Tag: Rogue Actors

Antivirus and Antimalware solutions are designed to protect computer and servers from becoming victims of bad actors (aka hackers). The entire purpose of these solutions is to provide protection, security, and assurance that your machines are safe. Antimalware solutions are considered an essential or basic part of every person’s and business’s computer security. Other than security experts who have their own ideas on protecting their own machines, it is recommended by just about everyone to have antimalware solutions on computers as a rule.

Think about it, antimalware tools might be the ultimate applications. They are installed on a large percentage of computers across the world, they require access to all files to work, and they are trusted. But they can also be used as a backdoor into computers and workstations.

In the news this week, three major US players in the antimalware software game may have all fallen victim to being compromised. Symantec Antivirus, Trend Micro, and McAfee all have been rumored to have been compromised. As of the posting of this article, Symantec has denied any breach, McAfee has said they are investigating the situation, and Trend Micro admits some non-critical data has likely been compromised.

Whether these companies were breached, or critical data was taken, we may or may not find out in the near future. What we do know is no company nor data is safe. RSA which was and may still be considered one of the leaders in digital risk management and cybersecurity solutions including dual factor authentication tools was compromised a few years ago.

Is the answer to switch antimalware solutions? Or, stop using them anyway since they offer backdoors into your systems? No, not at all. These incidents simply reinforce the need for layers of security protection. Many businesses and people on personal computers say, “well I have antimalware software installed, what else can I do?” The reality is this comparable to asking, “I put a door on my house, what else can I do.?” On your house, you don’t stop at the door; you add door locks, deadbolts, security systems, cameras, etc. You must do the same with cybersecurity. There isn’t a buy one fits all option.

It’s time to look for solutions that augment your standard antimalware solution. This can include solutions that look at behavioral characteristics of your network above and beyond antimalware’s traditional signature method. Another great solution is to add honeypots to your infrastructure with appropriate alerting built in. In one of the articles sourced for this blog, the publication captured dialog between the bad actors in a chat log. Within that dialog, the few lines below reveal the bad actors are using products that are used by employees:

Please note, these logs are translated from Russian and the English translation might sound awkward. Basically, the bad actors will use things like RDP, which almost all institutions utilize, plus some other applications that may be more specific to each individual business. To make a long story short, these guys are smart and navigate your network with the same tools your employees use. This is known as living off the land.

On average, it takes organizations 200 days or more to learn that they have been breached. The longer a bad actor has access to a network, the more damage they can inflict.

However, what if there were folders, servers, and databases on your network that were accessible via RDP or other technologies, but they served no business purpose? These assets would serve as bait for the bad actors. Suddenly, you can identify the traffic as likely snooping and not normal activities. This is the beauty of honeypots. It helps isolate suspicious traffic from normal activity based on the interest in the material, not the method of accessing it.

It is always important to keep up with the latest news about cybersecurity. If you use one of these solutions, be sure to keep up with the latest news from the company. If you don’t use one of these companies, you could be next. Stay vigilant as every company is one nightmare away from having a breach, including yours. In the meantime, evaluate the layers you have in place. Heavily consider some type of honeypot solution, as it might be one of the few solutions that can catch true covert snooping. As always, Safe Systems is here to help evaluate the layers you have in place to help ensure you have the extra protection.

Atlanta-based regional bank SunTrust issued a formal statement on Friday, April 20th notifying 1.5 Million customers that their personal data may have been compromised in a data breach orchestrated by a now-former employee.

The announcement came during an earnings call when CEO William Rogers said the employee had worked with an outside third party to steal client contact lists. The data included customer names, addresses, phone numbers and account balances. The data did not include social security numbers, account numbers, user IDs, passwords or associated driver’s license information.

Initially, the bank became aware of an attempted data breach by the employee in late February when the employee attempted to download client information. This triggered an internal investigation, which eventually lead to last week’s public announcement. They believe the employee may have printed the information with the intention of sharing it outside the bank.

At this time, SunTrust is working with law enforcement and is declining to provide any additional detail or make any further comments about the ongoing investigation. The bank has begun to notify individual customers whose data may have been stolen; as well as, offering free identity protection service to all of their customers.

Mr. Rogers said in a statement, “Ensuring personal information security is fundamental to our purpose as a company of advancing financial well-being. We apologize to clients who may have been affected by this.”

If you are a SunTrust banking customer, SunTrust if offering Experian’s IDnotify service free of charge. Visit https://www.suntrust.com/identity-protection to sign up.

Cyber Crime Terms Every Financial Institution Should Know

Defending yourself and your bank against cybercrime requires a mutli-layered, proactive approach. Threats come in many forms and with many malicious intentions. Safe Systems provides community banks and credit unions with innovative security solutions and tactics to help you stay a step ahead of cybercriminals.

Strengthen Your Strategy: Why a Layered Defense is the Best Choice for Your Bank’s IT Security Program

Learn why a single layer of security, such as antivirus, is no longer enough in the current risk environment.

Cybercrime and threats continue to be at an all-time high. An attack on a financial institution resulting in the loss of data can have a devastating effect on the organization’s revenue and reputation. In addition, the amount of time and money needed to resolve these attacks can be significant.

While we hear about cybercriminals and the effects of cybercrime, we’re left wondering, why do these criminals attack? In years past people would say cybercriminals attacked for the fun of it. However, now people turn to hacking for a variety of financial, political, and ideological reasons.

Three of the top reasons cybercriminals attack include:

Bragging Rights or Power

Some attackers, be it individuals or members of a larger group, will target large, well known organizations with the hope that the resulting recognition or publicity will give them bragging rights within the hacker community. This was best illustrated by attacks perpetrated by a teenager named Michael Calce (aka MafiaBoy) in early 2000. These attacks brought down large websites such as Yahoo, eBay, and Dell. Calce was later arrested after bragging about his attacks on the internet via IRC.

Political or Personal Agendas

Some attackers target particular companies, websites or governments as a way of drawing attention to their own political beliefs or personal grudges. In many cases, the attackers are disgruntled employees (or former employees) of an organization looking for revenge. Other attacks in this category can be attributed to nation states who are acting on political agendas.

An example is Blue Security and its anti-spam product, Blue Frog. Attackers did not like that the organization was blocking spam so they launched a distributed denial of service (DDoS) attack on the company and the organization shut down.

One of the largest DDoS attacks was launched against KrebsOnSecurity.com in retaliation for a series the site produced on the takedown of the DDoS-for-hire service, which coincided with the arrests of two men.

Financial Gain

In today’s market, cybercriminals have found it lucrative to readily sell stolen data on the black market. Or, attackers will penetrate organizations as a form of extortion, demanding payment with a deadline with the threat of an ensuing DDoS attack. Recent FBI statistics indicate that hackers were able to successfully extort more than $209 million in ransomware payments from businesses and financial institutions in Q1 2016 alone. While we hear about attacks on larger well-known organizations, it can actually be more profitable for an attacker to target smaller, lesser known organizations since their security measures might not be as tight.

Community banks and credit unions cannot be complacent when it comes to protecting themselves and the sensitive information they hold. It is critical to defend your institution with a variety of security layers, not only firewalls and anti-malware, but additional security layers designed to guard against cybercrime.

Cybercrime continues to be a growing problem for community banks and credit unions. Today’s criminals continue to develop increasingly sophisticated tactics to exploit systems. The goal of an attacker is to gain access to an organization, locate and extract valuables, and avoid being discovered. These intruders are referred to as rogue actors.

What is a Rogue Actor?

There are two types of rogue actors. The first type of rogue actor is an external individual or group who enters an organization’s systems without prior authorization. This unauthorized access could come from an external attack, or through a physical presence. This physical presence could be accomplished using social engineering techniques. In this scenario, the adversary poses as a printer repair tech, or any potential vendor, and gains unauthorized physical access to your systems. The second type of rogue actor is an adversarial insider attempting to obtain unauthorized access to valuable data for personal gain or malicious intent.

How to identify a Rogue Actor?

One effective strategy to identify a rogue actor is for organizations to place decoys throughout their environment. Since there are no legitimate reasons for the decoys to be accessed, an alert will notify the appropriate groups on the anomalous activity. If the organization’s other security layers are bypassed, these alerts enable the organization to quickly remediate the issue. There have been several major breaches over the last few years that likely would have benefitted from these types of decoys within their organization. It is important to be aware of any suspicious activity so you can successfully mitigate risks and prevent data loss.

What is the impact of a Rogue Actor?

The impact of having a rogue actor on a network can be devastating to a financial organization, with the main risk being theft or unauthorized access of data. Financial institutions are prime targets due to the amount of sensitive data they house. A data breach at a bank or credit union not only affects that organization but also all customers or members whose personal information may be compromised or stolen. Rogue actors can then hold the compromised data for ransom or sell it on the black market.

While financial institutions are aware of the importance of protecting their network from adversaries and possible outside attacks, many are not investing in protecting themselves against breaches coming from internal threats. These rogue actors could be an employee, an outside attacker, or another unauthorized user trying to access valuable data.

Within the last few years, several major breaches have been perpetrated by attackers exploiting a weak point within an organization and then scanning the network to gather information. While cybercriminals have certainly realized the benefits of targeting financial institutions, community banks and credit unions have been slower to realize the importance of monitoring for rogue actors and reacting to this danger.

Costly Invasions

As an example, a previously undetected hacker group, now known as the MoneyTaker group, has netted approximately $10 million in ATM network heists from at least 20 companies, including U.S. banks and credit unions, by targeting the networks banks use to transfer money. According to Group-IB, a global leader in preventing and investigating high-tech crimes and online fraud, the attackers used a form of malware that is stored in the memory of the computer, which makes them extremely hard to detect by traditional antivirus defenses. This also makes it very difficult for organizations to know they have even been hacked since all traces of the invasion are destroyed each time the machine is rebooted. On average, it can take an organization more than 200 days to discover that their network has been compromised.

Setting Out Bait

Security experts agree that a missing piece in many institutions’ security strategy is identifying unusual activity and having solid reconnaissance protection in place. One of the few ways to do this is to deploy what is known as decoy data and services onto the network. This technology serves as a trap for someone who is looking to gain illegal access to the network. Remediation processes can begin immediately once an attacker accesses the “bait” or “decoy.” Any unusual activity on these areas will trigger an alarm, since no there are no legitimate reasons to access the decoys.

Examples of decoy information placed on networks typically include items like port scan sensors, remote desktop protocols, SMB shares, FTP and/or SQL.

Protection for Community Financial Institutions

Many organizations that recently experienced breaches would have benefitted from implementing a solution to effectively monitor and detect unusual activity on its internal network. For community banks and credit unions, perimeter defenses can only do so much to protect their institution and customer information. Cybercriminals will continue to develop sophisticated forms of malware and carry out targeted attacks to compromise their networks. To be truly protected, it is important for financial organizations to monitor for internal threats and stop unauthorized network users before they strike.

2018 Community Bank IT Outlook

Primary Research and Analysis of Your IT Priorities in 2018