this mean to you and the organization? As a former CISO, what would you do and how would you approach this?
Fred: Every operator of essential services or digital service provider in the EU needs to comply with this NIS Directive (with some small company DSP exceptions). You mentioned the requirements: they need to take measures that have regard to state-of-the-art technologies to manage the risks of their network and information systems. They must take appropriate security measures to prevent and minimize the impact of security incidents. Besides this, they also have the obligation to report security incidents of a certain magnitude to their national authority.
As a responsible person for information security, you need to become “in control” of the risks of your network and information systems. So, I would focus on what matters and start with getting visibility into the security of your network and information systems.
This means understanding:
– Which networks and information systems support the covered services and how they are currently secured.
– Whether the products and services you use to protect those networks/systems account for the state of the art.
– What measures you are taking to prevent and minimize the impact of incidents on those networks and systems.
– If you are able to track and identify the impact of incidents that may occur so that you are able to notify authorities as needed.
I also recommend reading a recent blog by Greg Day, our CSO for EMEA, that explains how CISOs can view the NIS Directive as a positive opportunity for change.
Danielle: Again, from the CISO perspective, what is the final takeaway you’d like to share?
Fred: It is imperative to get proper visibility into your networks, information systems and data. In my opinion, that’s a prerequisite for effective security and compliance.
Palo Alto Networks is committed to assisting our customers on their road towards NIS Directive compliance. If you want to know how we can help, please attend our upcoming EU NISD webinar.
The information provided in this blog, concerning technical legal or professional subject matters, is for general awareness only, may be subject to change, and does not constitute legal or professional advice, nor warranty of fitness for a particular purpose or compliance with applicable laws. Always consult a qualified lawyer on any specific legal problem or matter.
That’s right! The August release of the Traps management services introduces five new features designed to simplify endpoint management and security event investigation:
1. Clickable Dashboard—From the Dashboard you can now jump to a filtered list of endpoints that share any of the following characteristics:
Platform operating system
License status (to view a list of all licensed endpoints)
Content update status (latest or outdated)
For security events, you can also jump to filtered lists of unresolved events by severity. The Dashboard quick links enable you to quickly identify endpoints for which administrative action may be required.
2. Enhanced Endpoint Filters—To refine the number of endpoints on the Endpoints page, you can now apply new endpoint search filters:
Agent Version—Filters all endpoints for specific agent versions. Using this filter you can quickly identify all endpoints running older Traps versions and upgrade them to the latest Traps version thus ensuring the endpoint takes advantage of the latest security policy and Traps features.
Content Version—Filters all endpoints for specific content update versions. This filter provides visibility into which endpoints are using older content versions.
3.Security Event Search by Event ID—If you already know the unique event ID for a security event, you can now use that ID to quickly locate a security event. To filter security events for an Event ID you must enter the complete ID value.
4. Hash Exceptions Search —To quickly locate a hash exception, you can now search hash exceptions using the complete SHA256 value.
5. Process Exceptions Assignment Enhancement—To quickly configure process exceptions for select endpoints, you can now assign process exceptions to endpoint groups, AD groups, and AD organizational units (OU). Process exceptions will apply only to the platform type specified in the exception. In addition, in the case of AD objects that specify users and endpoints, a process exception will apply only on endpoints.
For more details on the new features, please refer to the following resources:
