Page 2 of 2
Most cybercriminals begin their attack targeting the low-hanging fruit, Bejtlich said. Sophisticated methods are not necessarily needed to gain access to systems and files being targeted.
"These cases start out with the simplest thing you can do to get in the enterprise," Bejtlich said. "Once the adversary senses that you have found them and you start to kick them out, they switch to other tactics and they escalate to a better command and control, stealthier persistence and so forth."
It took a warning to alert the Times that something was amiss. The Times reporters were advised by an official with the Chinese government that there would be consequences if the stories were published. The Times reached out to its Internet service provider, AT&T, which indicated that it saw signs of network traffic that came from a Chinese threat group being tracked by its security researchers. The forensics team was then brought in to determine if a breach had occurred and eradicate any signs of cybercriminal activity on the network.
The attack on the Times and reportedly The Wall Street Journal as well, demonstrates the need for IT teams to monitor systems closely and have a rapid incident response plan when a potential problem is spotted, Bejtlich said. At the Times, the attackers moved throughout the company's systems, eventually gaining access to a domain controller containing the passwords of every employee of the company.
Bejtlich said rapid detection and response is important to contain and control the scope of the problem. Network segmentation is important to hinder an attacker's ability to move throughout corporate systems using legitimate account credentials. A third best practice is to have credentials that are not static, he said. Rather than using an employee's account credentials for IT assistance, temporary passwords can be used by IT administrators to remotely access employee computers.
"If you are monitoring your activity and you see people jumping from computer to computer, that is not consistent with normal business activity," Bejtlich said. "If you can detect that quickly and then contain it you can keep the bad guy from accomplishing his mission."
PUBLISHED FEB. 1, 2013
<< Previous
|
1
|
2
