Connect with us

Cyber Security

What CISOs can learn about insider threats from Iran’s human espionage tactics



Over the last few months, there has been an uptick of espionage revelations concerning Iran and its interest in collecting information against regional adversaries as well as Iranian ex-pats whose views are divergent to those of the current regime. It is important for CISOs to understand the human side to the Iranian offensive efforts to gather information of interest.

Iran recruits eyes within Israel

In mid-January Israel’s Shin Bet (internal security service) revealed four Israeli women had been arrested for espionage, having been successfully recruited by Iranian intelligence via Facebook. The women, all of Iranian descent, were contacted by an individual who identified himself as Rambod Namdar, who claimed to be a Jewish man living in Iran. The modus operandi is one that has been seen many times before: Establish contact via a social network and then daisy-chain the contact to a seemingly more secure communication medium, in this case, WhatsApp.

Shin Bet revealed that this specific operation resulted in the women being paid thousands of dollars over the course of five years.

According to the BBC, one of the women was identified as a 40-year-old woman who lived in the suburbs of Tel Aviv and who was tasked with taking photos of the U.S. Embassy, the interior of the social affairs ministry, and other buildings. Another was identified as a 57-year-old from Beit Shemesh who elicited information and documents from her son, whom she had encouraged to serve in Israeli military intelligence. A third set up a honeytrap configuration in her home, complete with surreptitious video, where she gave “personal massages” to clients from within the Iranian community in Israeli where she would elicit information. Her efforts included targeting a member of the Israeli Parliament.

Iran targets military and energy

Contemporaneously with the above in 2019, a former Israeli cabinet minister (energy and infrastructure), Gonen Segev, was sentenced to prison for 11 years for spying on behalf of Iran. Segev had apparently volunteered to the Iranians while in Nigeria in 2012 and then having made two clandestine trips to Iran where he was trained in a covert communications system that allowed him to communicate with Iranian intelligence in a secure manner.

Similarly, late-November 2021, Omri Goren Gorochovsky, the personal housekeeper for the Israeli minister of defense Benny Gantz, was arrested for collaborating with Iran to compromise the minister’s electronic devices. Gantz, who had unincumbered access to the devices within the minister’s residence, had sent photos of the home, office, computer, mobile phone, tablet, router, IP addresses and more. Shin Bet noted that Gorochovsky was “not exposed to classified materials.” Upon review, it was learned that Gorochovsky was a known felon, a fact that was not picked up by the background check.

Does Iran seed sources?

Then we have the ongoing case in Sweden of two brothers of Iranian descent who have been arrested. One of the brothers, Peyman Kia, is charged with aggravated espionage, according to the Swedish Security Service (SÄPO). Kia was an officer with SÄPO, the Office for Special Information Gathering (KSI) and Swedish Military Intelligence and Security Service (MUST). Pia became a naturalized Swedish citizen in 1994. His linguistic faculty in Persian and knowledge of the middle east made him a treasured and sought-after resource for the Swedish intelligence community.

Insider threat takeaways for CISOs

These are the takeaways that percolate to the forefront for CISOs, as one can easily extrapolate the government espionage experiences to the commercial world where an unscrupulous insider or competitor would use similar techniques.

  1. The use of social networks to spot, assess, develop, and then recruit sources for information is an ongoing threat. Use of professional networks like LinkedIn where individuals splay before the world their professional acumen and current work projects is but one example. The leveraging of Facebook as was the case of the four Israelis arrested serves to emphasize that all espionage is personal. The Iranian officer who handled the four Israelis leveraged the virtual personal relationship to achieve his operational goals.
  2. Background checks are important and non-negotiable. Gorochovsky was a known felon with a rap sheet that included prison time. His access to the minister’s home provided the active criminal mind with ample opportunity to figure out how to best monetize his access. Even if it was a case of giving an individual another chance, that chance should have included close and continuous vetting. Gorochovsky, the insider, leveraged that access and chose Iran as the avenue by which he could achieve a payday.
  3. Even trusted insiders break trust. Did Iran seed a source into Swedish intelligence? While details on this ongoing case continue to be shared piecemeal, a timeline on when Kia began to collaborate with Iranian intelligence has not been shared. Thus, it is possible that from the get-go Kia and his sibling’s emigration to Sweden was part of a long-term plot to garner access to Swedish government entities on behalf of Iran.

Copyright © 2022 IDG Communications, Inc.

Source link

Cyber Security

In-house vs. Outsourced Security: Understanding the Differences



Cybersecurity is not optional for businesses today. Ignoring security can result in a devastating breach or a productivity-sapping attack on the organization. But for many small- and medium-sized businesses (SMBs), the debate often revolves around whether to hire a third party or assemble an in-house security operations team.

Both options have their own pros and cons, but SMBs should weigh several factors to make the best decision for their own unique security needs. An in-house team, a managed security services provider (MSSP), or even a hybrid approach can make sense for various reasons.

Before choosing to build an in-house security team or outsource to an MSSP, businesses must first evaluate their unique needs to ensure the choice lays a foundation for future success.

Weighing control vs. costs

The obvious reason for assembling your own security team is control and immediate knowledge of what goes into your security operations.

“Handling security internally means you will sometimes have better visibility and centralized management,” says Scott Barlow, vice president of global MSP and cloud alliances at Sophos. “That said, if you outsource with the right service provider, visibility into what is going on should not be an issue.”

For many smaller organizations, the cost of running an in-house security program is prohibitive. Hiring skilled security specialists is expensive, and they are often difficult to find. They require regular training, and certifications must be kept fresh – typically at a cost to the employer.

“When you outsource to an MSSP, you will be paying a lot less than paying a senior security executive,” Barlow says. “I suggest that organizations conduct a cost analysis of outsourcing compared to paying salaries. Much of the time, it’s better to outsource.”

There are also technology and license costs to consider. Keeping software licenses up to date can consume both time and money, whereas working with an MSSP means access to the latest technology without worrying about license costs.

If both are important, try a hybrid model

Of course, some large organizations might need an in-house security presence.

“Generally, the larger you become, the more you need someone internally. That is where a co-managed model makes the most sense,” Barlow says.

In a hybrid model, companies tap outside support to collaborate with an internal security executive or team. This approach allows for more scalability while also providing the business with plenty of expertise through their relationship with the MSSP.

“Maybe you want to outsource a portion of the services because you can’t cover 24-7. Or maybe you need coverage on weekends,” Barlow says.

One major benefit to tapping outside support: your in-house team will have more time to focus on mission-critical objectives.

“With a hybrid approach, the internal IT and security teams can pivot to focus on more revenue generating activities,” Barlow says.

Click here to learn more.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Prevention or Detection: Which Is More Important for Defending Your Network?



When it comes to physically protecting a building, you have two primary defenses: prevention and detection. You can either prevent people from entering your property without your permission, or you can detect when they have already trespassed onto your property. Most people would prefer to prevent any trespassing, but a determined adversary is always going to be able gain access to your building, given enough time and resources. In this scenario, detection becomes the only alternative.

The same holds true for protecting assets in the digital world. We have the same two primary defenses: prevention and detection. And just like in the physical world, a determined adversary is going to gain access to your digital assets, given enough time and resources. The question will be: How quickly are you able to determine that an adversary has penetrated your network?

If you can’t prevent, you must discover

This is where detection comes in. Do you have the right tools and procedures in place to find attacks quickly when they are occurring? Most businesses do not. It takes days, weeks, and often even months before an attack is discovered. The gap between breach and discovery is known as dwell time, which is estimated to be more than 200 days in most cases and, according to IBM, as many as 280 days in some instances. If it takes this long to discover that an attack is in process, it may be impossible to determine the root cause if you don’t have enough historical data to review.

Therefore, it is just as important, and maybe even more important, to spend money increasing your ability to detect when a breach has occurred rather than to determine when a breach is actively occurring or to see that specific firewall (FW) or intrusion detection system (IDS) rules have actively prevented an attack. New attacks are taking place all the time, and bad actors are constantly coming up with new ways of infiltrating your network. It is important to understand that, at some point, a bad actor is going to get through and penetrate your network. What will be vitally important is whether you are able to see the attack when it is taking place, or shortly after, or whether instead the attack will be discovered weeks or months after the fact. In the latter case, do you have enough historical data to go back and determine when the attack started, or will that data be long gone by the time you notice something is wrong?

Saving the data you need

It is important to have several months’ worth of data so that you can go back and determine the initial compromise on your network. Having an advanced network detection and response (NDR) tool such as NETSCOUT’s Omnis Cyber Intelligence (OCI) can ensure that you have the data you need. OCI stores all of the relevant information, including layer 2-7 metadata and packets that you need to determine the root cause of an attack—not just flow data that won’t help in this situation.

How much historical network traffic are you storing? Do you have enough data to go back and research the start of an attack if it occurred 200 days ago? Or are you going to rely on catching bad actors faster than the industry average? It is important to understand the need for leveraging both prevention and detection capabilities and ensuring that you have enough storage to thoroughly investigate an attack when it occurs.

Watch this video to see how NETSCOUT can help your back-in-time investigation.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Want to Help Your Analysts? Embrace Automation and Outsourcing.



While the security tools we choose to invest in can undoubtedly make or break our success, one area we tend to focus less on is the human component of cybersecurity. Yet today, two-thirds of global leaders claim that the global skills shortage creates additional cyber risks for their organization, including 80% who reported experiencing at least one breach during the last 12 months that they attributed to the cybersecurity skills gap.

The always-changing threat landscape, with fewer skilled people makes it nearly impossible to keep ahead of threats. That’s why it’s time to talk about the human element – specifically your Security Operations Center (SOC) analysts – and their role in your cybersecurity framework.

Helping the Humans in Your Security Stack: Enhance, Automate, and Outsource

When you consider your security stack, you probably immediately think of the technology you use. And you’re likely already consuming these as a service. Security vendors operate, maintain, and improve critical security capabilities for the tech you use, keeping those tools tuned to be resilient against the latest threats so your team can focus on more critical tasks.

But what about the people? They’re just as much a part of your security stack as any firewall, endpoint, application, devices, or sandboxing tool. But there’s likely less of a roadmap for their continual improvement. Your analysts are playing a constant catch up game with alerts, which leaves no time for professional development. You’ve probably considered evaluating which tasks the SOC performs that you could automate or outsource, but a lengthy list of other to-dos often means that process improvements get deprioritized.

If your team is overwhelmed, you’re not alone. Here’s the good news: You can take steps to strengthen your organization’s security posture while simultaneously reducing your analysts’ workloads (and lowering the chances that they’ll burn out).

The first is to enhance their capabilities by choosing the right technology and making time for training when possible. Next is to automate many of your team’s processes to improve accuracy, mean time to detection (MTTD), and mean time to remediation (MTTR). Lastly, there are simply some aspects of cybersecurity you’ll want to outsource to keep your team focused on the most critical tasks.

Enhance Their Capabilities with the Right Technology and Training Opportunities

If you’re like most of us, your SOC teams are heads-down sifting through alerts, logs, and tasks. They find it challenging to find the time to stay sharp as they’re focused on the evolving threat landscape and supporting (and improving) your organization’s security posture.

That said, practice – even if done every few months ­– will make your team better and faster in responding to attacks. Make the time for it. Build and test your processes and playbooks, and then allocate time for tactical training sessionsbased on real-world attacks. Consider partnering with an outside organization to help hone skills and provide additional insights into potential security gaps. Also, take advantage of onboarding and training programs that support short learning curve objectives.

Automate Processes to Improve Accuracy and Efficiency

The goal of every cybersecurity leader today should be to establish a unified security framework across the entire organization that prioritizes synergetic systems and centralized processes to deliver ML-powered automation. If you’re just starting with automation, looking within your team and identifying repetitive processes that may benefit from automation is a good jumping-off point. Consider log review, bot activity monitoring, and initial alert triage for starters.

Remember that AI and ML are only as good as the data they’re trained on and the people who teach and optimize them. When engaging with vendors offering ML-powered solutions, you must look inside the organization and figure out who’s designing their models. What datasets are they working with? What AI training models do they use? Ensure that the processes and automation used to gather, process, identify, and respond to incidents are trustworthy. 

Outsource to Improve (or Redirect) Your Team’s Focus

The current intensity we see across the threat landscape, both in velocity and sophistication, means we all need to work harder to stay on top of our game. But that can only get you so far. Working smarter means outsourcing certain tasks – like incident response and threat hunting – so your team can refocus on other strategic priorities.

This is why relying on a Managed Detection and Response (MDR) provider, Incident response (IR) or a SOC-as-a-service offering is helpful. Such enhancements are a critical way to eliminate noise, help your team focus on their most important tasks, and advance your business. Outsourcing can either be used as a temporary measure until your analysts are past the learning curve of new technology, or you can use these services as a permanent extension of your security team, adding professional expertise when and where you need it.

Don’t Forget About Employee Cybersecurity Education

There are many ways to support your SOC analysts, from enhancing their skills through training and certification to outsourcing your detection and response activities.

Yet security is everyone’s job, not just the responsibility of you and your analysts. In many cases, your employees are your first line of defense, which is why everyone in the organization must understand basic cybersecurity principles.

When you invest in ongoing training programs to help your workforce enhance their security knowledge, combined with tools like ongoing phishing simulation services, you enable them to be strong partners to your SOC. It’s one more important opportunity – beyond training, automation, and outsourcing – to support the people who are part of your cybersecurity stack.

Learn more about how Fortinet’s team of cybersecurity experts can help you enhance, automate, and outsource critical security functions to keep your organization secure.  


Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading