Chapter 6: Security & Evolving Technology

Advanced Persistent Threats

• High degree of planning, resources and techniques
• A targeted threat composed of complex attack vectors that can go undetected for extended periods of team
• Characteristics
• Well researched
• Sophisticated
• Stealthy
• Persistant
• Targets
• Large organisations
• Small orgs in the supply chain
• Government agencies
• Intelligence Agencies
• Stages of an APT Attack
• Target Selection
• Target Research
• Target Penetration
• Command Control
• Target Discovery
• Data Exfiltration
• Intelligence Discrimination
• Information Exploitation

Risk

• Physical Risk
• mobile devices are easy to lose/steal
• BYOD can result in increased attack attempts
• Unprotected data can allow hackers to access
• Links to other accounts breached i.e. email
• Controls:
• Cell tracking and locators
• Remote shutdown/wipe
• Remote sim lock
• Organisational Risk
• Increase in BYOD opens up more risk
• Mobile devices are weaker and more difficult to control
• Rapid evolution requires continuous update
• Technical Risk
• Activity monitoring and data retrieval
• Unauthorised connectivity
• Activity Monitoring and Data Retrieval
• Messaging: SMS/MMS/Redirect/Phishing
• Audio: cover call/recording
• Picture/Video: sharing/copy
• Geolocation: GPS data/timestamps
• Storage: device attacks e.g. HHD/SSD

Risks

• Unauthorised Connectivity
• EMAIL: data transmission
• HP GET: browser based attack
• CP/UDP: simple data transmission
• DNS EXF: data transmission, slow and hard to detect
• Bluetooth: generic attack, close range
• WLAN: full command and control
• Sensitive Data Leakage
• Storage of large amounts of data on mobile devices increases risk of leakage
• May be accidental or malicious side channel attack
• Identity: IMEI, customised user information, update stats, weaknesses of potential zero day updates
• Credentials: user names, passwords, key strokes, tokens, certificates
• Location Files: GPS data, location behaviours, files stored in OS
• Unsafe Storage: store in plaintext and replicated without encryption, use of cloud can increase risk of loss

Bring Your Own Devices (BYOD)

• Advantages:
• Shifts the cost to users
• Worker satisfaction
• Frequent upgrades
• Cutting edge
• Disadvantages:
• IT loss of control
• Unknown security risk
• Difficult to implement
• Acceptable user policy
• Unclear data ownership

Cloud Computing

• A model for enabling convenient, on demand network access to a shared pool of configurable computing resources that can be rapidly provisioned.
• Risks
• Loss of governance
• Locked into a single provider
• Isolation failure
• Compliance failures
• Management interface compromise
• Data protection
• Malicious insider
• Threats:
• Data breach
• Data loss
• Account Hijack
• DOS
• Malicious insider
• Abuse of services
• Lack of due diligence
• Shared technology
• Insecure API