What are Chinese APT groups up to?

In the last 48 hours, Chinese threat actors APT 27 and 41 have shown extraordinary levels of activity. The fallout from the recent geopolitical events continue to define the sequence of events in the region. APT 27 which is a decade-old threat actor, was at the forefront of the latest spike in cyberattacks on Taiwan. The targets were chosen to create a sense of panic and to showcase the ability of Chinese threat actors to strike anywhere at will. Here is the latest on some of the Chinese threat actors we are tracking: Industrial security on your mind? Find out how your IoT, OT, and IoT deployments can benefit from our converged cybersecurity solution: Request Demo Sign up for our threat intelligence feeds and experience the power of our global honeypot network: Sign up now. Find out what is lurking in your network. Sign up for our threat assessment program.

What are Chinese APT groups up to? Read More »

Complete Guide to OT Security

Cyber Security, ICS, OT / Abhay S K

Oldsmar, a small city in the state of Florida, has a population of about 15,000. It was February 5th, 2021. At the Oldsmar Water Treatment facility, a vigilant employee noticed a spike in the levels of Sodium Hydroxide – or Lye. The levels of Lye were changed to 11,000 ppm from 100 ppm – a 10,000% jump. The hacker managed to infiltrate the critical infrastructure and release excess Lye into the water that serves the entire city. Public Utility systems without an upright security posture as far as Operational Technology is concerned, are vulnerable to such kinds of threats. The threats are real with attackers possessing advanced capabilities increasing at an alarming rate. Fears of security experts have come true, and they only compound with time. 2 in every 5 enterprises revealed that hackers targeted their OT device. Likewise, over 60% of respondents in a survey felt that the volume, complexity, and frequency of threats are likely to increase in the coming future. For an enterprise or an industrial unit, Operational Technology security is of paramount importance. In the case of infrastructure like power grids, it is a matter of national security. What is Operational Technology(OT)? The technology associated with the detection of a change or causes a change using hardware and software is defined as Operation Technology. This change can either be via direct control and/or monitoring of hardware like valves, sensors, I/O devices, switches, PLCs, actuators, switches, etc.), and software (customized and machine-specific). Along with the above-mentioned components, OT systems employ a wide range of control components that act together to achieve an objective. Unlike other information processing systems, any change in an OT network has its effect in the real world. Owing to this, safety and security are of paramount importance in OT systems conflicting with security design and operations frequently. Different types of OT systems: 1. Supervisory Control and Data Acquisition Systems (SCADA) The SCADA systems collect data from many Input-Output devices across a larger geography. Its architecture consists of computers, and networked data communications having a graphical user interface. Commands sent from the command control (using GUI) are executed by PID controllers and PLCs (Programmable Logic Controllers) at the endpoints. Electric Lines, Pipelines, railways, and power transmission often comprise SCADA systems. 2. Distributed Control Systems – DCS The DCS is seen in an environment having many control loops, offering both central supervisory equipment and local control level. It is seen in areas like refining, manufacturing, and power generation where high reliability and security are very important 3. Medical Systems On-site medical devices comprise in-hospital facilities like MRI scanners, infusion pumps, EKG/ECG Machines, defibrillators, and others. These run on age-old Operating Systems and proprietary protocols. Consumer medical devices comprise insulin pumps, artificial pacemakers, and prenatal monitors belonging to the class of IoT smart devices. 4. Physical Access Control and Building Automation Systems Every inch of an industrial complex – designing, fabrication, or manufacturing zone – needs to be protected. Right from HVAC systems, elevators, swipe cards, security cameras, biosecurity machines, and others, everything needs to be secured. OT Security without IoT integration: OT networks run off the grid – isolated from other networks – greatly limiting security vulnerabilities. Every process in an OT environment runs on proprietary control protocols. Critical infrastructure like transport, power distribution, healthcare, and others are an example of OT networks. In an event of an on-site security lapse, an intruder or a group of attackers may manage to get into the premises of an industrial workhouse. The threats arising from such events can be avoided by improving security and surveillance along with the deployment of multi-layered security. This is to ensure access to critical assets and control rooms is always restricted to unauthorized personnel even in an event of an on-site security lapse. Also read: Complete Guide to Cyber Threat Intelligence Feeds There have also been reports of identity card and swipe card thefts, giving unauthorized people access to OT infrastructure facilities. Did the adoption of IoT make OT systems more vulnerable? Smart transportation, smart power transmission, smart manufacturing – every ‘smart’ thing that is a part of our day-to-day lives is an upgrade of its cousin from the pre-internet days. Anyone associated – government, private contractor, or even an academician, wants to make an OT system more reliable, cost-effective, and efficient. To achieve this goal, the adoption of services like big data analytics and other enterprise software has been integrated with the OT networks. This means IT has been integrated with OT. This brought more misery than what OT systems have seen cumulated across the past 200 years. With the integration of Information Technology and the Internet of Things into Operational Technology, the security of the critical infrastructure that holds a nation has been put under scrutiny. To mitigate risks arising out of IT and IoT integration with OT, traditional security solutions along with strategies like defense-in-depth, layered security mechanisms, and other sophisticated modern security systems should be deployed. Also Read: How to get started with OT security The OT systems have moved from the state of Complete Isolation to a state where complete isolation is impossible. While the integration between IT, IoT, and OT was bound to happen sooner or later, the threats and security vulnerabilities were to follow. Just like IT Cybersecurity went through some rough patches during its infancy some 3 decades ago and is still fighting with a positive spirit, hybrid-modern OT systems to are expected to continue. How OT Security differs from IT Security Operation Technology is industry-oriented and focuses on the manufacturing, production, and transmission landscape. A single failure in an OT system can hurt industrial operations directly leading to long non-production hours. There have been instances of fatal accidents in some cases. Though such incidents are of low frequency, they have a destructive effect, threatening national security at times. OT security puts Safety at the forefront, despite being non-dynamic. On the other side of the fence, IT Security deals with data flowing across various IT systems. IT security primarily is a business-oriented vertical driven by an enterprise landscape. An IT

Complete Guide to OT Security Read More »

9 important tips for selecting an OT security vendor

Cyber Security, ICS, OT / vikas.karunakaran

With rising cyberattacks and inbound scans from sophisticated actors, security teams managing OT networks and assets are under immense pressure. In addition to SOC fatigue, there are also challenges associated with rising threats to OT infrastructure that could cause a shutdown or make critical equipment unavailable. In a study conducted by Sectrio’s threat research team in June 2022, we found many ports on OT networks easily accessible from outside. Because of a lack of network visibility and cyber hygiene, hackers can access networks and move laterally across infrastructures and locations. This is not just a dangerous trend but it can also severely dent the ability of such businesses to ward off cyberattacks in the future as they may already be hosting malware loaders and multiple stealthy malware that is either exfiltrating data or keeping the infrastructure available for attacks in the future. Investing in better cybersecurity practices and an OT security solution is thus imperative. But then, choosing such a solution should ideally involve a round of diligence. To help you we have identified a set of tips that can hasten the process of selecting an OT security solution with the right features, capabilities, and endurance. 9 vital tips for selecting the right OT security vendor 1. Does the vendor understand OT protocols? A vendor that understands and covers varied OT protocols could be considered as a mature vendor. 2. Is it a mixed bag solution? If the OT security vendor has chosen detection or mitigation exclusively from another vendor or vendors, then that is a huge red flag. Such a security solution would induce a detection and mitigation lag and the vector might just slip through the integration gaps. An ideal solution should have all modules coming from the same vendor. 3. Did the vendor acquire any other capability inorganically, recently? Lots of mergers and acquisitions occur in the OT security industry so be careful about any solution coming from a vendor that has acquired another security vendor recently as the integration of capabilities and features may not have been tested fully and be bug-free. The solution can however be considered after an extended POC 4. Do they offer asset discovery and vulnerability management? You will be surprised to know that many OT security vendors do not provide these capabilities as part of their core solution. This is a clear disadvantage as these are essential capabilities to ensure a robust security posture. 5. How do they get their threat intelligence? Only a few vendors offer native OT threat intelligence feeds. If a vendor is offering this, it should be considered a clear advantage. 6. Has the solution addressed unique security challenges that you can identify with? Read some of their case studies and check if the solution is addressing real problems rather than academic ones. 7. Ease of deployment and decision data accessibility. Is the solution modular and permits rapid deployment? Once you have selected the solution you would want it to integrate with your environment rapidly. The data dashboards should be clutter-free and permit decision-making across views. 8. Support for mixed environments The solution should be able to work across hybrid environments with various technologies and devices of all vintages 9. Do they offer comprehensive consulting and compliance services as well? Vendors that offer security services for specific end needs score high on the ratings as consulting services are often required to build a security roadmap and build OT security skills and knowledge in the workforce. With new compliance mandates getting added, businesses need to get help in configuring their workflows, processes, and systems for audit, reporting, or any other compliance need. Need help with selecting an OT security solution, talk to our solution experts to take the next steps here: Contact us Is your existing OT security solution failing you? Download the checklist to learn how to move on to a new solution with ease – Download checklist now

9 important tips for selecting an OT security vendor Read More »

Why the banking and financial services industry needs to embrace decoy and deception tech

Cyber Security / vikas.karunakaran

The financial services industry has been on the radar of hackers for a while now. In fact, banks are routinely targeted by sophisticated actors as well as script kiddies. Banks with mature cybersecurity practices do not work with the assumption that their systems are secure. Instead, they are constantly on the lookout for threats that can harm their assets. They are also regularly investing in methods to improve security while subtracting any assumption of invincibility. Also read: Why IoT Security is Important for Today’s Networks? Threats that are already on the networks of banks are very hard to detect and neutralize. They may have already controlled applications and exfiltrating data and information on system users. Conventional security systems that are based on ancient or outdated detection techniques will lead to a deluge of false positives (some of which could even be initiated by hackers to ensure detection fatigue). With passive defense, banks are always on the defensive which translates into The solution, therefore, is to have an active defense posture using decoy and deception to trick hackers into believing that they are targeting real systems. Such systems bring in a very high level of clarity in terms of understanding hacker behavior, tools, tactics, and targets. Hackers will be kept engaged and their attack cycles will be wasted on decoy infrastructure that is of no value to a bank. How the decoy and deception systems work Decoy and deception systems work by creating fake digital twins of real infrastructure that mimic every possible attribute of the system it is mimicking. These decoys are strategically located and when a hacker enters a banking network, they will discover these decoys first before they discover real systems. Once the decoy is discovered, the hacker will try and lay multiple backdoors and try out ways to drop more potent malware into the fake system. Once this is done, the hacker will move around the fake network and try and locate assets of significance and exfiltrate data and credentials. They may even use stolen credentials to access sub-directories or subsystems. All this while the hacker will have no idea that they are going after a fake system. Also read: Use cases for the banking and financial services Industry Deception systems are often built to be triggered by active thresholds and these can be changed based on the threat perception of a bank. Servers, work machines, laptops, networking gears, wi-fi systems, CRM, or other front systems can all be turned into decoys. Threat actors can hypothetically be kept engaged for an extended amount of time and even made to feel as if they have got real data or have entered the real network when they would be quite far away from the real infrastructure. Essential characteristics of a decoy and deception system Before purchasing a decoy and deception system, the following traits of the solution being considered should be analyzed: Decoy and deception solutions represent an easy way of engaging and studying threats and bad actors without compromising on data or infrastructure availability. Learn about Sectrio’s solution To see Sectrio’s award-winning Decoy and Deception solution in action, book a free no-obligation demo today. Get in touch with us to learn how our threat assessment capability can help your business.

Why the banking and financial services industry needs to embrace decoy and deception tech Read More »

China assigns APT actors to initiate revenge attacks for the Shanghai police data leak

Cyber Security, Featured / Prayukth K V

As per a series of conversations intercepted by Sectrio’s threat research team from various forums, China is learned to have identified Beijing-based APT 41 and Haikou, Hainan-based APT 40 as nodal cyber offense teams to initiate revenge attacks against many countries. Through these attacks, China may try to gain control over the narrative that has emerged in wake of the recent revelation of a large data breach that has impacted over a billion Chinese citizens. Who are the Chinese APT groups targeting? These attacks may primarily be aimed against countries with whom China has had an uneasy relationship in the past. It could also include a few other countries to enhance the magnitude of the breach and to bring in an element of plausible deniability. Understanding the Shanghai Police data leak incident It may be remembered that in one of these most expansive breaches reported so far, the data belonging to nearly a billion Chinese citizens was breached some time ago. The 23 TB of data, a sample of which was released online, belonging to the Shanghai police department includes names, phone numbers, government ID, and law enforcement reports of citizens. An extortion attempt was made and hackers who asked the Police department to pay $200,000 to prevent the data from being leaked to a wider audience. China is known to keep massive amounts of data concerning its citizens and persons of interest from around the world in databases with various levels of security. In this instance, it is claimed that while the database was protected, a dashboard linked to the database was not. Also read: How to get started with OT security On Friday, the site where the data was put for sale removed the post advertising the data for sale. The site however indicated that it has other databases that it is willing to sell to prospective buyers. The scale of the breach left many questions unanswered primarily regarding the security of information collected by the government. While it has not made any direct references to the breach, China did ask all public bodies and citizen information managers to secure all information submitted to the government so that people and businesses feel safe while sharing their data with the government of China or public bodies under it. In addition to increasing confidence in the government’s ability to securely harvest and store data, China is also getting ready to go on the offensive to prove that such breaches can happen to the citizens of any country. This will also help China downplay the gravity of the original event while offering Chinese social platforms a convenient diversionary topic to discuss. Gameplan Revenge China is planning to launch new ransomware families and multi-loader malware for this operation. The designated APT groups identified for this breach campaign are APT 40 and 41. APT 40 also goes by monikers BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper. In the past, it has targeted government agencies, healthcare facilities, AI-based projects and even scientific research. APT 40 is no stranger to harvesting stolen data and is known to maintain a long-term reconnaissance presence extending to many victims in countries considered to be adversaries by the PRC government. This also includes friendly countries that have signed up for the Belt and Road initiative and nations that have received aid from China in one form or another. Also read: Complete Guide to Cyber Threat Intelligence Feeds APT 40 actors often employ non-malicious tools in non-standard folders as part of an attack. Thus, if the location of a non-malicious tool is found to be non-standard, the tool becomes an IOC for a breach. The malware libraries used by APT 40 are often shared with other Chinese APT groups. Post-breach data is also shared with other groups as a standard practice. Beijing-based APT 41 AKA Double Dragon Barium, Winnti, Wicked Panda, Wicked Spider, TG-2633, Bronze Atlas, Red Kelpie, Blackfly) is known to have links with the Chinese Ministry of State Security (MSS). Between 2021 and the early months of 2022, this group is known to have conducted extensive operations against the governments of the US, Canada, a few NATO member states, and the UK. This group is known to have multiple breach tactics in its inventory and is hard to detect. This group also has the capacity to modify a malware post-injection to work in conjunction with the host environment and adapt to any changes that the victim may make to their networks. Also read: Why IoT Security is Important for Today’s Networks? Both these groups are well versed in large-scale data harvesting, processing, and transfer of data and are known to be among the most stealthy APT groups in China. This is why China has chosen them to carry out a series of revenge attacks across many countries. These attacks could occur as early as this month as China seeks to bury the Shanghai Police leak episode. The speed with which these actors were assigned to this project indicates a sense of urgency. The gameplan: Learn more about these actors in our 2022 IoT and OT Threat Landscape Assessment Report Go for a complete threat assessment program now to learn about the threats lurking in your network Learn more about Key Advanced Persistent Threat (APT) Clusters Under Observation explained by Prayukth K V, Speaker & Published Author cybersecurity, CMO, Sectrio, the market leader in IoT, OT & IT Security.

China assigns APT actors to initiate revenge attacks for the Shanghai police data leak Read More »

Expanding RaaS eco-system is exploiting OT security gaps like never before

Leave a Comment / Cyber Security, OT / vikas.karunakaran

Ransomware availability is now at an all-time high globally. Not only is ransomware more easily available, but the average cost of ransomware has dipped by as much as 70 percent since February 2022 when the Russo-Ukraine war began. This is one reason why complex ransomware is now turning up in places it never was before. This dip has attracted new players and also contributed in some extent to the growing attacks on businesses that run on or have OT in their infrastructure. Growing Ransomware as a Service (RaaS) economy The global RaaS economy is now estimated to be worth more than a billion dollars. The business is not just highly profitable but is also working its way towards evolving some kind of an information structure and functional streamlining. The hierarchy of RaaS is a simple one. At the bottom rung lie freelancers who work with a contractor who is tied to multiple ransomware groups. The contractors are responsible for the recruitment and allocation of freelancers for specific projects that are chosen by the ransomware groups such as Lockbit. Also Read: How to get started with OT security The freelancers are given assignments based on which their skill sets are evaluated and they also receive rewards based on these assignments. A contractor may float a job ad in the dark or surface web calling for the recruitment of freelancers for specific projects. Depending on the skillsets and scope of a project, a freelancer can expect to earn anywhere between $300 to $ 500000 for a single project. If the victim is attacked again based on stolen credentials or if the stolen data gets resold, the freelancers and contractors behind that project can expect to get additional commissions. Groups like Contii have made RaaS projects exceptionally rewarding with a shoot, scoot, and regroup model. This model involves ransomware groups routinely reassembling after disbanding in the aftermath of a successful ransomware campaign. These groups also maintain a secret inventory of bugs to exploit. The malware development cycle for exploiting a specific high-value bug is today in the range of a day to a week depending on the complexity of the exploit. Also Read: Complete Guide to Cyber Threat Intelligence Feeds Unlike earlier ransomware groups, groups today are more sophisticated and use better tools, communication means and random targeting is almost unheard of among them. Each target is chosen with diligence and handed over to contractors for acquisition. Contractors may also decide on targets at their discretion to increase their earnings from a specific family of ransomware. By mobilizing an army of freelancers the contractors and ransomware groups benefit from higher levels of anonymity and a more fluid chain of association. Thus the risks of an entire chain of cybercriminals being exposed are significantly reduced. Implications of RaaS for OT security Ransomware groups are now openly targeting manufacturing and utility firms that have a high percentage of OT installations. A soon-to-be-published study by Sectrio reveals the gravity of the problem. The study found that over 150000 ports connected with various OT and IT services were available for scanning by an external actor. Some of these ports also provided access to core IT and OT assets raising the alarming prospect of a massive and debilitating cyberattack unless these ports (opened inadvertently we assume) are closed rapidly and the networks connected assessed for any signs of unauthorized entry. Here is why OT security teams need to get their act together fast: Want to learn about the threats lurking in your network? Get a comprehensive threat assessment done by our Threat Discovery and Assessment team Try our threat intelligence feeds for two weeks and ramp-up the efficiency of your threat hunting efforts. Want to secure OT? Try our award-winning OT-IT-IoT security product now. Visit our compliance center to download additional information for free: Compliance Center

Expanding RaaS eco-system is exploiting OT security gaps like never before Read More »

Black Basta ransomware is mutating, and this has several implications

Cyber Security / Prayukth K V

New variants of the Black Basta ransomware are now emerging in the wild and routinely turning up in our global honeypots. According to online reports, Black Basta has managed to make many victims pay a ransom across US, Singapore, UAE, UK, India, and Australia since it was first discovered in the wild in February 2022. Its emergence as a massive threat within just 2 months of its launch points to a new trend. Hackers are betting on faster hit-and-run tactics to draw large sums of money as ransom within a short period of time, sell the code to other groups and move on (either to develop new malware or for an extended vacation). The malware development and release cycles have been shrunk in response to law enforcement agencies targeting third-party platforms involved in money laundering and the conversion of cryptocurrencies. As law enforcement agencies are tracking the movement of money, hackers are aware that they have less time to encash their stolen wealth and exit the ecosystem. Also read: How to get started with OT security Black Basta is targeting a wide range of victims across verticals such as manufacturing, transportation, utilities, maritime, and government agencies. It has also been associated with at least one phishing campaign targeting oil and gas pipeline companies based in Europe. Discovering multiple Black Basta variants Sectrio’s threat research team has discovered multiple Black Basta variants including 2 which seemed to have been developed exclusively for ransomware-as-a-service end-use (with two back doors). The RaaS version has extensively targeted corporate networks and sensitive data and access credentials. Data is first exfiltrated and then the encryption process is initiated. A newer variant released in late May is targeting virtual machines running on Linux servers. This variant works to encrypt multiple servers instantly by searching for /vmfs/volumes or locations housing VMs within these servers. The list of victims is published on a blog site (Basta news) maintained by the actors behind this ransomware. While the overall operations seem to be copied from the playbooks of threat actors such as the notorious Conti ransomware group, the emergence of multiple variants indicates ongoing research designed to develop more potent variants to meet specific end-user requirements of hackers. Also Read: Complete Guide to Cyber Threat Intelligence Feeds A glut of new variants could also confuse threat detection engines and threat researchers. We suspect that the Basta group has already moved on from this ransomware and that the development work has been subcontracted to other groups for a commission or other considerations. After multiple cycles of variations (some of which could be AI-driven), the ransomware will be completely unrecognizable and may slip through existing signature-based detection mechanisms. If such updates are then passed on to other variants, then the detection challenge will grow exponentially and single ransomware can bring many industries and agencies to a complete halt if adequate cybersecurity measures are not already in place. To find out if your IoT, OT, and IT deployments are secure and protected from Black Basta and other potent ransomware, schedule a comprehensive threat assessment program with Sectrio. Book a demo now to see our IoT-OT-IT converged cybersecurity solution in action

Black Basta ransomware is mutating, and this has several implications Read More »

Learn more about Sectrio Award winning solution

Sectrio’s IoT OT, and IT Security solution wins NASSCOM Gamechanger 2022 award

Cyber Security / Prayukth K V

Sectrio’s unique AI-powered IoT and OT security solution based on the Adaptive Threat Defense approach has been recognized as a game-changing technology by NASSCOM. The solution won the top honor at an event organized by NASSCOM last week (June 23). In addition, the solution use cases presented by Sectrio have ranked number one by NASSCOM in the use of AI in the cybersecurity category well ahead of over 300 competitors. This honor is another validation of the uniqueness of the solution as well as its ability to evolve in-situ to stay aligned with emerging threats and changes in the threat environment including the addition of new adversaries, malware, malware deployers, mutational threats, and rogue insider activity. The solution has been developed to tackle the most sophisticated threats that threaten IT, OT, and IoT assets and infrastructure. Its features have been enriched with inputs from our diverse customer base around the globe and its evolutionary and self-learning feature enables it to reach unprecedented levels of scale when it comes to tackling complex and sophisticated malware and adversaries. With the rise in threats and complexity of infrastructure, CISOs are having to deal with multiple challenges such as network visibility, working with the right threat intelligence, detecting threats early, and evolving security measures to keep their security posture current and relevant. In this context, the Sectrio solution is the only OT and IoT cybersecurity solution that can help CISOs and enterprises keep their businesses safe by keeping threats at bay. Unique features of Sectrio’s Adaptive Threat Defense solution include: Based on adaptive technology that scales to meet new threats and risks Secures all surfaces across devices and networks irrespective of protocols or device architectures Detects and engages threats early using a unique detection framework and mechanism Utilizes the most comprehensive and contextual threat intelligence feeds generated from the largest IoT and OT-focused honeypot network in the world Multiple remedial actions are available Zero detection lag, minimizes false positives, and reduces SOC fatigue Aligned with the most critical security standards spanning NIST frameworks, IEC 62443, and multiple ISO requirements The solution is capable of scaling in a ‘J’ shaped curve in terms of devices and network elements covered Offers protection against evolutionary malware, modular malware, and latent malware through footprint grade baselining Deployed across industries such as manufacturing, maritime, critical infrastructure, banking, utilities, maritime and more The only that offers proven evolutionary protection i.e protection that is scalable, robust, and vector proof To learn how this award-winning IoT-OT-IT cybersecurity solution can secure your enterprise, book a no-obligation demo now. You can also opt for an IoT and OT threat assessment program from Sectrio to understand your threat envelope, vulnerability status, and exposure to various risks as a first step. Learn more about our threat assessment methodology here: OT and IoT Threat Assessment Read more about this award at the Government of India’s AI portal. Read more and download the NASSCOM AI Gamechanger Compendium!

Sectrio’s IoT OT, and IT Security solution wins NASSCOM Gamechanger 2022 award Read More »

How much can delaying a cyber threat assessment cost your business?

Cyber Security / Abhay S K

Between cyber-criminal groups, Lazarus (North Korea), Conti (Russia), and Mustang Panda (China), almost every business in every sector is on the radar of hackers. Because of geopolitical and economic reasons, these groups have stepped up their scanning and target acquisition activities in the last 4 weeks. Though evidence of collaboration is scant, there is some evidence to indicate that at least two of these groups have exchanged a list of targets in the past. So what have we got to worry about? Targeted attacks on OT networks are rising and depending on who is attacking, the motivation could be anything from ransom, disruption, elimination of competition, or even training Oil and gas facilities have been successfully targeted in the last two months and the ransom that came from these attacks has fueled a new wave of attacks by Conti (including the launch of a new multi-loader malware that was released early) While Lazarus is primarily targeting the financial services sector, it could switch to attacking manufacturing units and other critical or large chemical processing units for ransom Most attacks are based on spear-phishing using specific messaging By targeting oil and gas and manufacturing, the hackers are also trying to destabilize economies and large supply chains Even without these events, 2022 has been a tough year for CISOs with Cyber threat assessment for IT, OT, and IoT is the need of the hour Most businesses are not conducting security audits frequently enough. They are also not investing adequately in ramping up their security posture to cover new and emerging threats. The reason for this is simple. These businesses are not conducting enough threat assessment runs to understand internal and external threats and vulnerabilities they are exposed to. This makes such threats and vulnerabilities invisible to them and these businesses continue operations on a BAU mode while the threats multiply and grow in sophistication and potential impact. A threat assessment exercise when done in the right way at the right time could save millions in revenue, downtime avoided, and loss of market share due to delays in production and shipment of products. what are the components of a good threat assessment program? Frequency: calendarize the exercise so that the exercise is taken up periodically and frequently Coverage: cover the infrastructure as a whole including devices, networks, HMI units, SCADA systems, data platforms, and everything connected. It should also cover access privileges and any and all components including, if possible, assets that are not yet added but will be in the short term Methodology and framework: threat assessment should not be aligned to compliance objectives alone. Instead, it should also take into account all operational sources of risk, threat surfaces, and all infrastructure components. The core framework should be flexible enough to incorporate any changes in operations and the methodology should ideally be unique to your business keeping the parameters mentioned above in mind. It is advisable to build a unique methodology and framework for your threat assessment program Be clear about the objectives and outcomes. Also, a threat assessment program that doesn’t have an action plan for improving security is as good as a non-existent one Working with a cyber threat assessment partner like Sectrio can improve the outcomes and shrink the learning curve. Sectrio will build a unique framework and method for you from the ground up and conduct the exercise as well. Benefits of Sectrio’s threat assessment program: Get a comprehensive report on your cybersecurity posture including all threats, risks, vulnerabilities, misconfigurations, exposed threat surfaces, and entry points for threats Prioritize top threats so that you can avoid straining your resources while addressing the threats Action plan and roadmap to address the challenges and scale to the next level of security Rating on how your existing security posture compares with your threat environment Impact assessment for key risks, vulnerabilities Enhance maturity level of IT operations and improve data security Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days Book a demo now to see our IT, OT, and IoT security solution in action: Request a Demo

How much can delaying a cyber threat assessment cost your business? Read More »

Complete Guide to Cyber Threat Intelligence Feeds

Cyber Security, Threat Intelligence / Abhay S K

Cyber Threat Intelligence [CTI] Feeds – The devil is in the details Whether your firm is looking for a cybersecurity vendor to meet your needs or your employees are undergoing a training program, it is important to understand how cyber Threat Intelligence Feeds form the backbone of a cybersecurity action plan. So what are these threat intelligence feeds? Before that, let us understand what ‘threat intelligence’ is. In layman’s terms, threat intelligence can be defined as any data that helps in a better understanding of the cyber landscape and various threats associated with it. CTI feeds comprise data coming from a wide range of IoC (indicators of compromise) feeds like: The continuous stream of data from these feeds helps us understand the current state of the network, threats, and risks associated with it, and document various IoCs (Indicators of Compromise). It is these feeds that the SOC (Security Operation Center) continuously monitors and uses to identify any infiltrations, attempts, and attacks on the systems and the networks. With time and proper data evaluation, cyber threat intelligence feeds can be used to develop strategies to counter-attack cyber threats and understand hacker tactics, procedures, and techniques. In the due course of this blog post, we shall learn more about types, evaluation, features, benefits, and a lot more about cyber threat intelligence feeds. Types of Threat Intelligence Feeds – Data that forms the bricks Cyber threat intelligence feeds can be briefly classified into 4 types: While many choose to only list the top three, the ‘Technical Intelligence Feed’ plays a critical role if your cybersecurity vendor is serious about protecting your systems and network. 1. Strategic Threat Intelligence Feed: Often dubbed as a high-level intelligence feed, the Strategic TIF helps in understanding why a certain attack is carried out by the threat actors. Non-technical in nature, it is usually served to the c-suite of the company, helping them to better understand the reasons and intentions behind an attack. Analysts outside the cybersecurity field are often engaged to give a holistic perspective of the cyber-attack. Many cybersecurity experts believe that Strategic TIF can impact the high-level business decision makings of a company. Common sources for Strategic TIF include the following: Though the final product is non-technical, researchers and analysts go through tons of data, putting it through hundreds of analyses to suggest effective strategic intelligence. 2. Tactical Threat Intelligence Feed: Simply put, the Tactical TIF deals with the TTP (Tactics, Techniques, and Procedures) of the attackers. Often consumed by Network Operations Center (NOC) employees, Security Operations Center (SOC) employees, IT service managers, and cybersecurity architects, this type of cyber threat intelligence feeds help in analyzing the various tactics, techniques, and procedures deployed by the threat actors. These feeds comprise, but are not limited to human intelligence, data on malware attacks, cross-industry cybersecurity statistics, incident and attack reports, and other threat-related data. Using this data, a comprehensive process involving patching vulnerable systems, changing security merchandise, and improving defense mechanisms is carried out. 3. Operational Threat Intelligence Feed: The notion: “Perception without Conception is blind; Conception without Perception is empty”, is true when it comes to analyzing threats and risks of cyberspace. Without a proper context that involves the nature of the attack, type, timing, intent, and level of sophistication, it is difficult to arrive at a logical perception of how to protect key assets like data and infrastructure. Often experienced hackers and hacking groups interact in private chat rooms and away from analysts and security experts scouting the web. The researchers must keep track of online events, campaigns, and other cyber-attacks to find more valuable intelligence on hackers and their methods. Researchers and cybersecurity experts often face the problem of CAN: 4. Technical Threat Intelligence Feed: Despite its shorter period, the Technical TIF provides key insights into the tools, resources, and other variables a threat attacker has used. Often limited to a specific IoC (incident of compromise), the Technical TIF includes control channels, tools, command channels, IP addresses, hack checksum of malware, phishing email headers, and other technical data. Understanding and applying proper analysis to this feed helps in rapid response to threats. The Technical TIF is consumed by Incident Response and the Security Operation Center (SOC) teams. Most of this feed is read using a Machine Learning program and is fed directly into security systems and other installations. This helps in preventing many threats at their very source promptly. Evaluation of Threat Intelligence Feeds – The Lens that adds context to data! Cyber threat intelligence feeds truly provide critical information that can help companies mitigate cyber-attacks. But how does one evaluate a particular feed? Usually, the feeds come from internal and external intelligence: 1. Internal Intelligence 2. External Intelligence Evaluating the threat intelligence feed: Without adding context, cyber threat intelligence feeds are nothing but a bunch of data outputs. Context brings the intelligence from the feed. But how do we add one? What are the factors that we need to look at while evaluating a threat intelligence feed? Let’s learn. 1. Timely detection When it comes to cybersecurity, every second is critical during a cyber-attack. The faster a threat is identified, the greater can be the damage control. Even in the case of a threat intelligence feed, a real-time feed is priceless. It can often prevent many cyber-attacks. But currently, according to a survey from 24 cyber threat intelligence feeds and analyzing data of over 1.3 million indicators, the average delay was reported to be 21 days. Surprisingly, 56% of participants in a survey felt that threat intelligence becomes stale within a few minutes, and even seconds at times. Despite that, the participants saw it as a parameter that builds the reputation of the source. This no way means intelligence, and companies should keenly monitor for such false promises by their CTI feed providers. 2. Geographical Location Many CTI feeds show a strong bias towards a particular nation or a particular geographic region. Everyone knows that a threat actor sitting in Latin America can

Complete Guide to Cyber Threat Intelligence Feeds Read More »

By Industry

By Compliance

Business Needs

Services

Contact Us