When it comes to enterprises finding innovative ways to neutralize widespread email-based attacks, I’ve made the case before that it's employees – the same “weak links” who unknowingly click on malicious email URLs and attachments – who could actually be the strongest allies of IT managers in fighting back against these threats.
There’s one caveat, though. The “human firewall” will not be as successful if employees are merely aware that email-based threats exist. Attackers know employees either don't care about cybersecurity or don't know enough to ward off threats, which is why spear-phishing and social engineering attacks continue to be so effective.
Attackers know employees either don't care about cybersecurity or don't know enough to ward off threats, which is why spear-phishing and social engineering attacks continue to be so effective.
To explore the problem further, last week I hosted a webinar, "The Human Firewall: Strengthening Email Security," where I was joined by Mimecast Product Manager Steve Malone and Forrester Research Analyst Nick Hayes.
Here are three takeaways from the webinar:
1. Shore Up Your First Line of Defense
Picture your cybersecurity infrastructure. At the core is all the sensitive data you're trying to protect. The first line of defense should be your cybersecurity technology. This is critical. Technology is not a security guarantee, but if you have the right controls in place, like Targeted Threat Protection, then fewer threats will actually break through.
This is important because your next line of defense comprises your employees – the “human firewall.” If your technology is working correctly, employees won’t be overwhelmed by a wave of continuous threats; they'll be less likely to fall victim to the few that may enter your infrastructure.
2. Appeal to Employees' Ability and Motivation
So, what happens when a threat actually does reach your “human firewall”? Are your employees properly trained to recognize and react to it? The answer depends on how well they were trained.
To illustrate how to educate employees, Nick gave the hypothetical example of a mobile phone ringing and explained there were two reasons why someone wouldn't answer it – either they didn't have the ability to do so (too busy) or didn't have the motivation (just didn't feel like talking).
Applying the example to cybersecurity training, "ability" refers to whether employees have learned how to recognize and respond to threats, while "motivation" refers to whether they understand the consequences of whatever action they take, right or wrong.
The best training stresses both, and does so in compelling language that employees will remember.
3. Link Desired Behaviors to Necessary Knowledge
Once employees understand the threats at bay, the next step is to teach them new behaviors. To get to that point, employees need context. You first have to identify their current behaviors putting your organization at risk. This could be, for example, clicking on malicious links or attachments.
Once those behaviors are clear, determine the desired alternatives. So, instead of clicking on a malicious link, you'd want your employees to recognize a link or attachment as being malicious and then flag it to the IT department. By working backwards from that point, you would know exactly the knowledge you would need to impart upon your employees about email-based threats.
The Writing is on the Firewall
While it may seem farfetched that IT departments can build a savvy, well-trained army of cyber defenders from the same employees who previously snuck shadow IT into the workplace and jeopardized enterprise security, the process works. We've seen the technology and the “human firewall” go hand-in-hand to protect organizations that were previously vulnerable. And it can work for your company too.
To learn more, please play our on-demand webinar, "The Human Firewall: Strengthening Email Security."
It’s long been said that when botnets first appeared, they were the first usable forms of cloud computing. Now with hindsight they fit the NIST definition of cloud computing very well and have become rapidly scalable and on-demand.
More recently criminal malware has taken a turn towards being more akin to enterprise-grade software through its entire lifecycle. It’s not unusual to find your rental of a botnet now comes with 24x7 support and channel reseller margins. Buying exploit kits, renting botnets, and using enterprise-grade cloud technology, Crime-as-a-Service (CaaS) has become part of the latest breed of XaaS, offering the same benefits of cost and complexity reduction as well as lower barriers to entry. Using CaaS gives anyone an instant criminal business model in the cloud.
What we know today, is that CaaS is starting to have its own marketplace, run by well organized criminal mega-gangs; support contracts for purchasers are not uncommon.
CaaS has been given much publicity since the 2014 Internet Organized Crime Threat Assessment (iOCTA) report from Europol described the commercialization and availability of the technology and how it’s impacting legitimate enterprises in real time.
The rise of CaaS is another step on the roadmap of the crimeware that has been instrumental in many of the most recent attacks, where Zeus and its variants like Citadel and Gameover have led to significant loss of data. What we know today is that CaaS is starting to have its own marketplace, run by well-organized criminal mega-gangs; support contracts for purchasers are not uncommon, nor are healthcare and pension plans for employees.
This threat takes how we think about our own protection to a new level. The high-profile breaches of the last twelve months all managed to evade well known or best of breed corporate defenses, so it’s no surprise that enterprise IT managers and CIOs are starting to lose sleep about their next big breach. In many cases, this fear is born out of a realization that platforms like CaaS have become rapidly more advanced than the protections they have within their own environments.
Targeted Threat Protection is once again at the top of the agenda, for C-level managers, as well as those who deploy and run the technology. The sophistication of the attacks means we can no longer sit back and wait for our protection to do its job. We all need to become much more actively defensive – not offensive, but active in our defenses.
In tennis, you never want to commit an unforced error. These are the worst kind of point-costing blunders a player can commit – the completely avoidable, self-inflicted ones that have nothing to do with the skill of the opponent or the excellence of their shot.
Losing to an exceptional opponent is not (really) something a tennis player can control, but losing because of an untimely, unforced error, or a series of them, is a different story.
If you've ever worked in information security, you can probably see the parallel.
Every day, you fight talented opponents of your own – sophisticated cyber-criminals who constantly evolve their methods to exploit any and all vulnerabilities you may have. And every day, you and your peers are losing battles to these criminals, who can exploit both your unforced errors – self-inflicted failures of your cybersecurity technology – and create clever schemes that trick your users.
These attackers have a strong track record – more than half of U.S. small businesses now say they have been victims of a cyber attack, according to the National Small Business Association (NSBA). And an overwhelming majority of these attacks – 91 percent – begin with email-based phishing and elaborate, highly targeted spear-phishing schemes.
These attacks are so effective because of the simple fact an IT department can't completely control all of its users, all the time – they're too unpredictable, and it only takes a mistake by one user for a breach to be successful. However, what an IT department can control is the technology it uses to protect its email systems from spear-phishing attacks. Failure to do so is an unforced error that could cost you.
You certainly wouldn't be alone. Secure Mentem President Ira Winkler, speaking at RSA Conference 2015 in San Francisco, said that even though users get the blame following a successful spear-phishing attack, it's usually a failure of technology that allows the socially engineered email bait to arrive in their inboxes in the first place.
Technology should be your first – and second, third and beyond – line of defense. If a malicious email is neutralized by your spear-phishing defenses long before it even reaches your employees' inboxes, they won't even have a chance to facilitate the attack unknowingly – users can't click on links or download attachments that they never see.
That's where Target Threat Protection (TTP) comes into play. With this technology in place, CIOs, CISOs and IT department heads gain the peace of mind that their users are protected against targeted spear-phishing attacks. Even if – or perhaps, when – a user clicks on the wrong link or downloads the wrong attachment, IT departments will know they have a fail-safe in place to end the attack before it spreads.
As Winkler said during his RSA session, "there is no such thing as a perfect countermeasure," and he's right. But TTP will reassure you that you have the technology you need to create a first line of defense.
To learn more, please see our new whitepaper, "The Spear-Phishing Attack Timeline" which walks through the stages before, during and after a spear-phishing attack and provides a minute-by-minute look at how these attacks can be prevented.
It was reported earlier this month that Russian hackers accessed President Barack Obama’s email system inside the White House. When asked to comment on the attack, Deputy National Security Advisor, Ben Rhodes, said: “We do not believe that our classified systems were compromised.”
Regardless of whether or not an email system is classified, the fall-out of a cyber-attack can be dire. After the recent barrage of data breaches in the U.S. – spanning the retail, entertainment and healthcare industries, and now the government – it’s time for organizations to take action when it comes to email security, specifically, making employees aware of existing threats. Here’s why:
The White House hack was triggered when a compromised email account in the State Department was used to send a spear-phishing email to an individual in the White House and the executive office of the President. The State Department was aware of the breach and forced its network offline to try and rid themselves of the hackers.
Some are drawing the conclusion that human error was at fault – exploiting individuals in the White House allowed the hackers to pivot their network access into a more sensitive and secure network than the one they initially compromised. In complex long-con attacks like this, where threat actors are resident on a network for long periods of time, it becomes almost inevitable that someone will eventually (and unknowingly) help them reach their ultimate goal. Trust is built quickly by email, and it is likely the attackers exploited the trust of having a @state.gov email address to gain access to the White House and POTUS. This use of a trusted third-party is getting more common, and something I’ve written about previously.
What worries me about Rhodes’ statement is; he’s hinting about the security of the classified systems at the White House. No doubt checks have been made to ensure there are no obvious compromises. But just as humans were used to move from the State Department to the White House, the same could surely be true of a further attack inside the White House to gain access to the classified systems. It wouldn’t take too much effort on the part of hackers to move from the unclassified to classified systems. Exploiting the weaknesses in humans once is easy, with only a little trust to abuse, but given a lot more trust, elevating privilege internally becomes very simple.
Humor me for a moment. If I was an attacker, and had been successful, I would have made sure that Mr. Rhodes and his colleagues from the FBI and Secret Service would never detect my presence. So while Rhodes does not believe his classified systems have been compromised, I’m sure he is still hunting for intruders.
Given the complexity of this attack, against what could be one of the most protected governments in the world, it would be fair to say that there’s no amount of technology that can keep out skilful and determined hackers. Do we give up on the technology? Or perhaps revert to pen and paper or typewriters? Of course not.
Making humans aware enough to not react to the social engineering in a spear-phishing email in the first place should be a top priority of any CISO, CIO and IT manager. Deploying a new spear-phishing gateway is important but may not be enough. You need to make sure users – humans – understand the risk, the threat and how to detect the presence of an attack.
Once you achieve this understanding you’ll have deployed a key part of your security infrastructure - your own human firewall. And it’s humans who are your key protection against these new and emerging threats.