Learning to think like a hacker is a first step toward stopping one
Note: there’s a bit of self-promotion for CyberGuard360 toward the end as I speak to the need for robust, layered protections.
Cybercrime is big business. Lucrative results have spurred a large industry of crime organizations run by hackers who are sophisticated, organized, highly-trained, and well-funded. Some are just as technologically sophisticated as the most advanced IT companies – and move just as quickly to adopt the latest innovations, from artificial intelligence to cloud computing.
Cybercrime costs the world economy an estimated $600 billion a year and attacks show no sign of slowing down. After all, hackers perceive little risk of being caught and punished, and technology users who fail to take protective measures make infiltration far too easy.
University of Maryland research reports that hackers attack computers with Internet access every 39 seconds. There’s no single play book cybercriminals follow that companies can crack to thwart attacks. But learning to think like an attacker – and understanding the most common tricks and techniques – goes a long way toward protecting your organization from cybercrime.
Let’s take a look at a how a typical attack unfolds.
The 5 steps of a data breach
- Long before they enter a network, hackers invest time into understanding their targets. They study a company’s network, online user behavior, and system vulnerabilities – gathering as much publicly-available information as possible, including network ranges, IP addresses, and domain/host names. The names, positions, email addresses, and even some personal details of key players in a company are often readily available on social networking sites like LinkedIn, opening the door for potential phishing attacks.
- Once their research is finished, hackers choose the best way to slip into a system undetected. The most common methods involve phishing, infected websites, or malvertising that tricks employees into exposing sensitive data or downloading malicious software. Tools that assist their criminal endeavors are easy to find on the dark web, including port scanners that reveal which ports are open, password crackers, and vulnerability exploitation, traffic monitoring, and encryption tools.
The biggest warning signs of an attack are often official-looking emails that ask employees to take some sort of action, like changing passwords or downloading a new tool. More than 92 percent of malware is delivered via email.
Typosquatting attacks are also surging in popularity. Hackers use spear phishing to direct employees to fake websites that spoof legitimate destinations but have a deliberate, easy-to-overlook typo in their names (“gooogle.com,” for instance, instead of google.com). As soon as the employee visits the site, malicious code able to infect the entire company network can be downloaded onto their endpoint. The fake sites also often prompt victims to login, giving bad actors access to their credentials.
- Once hackers gain access to an endpoint they pivot, using the compromised device to infiltrate other devices that would otherwise be hard to reach. They have many tools at their disposal for penetrating a company’s systems and networks, escalating privileges and gaining system administrator credentials that grant them broader access.
Malware or ransomware can log keystrokes, waiting for passwords, or turn into a worm that searches for vulnerable systems so it can spread throughout a network. If the hacker used user credentials to slip inside, they can simply plant a worm and leave – keeping the attack going for months or even years before it’s detected.
While hackers have many motives for breaching a network, most often they are looking for data they can monetize. Generally, their goal is to hijack as many systems as possible – seizing control of the network and widening the attack surface. The malware then establishes “command and control,” enabling a server controlled by the attacker to send commands to the compromised system.
The stealthy harvesting of sensitive and high-value data begins, perhaps pilfering credentials, personally-identifiable information, emails, business data, or transaction information. The 2018 Cost of a Data Breach Study by Ponemon found that companies take an average of 196 days to detect a breach.
- Once attackers find what they want, they take steps to achieve their endgame. Often this includes encrypting the company’s data so its Intrusion Detection Systems (IDS)/Intrusion Protection Systems (IPS) don’t detect or block its removal. Once the data is stolen, it usually travels one or more anonymous routes throughout the Internet so it can’t be tracked.
Successful attacks may include:
- Opening command and control communications
- Gaining administrative access
- Denying access to systems
- Exfiltrating data
- Destroying data
- Persisting in the system
- Covering tracks
- Cleaning up is the final step in a cyber-attack. Hackers carefully erase evidence that they were in the network – partially so they can get away unscathed, and partially so they can attack it again in the future.
In today’s threat environment, it’s no longer a matter of if a business will experience a cyber-attack, but when. Organizations must be proactive about hardening their attack surface and responding quickly and effectively to attacks.
That’s why CyberGuard360 is setting a new cybersecurity standard through its latest innovation, CyberGlass. It offers the highest level of protection on the market with the groundbreaking ability to not only spot attacks – but fix them.
It is the first and only product to combine all the elements of a complete cybersecurity program into a single actionable interface. Not only does CyberGlass gather significantly more data than traditional SIEM tools, but it adds components like direct asset access and automation that companies would otherwise need to acquire separately to achieve maximum protection.
Cybercriminals rely on sophisticated tactics and ineffective security measures to penetrate an organization’s defenses. CyberGlass offers the next-generation protection businesses need to spot and resolve ever-evolving attacks before they can wreak havoc in a network.