Next-Generation Enterprise Security and Governance

Mohiuddin Ahmed, Nour Moustafa, Abu Barkat, Paul Haskell-Dowland, Mohiuddin Ahmed, Nour Moustafa, Abu Barkat, Paul Haskell-Dowland

• Publisher: CRC Press
• Year: 2022
• Print ISBN: 9780367639624
• eBook ISBN: 9781000569797
• Edition: 1
• Topic: Business
• Subtopic: Business General
• Index: Business

The Internet is making our daily lives as digital as possible, and this new era is called the Internet of Everything (IoE). The key force behind the rapid growth of the Internet is the technological advancement of enterprises. The digital world we live in is facilitated by these enterprises' advances and business intelligence. These enterprises need to deal with gazillions of bytes of data, and in today's age of General Data Protection Regulation, enterprises are required to ensure privacy and security of large-scale data collections. However, the increased connectivity and devices used to facilitate IoE are continually creating more room for cybercriminals to find vulnerabilities in enterprise systems and flaws in their corporate governance.

Ensuring cybersecurity and corporate governance for enterprises should not be an afterthought or present a huge challenge. In recent times, the complex diversity of cyber-attacks has been skyrocketing, and zero-day attacks, such as ransomware, botnet, and telecommunication attacks, are happening more frequently than before. New hacking strategies would easily bypass existing enterprise security and governance platforms using advanced, persistent threats. For example, in 2020, the Toll Group firm was exploited by a new crypto-attack family for violating its data privacy, where an advanced ransomware technique was launched to exploit the corporation and request a huge figure of monetary ransom. Even after applying rational governance hygiene, cybersecurity configuration and software updates are often overlooked when they are most needed to fight cyber-crime and ensure data privacy. Therefore, the threat landscape in the context of enterprises has become wider and far more challenging. There is a clear need for collaborative work throughout the entire value chain of this network.

In this context, this book addresses the cybersecurity and cooperate governance challenges associated with enterprises, which will provide a bigger picture of the concepts, intelligent techniques, practices, and open research directions in this area. This book serves as a single source of reference for acquiring the knowledge on the technology, process, and people involved in next-generation privacy and security.

Chapter 1 Enterprise Threat Intelligence

Craig Jarvis

Independent Cyber Security Strategist

DOI: 10.1201/9781003121541-1

Contents

1. 1.1 Introduction: Security Risk & Intelligence
2. 1.1.1 Chapter Roadmap
3. 1.2 Organized Crime
4. 1.2.1 Identity Theft
5. 1.2.1.1 Countermeasures
6. 1.2.2 Financial & Asset System Targeting
7. 1.2.2.1 Payment Card Attacks
8. 1.2.2.2 Business Email Compromise (BEC)
9. 1.2.2.3 Direct Financial System Attacks
10. 1.2.2.4 Crypto Currency Attacks
11. 1.2.3 Extortion
12. 1.2.3.1 Denial of Service (DoS)
13. 1.2.3.2 Ransomware
14. 1.2.4 Infrastructure Squatting
15. 1.2.4.1 Countermeasures
16. 1.3 Nation States
17. 1.3.1 Espionage
18. 1.3.1.1 Countermeasures
19. 1.3.2 Financial Gain
20. 1.3.2.1 Countermeasures
21. 1.3.3 Sabotage
22. 1.3.3.1 Countermeasures
23. 1.3.4 Influence
24. 1.3.4.1 Countermeasures
25. 1.4 Hacktivists
26. 1.4.1 Countermeasures
27. 1.5 Cyber Terrorism
28. 1.5.1 Countermeasures
29. 1.6 Insider Threats
30. 1.6.1 Countermeasures
31. 1.7 Future Threats
32. 1.7.1 Artificial Intelligence (AI)
33. 1.7.1.1 AI: Cyber Offensive Applications
34. 1.7.1.2 AI: Cyber Security Applications
35. 1.7.2 Adversarial Machine Learning
36. 1.7.3 Quantum-Insecure Cryptography
37. 1.7.4 Cyber-Physical Systems
38. 1.8 Conclusion
39. Notes
40. References

1.1 Introduction: Security Risk & Intelligence

Security is dependent upon threat insights, otherwise known as intelligence. Without intelligence enterprises are unable to calibrate controls – they are blind, or at best, myopic. Cyber defense requires fighting battles on multiple fronts. Unlike in conventional warfare, enterprises cannot return fire – they must absorb the punishment of distant enemies. Occasionally, adversaries loiter closer to home, perhaps even within their own citadels. Enterprises must also be fortified against the carelessness of their own forces, whose mistakes may cost battles that at worst lead to corporate demise. To avoid such eventualities enterprises must be hardened against compromise, and incident response must be rehearsed – for history suggests breaches are all but inevitable. Post-compromise, enterprises are judged not only in the court of public opinion, but in regulator's offices, the rulings from whence could render billions of dollars in fines. Two principal factors determine the scale of such penalties: were proportionate defensive controls implemented? and, was breach response effective? Meeting the first of these requirements necessitates an enterprise risk assessment. Breach risks include confidentiality losses via stolen intellectual property or personally identifiable information (PII), integrity damage, such as the altering of bank balances, and availability impacts, such as extortionists encrypting enterprise assets. An evolving additional risk is that attackers endanger human safety, such as via the manipulation of traffic lights, or of manufacturing processes – such risks are rapidly transitioning from science fiction to science fact. The impact of these risks manifesting includes brand damage, competitive advantage forfeit, financial loss, and even enterprise extinction. Breaches are also often resume-generating events for executives, in particular the CEO, CIO, and CISO. A 2020 Ponemon study estimates breaches with less than 99,730 client records stolen cost enterprises an average of $3.86m. The same study found compromises of 1 to 10 million records resulted in an average $50m loss, whilst breaches exceeding 50 million records cost businesses an average $392m [1]. As regulations are made stringent, more of these costs are associated with fines. For example, Capital One was fined $80m for a 2019 breach that compromised the credit applications of 100 million users [2]. An even more severe £183m (~$250m) fine was issued to British Airways after a 2018 breach exposed 500,000 customer records, this was later reduced to £20m (~$26m) in recognition of the crippling impact the pandemic was having on the airline sector [3]. Cyber Defense Consultancy Director Dan Baker, who has worked with scores of technology executives, comments, “it isn't fear of criminals, it's fear of regulations that drives enterprise security investment” [4]. We can expect further large fines in the coming years.

Intelligence enables defense calibration minimizing breach risk. It is said that intelligence is the world's second oldest profession.¹ One of the first warfare philosophers, Sun Tzu, commented around 2500 years ago that, “the reason the enlightened prince and the wise general conquer the enemy whenever they move and their achievements surpass those of ordinary men is foreknowledge [intelligence]” [5, p. 144]. At its best, intelligence locates adversaries, reveals their intent and capabilities, and allows the devising of defensive countermeasures to diminish, or even remove, associated risks. Cyber security is critically dependent on intelligence. Traditional bricks and mortar enterprises had few exposure points. Security resided in physical security measures such as guards, and industry-specific controls such as merchandise alarm tags. Digital transformations, accelerated by the pandemic, have resulted in what scholar Frances Cairncross terms the “death of distance” – physical distance no longer hinders adversaries [6]. Therefore, enterprises now face a greater number of more diverse threats. The threat actors are often well-funded, highly skilled, and extremely persistent. Intelligence allows assessment of these disparate threats and controls calibration. Intelligence is also crucial in reducing an overwhelming number of security alerts to reveal critical events, and in improving the performance of the second factor regulators use in determining breach fines: incident response. Ultimately, intelligence enables better business decisions.

1.1.1 Chapter Roadmap

This chapter explores each threat group and offers selective countermeasure recommendations. In Section 2 organized crime is explored, with examination of identity theft, financial and asset systems targeting, extortion, and infrastructure squatting. Nation states are the focus of Section 3, with espionage, financial-gain operations, sabotage, and influence activities all explored. Section 4 provides an overview of hacktivism, which, whilst currently at a historical nadir, remains a problem to enterprises with particularly immature defenses. Section 5 considers the emerging challenge of cyber terrorism, whilst Section 6 assesses the risks of insider threats. Finally, Section 7 examines future threats including artificial intelligence, adversarial machine learning, quantum-insecure cryptography, and the vulnerability of cyber-physical systems on which our societies are dependent.

1.2 Organized Crime

Cybercrime represents the majority of enterprise attacks [7, p. 9]. Criminals manage their operations as multi-national high-revenue businesses and focus heavily on innovation. A rich and collaborative criminal eco-system underwrites the industry's prodigious success. Adversarial capabilities range from misguided self-taught teens, to organized criminal enterprises the sophistication of which rivals some nation states. Cybercriminals typically operate from jurisdictions beyond the reach of their victim's governments. For instance, criminal marketplaces often forbid their products use in the Commonwealth of Independent States (CIS), the home of a high concentration of cybercriminals [8], 22:00].² Malware may enforce geographic filters to ensure such diktats are not violated. Cybercriminals may also bribe local law enforcement to turn a blind eye to their operations, with the caveat that the criminal's activities must not target countries with which their government has good relations (for Russia, the CIS). In short, cybercrime offers perpetrators a drastic risk reduction in comparison to physical crime, a reality which has driven cybercrime's vertigo-inducing growth. There are several methods cybercriminals use to part enterprises from their profits.

1.2.1 Identity Theft

Identity theft involves criminals using stolen PII to impersonate victims for financial fraud. For instance, the threat actor may acquire credit in the victim's name before using that credit to make large purchases, which can then be cashed-out via black market resales. Such operations require a network of criminals involved at different stages of the attack chain, from malware authors, to money mules. Attackers can also sell the pilfered details online; such datasets are increasingly rich as attackers harvest victim's browser settings enabling an emulation of their digital identity, thus reducing the chance of anti-fraud detection. In 2020, the average dark web price for the details of a stolen credit card with an account balance of up to $5000 was just $20, physical cloned credit cards started at $15 [9]. However, identity theft is trending downwards [10]. This is because improving cyber security is removing the lowest hanging fruit upon which criminals feast, and as extortion attacks offer easier and swifter monetization. Initial access for identity theft is often achieved with spear-phishing, technical vulnerability exploitation, or via access brokers (actors who breach a network before selling their access, Mandiant assessed 2% of intrusions they investigated during 2020 were for this purpose) [11, p. 19]. Lateral movement typically occurs quickly, with the database servers almost always the destination from where PII is stolen.

1.2.1.1 Countermeasures

Database security is imperative to countering the bulk loss of PII. Sensitive data requires a well-documented lifecycle with encryption applied wherever possible. Identity and access management is also crucial. A least privilege model should limit the ability of entities to read from PII databases. Where possible two-factor authentication, ideally hardware (U2F) security tokens, should be used, especially for those with sensitive accesses. Cloud security is another common ingress method, with security firm checkpoint noting misconfiguration as the main associated problem [12, p. 23]. Such misconfiguration often leads to exposed credentials which can enable breach – enterprises should make use of tools such as GitHub's secret scanning to continually monitor for exposed credentials. Security firm Trustwave's SVP of Strategy Marco Pereira comments, “most people don't truly understand the profound security implications of [the] cloud, it's like our understanding of the Internet 25 years ago” [13]. Cloud security should be a focus to manage all threat actors, as should patching. Dark web monitoring should be considered for stolen data identification. Enterprises should also consider defensively searching client email addresses against breach lists, such as www.haveibeenpwned.com. Any available credentials on the dark web will often become part of a credential stuffing attack, whereby the username and password are tried against multiple websites as an attacker hopes to find an instance of password reuse. Where breached account owners are identified they can be notified, and provided security recommendations.

1.2.2 Financial & Asset System Targeting

1.2.2.1 Payment Card Attacks

Targeting of enterprise points of sale (PoS) infrastructure is becoming more challenging due to security advances. Chip and pin technologies are also minimizing the locations at which stolen credit cards numbers alone can be used. Additionally, the rise of extortion-oriented attacks have caused criminal groups, such as Russia-based Carbon Spider, to transition from PoS attacks to ransomware [11, p. 6]. There are two main PoS targets – PoS physical infrastructure, such as retailer payment terminals, and online payment systems. Verizon found that o...

Table of contents

• Cover
• Half Title
• Series Page
• Title Page
• Copyright Page
• Dedication
• Contents
• Preface
• Contributors
• 1 Enterprise Threat Intelligence
• 2 Enabling Corporate and Institutional Governance for Effective IT Governance
• 3 The Non-Malicious Risky Behavior in the Enterprise Information System Security
• 4 Cybersecurity Incident Response in the Enterprise
• 5 Cyber-Enabled Crime as an Enabler in Market Manipulation Schemes
• 6 Data Lakes: A Panacea for Big Data Problems, Cyber Safety Issues, and Enterprise Security
• 7 The Battle for Cloud Supremacy and the Remaking of Enterprise Security
• 8 Security, Privacy, and Trust of Emerging Intelligent Transportation: Cognitive Internet of Vehicles
• 9 IT Governance and Enterprise Security Policy in the 6G Era
• Index