Magazine menu Close Magazine menu

Author

Jose Alemán

Jose Alemán is a Global Presales Expert at Kaspersky – he’s worked in cybersecurity for nearly two decades. He presents thought leadership to business around the world at events and works with key regional and global customers.

Get in touch with Jose

Latest stories by Jose

threat attribution

How to find out who’s behind a cyberattack

  • Enterprise cybersecurity
  • min read
    • Knowing who or what has attacked us is critical for survival. In cybersecurity, threat intelligence cuts through the noise to find the poisoned needle in your data stack, letting you act fast before damage spreads. But what if you could also find out who is behind the attack? How threat attribution helps if you've been targeted by an APT If you've been targeted by an advanced persistent threat (APT), threat attribution helps you understand the attack motive and respond quickly. The cybercrime groups that carry out APT attacks are often linked to state-sponsored attacks. It's a costly way to get to their prize. If you have something they want, you could be a target. They're advanced. No low-cost software bought on the dark web by do-it-yourself cybercriminals. They build their own sophisticated software for purposeful damage. They're persistent. They seek you as their target, hitting you with weeks or months of attacks until they break through your IT security defenses. Or they lie dormant for years until the time to attack. Once in, they conduct secret operations to find critical data. If they're determined, there's only so much that cybersecurity software can keep safe. And they're a serious threat. Their goals range from espionage to sabotage, to data theft for profit. Threat attribution wins the threat intelligence race, but it's not for everyone Threat attribution is a next-level solution, but it's not for every business. It's like choosing a car. What you need depends on your journey. A budget motor is fine for driving from A to B. In cybersecurity, that's endpoint security. If you're carrying precious cargo, a limousine may be a worthwhile investment. In cybersecurity, that's threat intelligence. If you hold classified information that's interesting to a rival state, you're at greatest risk of an APT attack. National security and law enforcement agencies (like Interpol or the FBI) are most vulnerable. They have much to gain by uncovering who's hacking them. Sometimes APT attacks also target corporates, other government agencies and critical infrastructure like power plants and manufacturing. You don't have to be a big organization to be a target. If you're making components for a military plane, a less friendly state may want to know how you're making the rudder for counter-intelligence. Supply chain attacks are also on the rise. By hitting a laptop manufacturer, hackers can infect everyone in an organization. Then, when the time's right, they strike, cherry-picking who they spy on by hacking straight into their laptop. Who are the threat actors? APTs are a fast-growing 'industry.' These threat actors are not amateurs. They're super-organized crime workers. Some have different units for espionage, counter-intelligence and financial exploitation. Lazarus was the most significant threat actor in 2019. They attacked Sony Pictures Entertainment with a data-wipe in 2014 and made several attacks on South Korea. APT trends in 2020 predict more sophisticated attacks using artificial intelligence (AI) and deep fakes to access personal data. How does threat attribution work? When one of the most damaging ever ransomware attacks WannaCry hit in 2017, a Google researcher tweeted cryptic code showing similarities between WannaCry and 2015 malware attributed to Lazarus. This is threat attribution. You need to analyze and find clues that take you back to existing knowledge. By analyzing the attack's context, and nuances and languages deep in the code, researchers can reveal the threat actor's origins. These actors rarely leave a calling card, but they do leave evidence. We can analyze malware samples never seen before to find out if the actor is new, or an existing player in disguise. Like all forensic analysis, it's slow and painstaking. With highly sophisticated threats, it means reverse-engineering the attacks. It can take years, even for teams of the most skilled researchers. That's often enough time for attackers to achieve their goals. How can we shorten the analysis time? What if we could speed up the process? Faster attribution can shorten incident response times from hours to minutes, and reduce false positives. Kaspersky's Global Research and Analysis Team (GReAT) tracks over 600 APT actors and campaigns. To help the Information Security (InfoSec) community block APTs, they produce 120 or more subscriber reports each year and share highlights in quarterly APT trends reports. Profiling each threat actor can take years, building a database of everything you need to know about them. From this insight, Kaspersky developed one of the first solutions for automated threat attribution. It's like the Shazam app – that can identify the song you're humming by finding a match – for threat intelligence. By uploading a code sample to Kaspersky's Threat Attribution Engine, it matches previous attacks and APT groups in seconds. It analyzes the malware's 'genetics' to compare to 'genotypes:' known malware linked to a threat actor. This fast analysis can help those facing APT attacks to limit damage. We can't stop the flood of threats permeating our world, but we can build our defenses. Threat attribution is a new weapon in the arsenal for tackling organized cybercrime, and it could make it far harder for them to succeed.
Threat intelligence drive SOCS

How threat intelligence finds the needle in your cybersecurity data stack

  • Threat Intelligence 2020
  • min read
    • According to Benjamin Franklin, nothing is certain in life except death and taxes. And in our advanced technology age, we can add a new inevitability: cyber-threats. Before you even take your first sip of coffee on a Monday morning, a new threat that could have a severe impact on your infrastructure and data may already be in your system. You just haven't found it yet. Monitoring threats around the clock: powering your Security Operation Center So in a world where threats are everywhere, what are your options? Well, if business continuity and protection of data are a top priority for your enterprise, you've probably already invested in, or are planning to launch, a Security Operation Center (SOC). Your SOC will monitor threats around the clock, so you can trust your security team to monitor and act to keep the most significant risks at bay. Rest easy. It's time to enjoy that delicious, hot coffee. Well, not quite. If data is the new oil, today we live in the aftermath of an oil spill. And data overload is as much a problem to your InfoSec team as it is to your marketing or customer operations. With the continued growth of more interconnected devices and the internet of things, having data on the many threats hitting your perimeter is all well and good. But understanding which are false positives and which need immediate action to quash is like finding a poisoned needle in your data stack. To find and immunize against that one-in-a-million alerts, you need threat intelligence. Why you need threat intelligence Threat intelligence is the overlay that turns seeing threats into knowing when and how to act. Gartner defines threat intelligence as: I'm not arguing with that. But no two battles against cyber-threats are quite the same. Using threat intelligence, you can join the dots between related attacks to pinpoint who your adversary is, then adjust your defense strategy to block them. Data suggests a 'threat pyramid' Every day, we face more threats. These range from everyday commodity threats – easily detected, known malware – to advanced threats and targeted attacks using known TTPs (tactics, techniques and procedures,) and rare but deadly advanced persistent threats (APTs.) The data paints a picture known as the 'threat pyramid.' Almost all threats we see are mundane, like common malware. A small number are advanced threats and targeted attacks, like the banking trojan malware Emotet, hitting small- and medium-sized businesses (SMBs) and enterprises hardest. A tiny number are APTs, affecting few organizations with devastating consequences. These are the most poisonous needles in the data stack. You need a strategy, not a platform Good threat intelligence is more than just buying a platform and hoping for the best. Like all effective cyber-prevention, it blends technology, strategy and effort. Good threat intelligence gives you the insight you can act on – from real-time alerts of a potential breach to helping paint a bigger picture that educates your senior stakeholders about the ongoing risks. This, in turn, indicates what software and investment you need to keep harm at bay. At the basic level, threat intelligence provides alerts and blocking for indicators of compromise (IOCs). Contextual alerts and e-signature management help determine the validity and severity of attacks to form your incident response approach. Another use case is fusion analysis, used by Kaspersky CyberTrace – pulling together and evaluating disconnected data feeds to help identify which threats pose a danger. And threat intelligence can inform your cybersecurity strategy too. By using intelligence relevant to your risk posture, security planning informs architecture decisions and helps you refine your security processes to better defend against known threats. If you're working with a managed service provider (MSP) to run your security operations, ask how they'll install and run your threat intelligence service, and how much time and effort you're getting. Its round-the-clock nature means it's not the easiest service to outsource. Threat intelligence's big three When planning and buying your solution, there are more advanced threat intelligence options like human-readable threat hunting reports and threat attribution, but to start, you'll need three components: IOC (indicator of compromise) IOC is the basis of threat intelligence. It's evidence we can measure and recognize like a fever is the outward sign of disease in the body. There are many IOC services. To choose the right one, you'll need to know which threats you're most likely to face. Threat data feeds These provide integrated intelligence by analyzing adversaries and the wider threat landscape. There are many on the market, both free and paid. To choose the best one for you, ask: do we need an APT data feed if we're not a likely target for APT groups? Where is the best place in the IT infrastructure to add the feeds? Should we block threats or just alert the team? Your answers will depend on your organization's security posture and IT strategy. Threat intelligence platform A threat intelligence platform lets you manage a range of specialist software that supports the different components. What you choose and how you integrate services comes down to your budget and business needs. Although there are open-source data feeds out there, you can buy more sector-specific intelligence. It's essential to drill down when you purchase threat intelligence services to make sure the vendor provides a responsive service – both in the quality of data feeds and speed if they're providing incidence response. With careful planning, while choosing a vendor and a well-thought-out strategy, your SOC can benefit from the full protection and power of threat intelligence. The needles will still be in your data stack, but you'll have the tools to find and break them.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries