September - 2019ENTERPRISE SECURITY| | 9compromise. Many information security programs are not adequately funded or have the proper resources to protect the organization's environment. To maximize the resources, we have to determine which organizational information security risks will be prioritized for mitigation. It is essential to understand how the adversary thinks to help with this prioritization and not have any pre-conceived ideas or assumptions regarding the threat or attack. It is easy to miss an essential element that can be exploited if all the attack approaches are not evaluated.Over the past 15 years, I have reviewed information security literature, data breach reports, legal cases, and had discussions with information security professionals and developed the following list of attack methods most commonly seen. · Authorized account misuse - authorized accounts are used to gain unauthorized access to data; · Implied trust exploitation - involves employees, trusted partners, or other third parties that have trusted access to the assets or data; · Denial of Service - disrupting access to specific resources; · Physical - exploiting vulnerabilities in the physical realm utilizing various techniques against physical entities and properties; · Supply chain compromise - manipulation of computer system hardware or software that disrupts the supply chain lifecycle; · Social engineering - interpersonal manipulation to gain access to systems or data; · Malicious software - occur using software such as viruses, worms, Trojans, and spyware designed to infiltrate a computer system without the owner's informed consent; · Misjudgment or error - related to mistakes made by authorized individuals allowing data or systems to be compromised; · Cryptographic and password attacks - bypasses the security of a cryptographic system by finding a weakness in code, cipher, cryptographic protocol or key management scheme; · Data interception - monitoring the data streams to or from a target to gather information occurs; and · Operating system and application - deliberately causing a fault in the asset's operating system or application. As each attack method is reviewed, evaluation of the attack from the perspective of an external user (no trust or system privilege), partner (implied trust and system privilege), and internal user (full trust and privilege) is necessary. The next step is to assess the exploitability, prevalence, and potential controls that can help mitigate the successful attack. From this evaluation, an organization can at least prioritize the controls that have the most significant impact in reducing the overall risk while maximizing the use of resources. It is interesting to note that often the adversary will combine multiple attack methods to gain access to the organization's assets after they complete their reconnaissance of the infrastructure and systems.Information security professionals must learn from past events and understand the applicable attack methods so they can help their organization implement controls and practices that make sense and are agile enough to stay ahead of the evolving threats. Many good organizations have implemented basic administrative, physical, and technical controls and maintain mature information security practices. Even with this maturity level, the organizations are still at risk of being successfully attacked. Unfortunately, this level of maturity seen in some organizations is not uniformly implemented across all organizations that are protecting our confidential data, which is a contributing factor in the potential breaches. It seems that we expect different results without changing any of our actions ­ not something any information security professional wants or should accept. It is essential that we continue our fight for good practices and educate our leaders as to the risk of the status quo or inaction. ESUnderstanding how the adversaries target assets is an essential step in determining what controls are necessary or at least have the best chance of protecting the asset against compromiseCris Ewell
< Page 8 | Page 10 >