Countermeasures against targeted attacks in the enterprise

In the early days of computing, viruses commonly hopped from one machine to another via floppy disk. Few machines had proper antivirus protection, and even fewer users cared about security as malware was largely benign and had limited network and application resources at their disposal.

Now we are entering a new age when not only is malware prevalent and dangerous, but human actions also matter more than any myriad of security technologies an organization may have in place. This confluence has spawned a flood of targeted attacks that look to exploit human mistakes. At the core of many of these attacks, we find social engineering. Social engineering attacks prey on human vulnerabilities, and are fueled by the availability of data about potential victims.

This tip will explore some of the most prevalent and dangerous varieties of targeted attacks victimizing enterprise users today, and how security organizations can defend against them.

The effectiveness of social data mining
A key piece of the puzzle in preventing targeted attacks is to make data mining difficult. Also known as buddy mining, this is when attackers seek to learn who knows who, and how. If attackers have an understanding of the trusted relationships within an organization, they can exploit that knowledge to plant malware and acquire sensitive data.

For instance, if an attacker learns that two employees with an organization, Joe and Lucy, are friends, he or she might send Joe an email purporting to be from Lucy. The text of the message might say, "Joe, take a look at this funny slideshow I put together. Later! Lucy." If the attacker can persuade Joe to open the email amid the guise of his trusted relationship with Lucy, it gives the attacker power over that user to spread malware virtually at will.

Similarly, consider a malicious email to all employees appearing to come from the system admin, saying "We are under attack by viruses, and I am working on updating our firewalls. To help me protect the system, please install the attached virus shield on your machines right away. Thanks! Bob". Such a message seeks to exploit the trusted relationship between employees and IT staffs.
How can an attacker obtain the organizational charts of a company he or she wishes to target? There are many ways. For example, consider the simple Google query: "at site:linkedin.com"

This will return a list of public LinkedIn profiles to be returned, and each result will specify the name of the person working in the specified company, his or her position, and maybe even a list of his or her closest colleagues. An attacker who knows the email address formatting conventions within a company would automatically know the email addresses of many potential victims. But knowing the names of employees may let him find personal email addresses for target individuals, too, in order to reach victims outside the protective shields of their companies. This can be achieved by looking for other instances of name and other identifying information; after all, given only name, gender and zip code, 90% of Americans are uniquely identifiable.

Defending against social data mining
How can enterprises defend against social data mining? To aim at the root of the problem, one can protect the names of employees on corporate websites, and discourage employees from maintaining public profiles on social networks (whether for work or for fun). That makes it harder for an attacker to design and initiate an attack. Companies can also scan computers that are brought inside the corporate firewall; this protects against device infections that occur in employees' homes and in public places beyond the network perimeter.

There are secondary lines of defense to consider, too. For one, better spam filtering makes it harder to reach the potential victims, and good antivirus protection from an established vendor that provides regular, reliable updates will effectively block many dangerous attachments.

But we must recognize that since social engineering takes advantage of human vulnerabilities, and not technical weaknesses, that also means that education must be a part of the defense system, just like technical countermeasures are. If users are at least vaguely familiar with the common techniques used by fraudsters, they are likely to be less susceptible to such attacks. And providing users with an understanding of how much personal information is commonly accessible to just about anybody may humble them, making them less likely to believe that every correctly addressed email is legitimate.

The worst thing an enterprise can do is to think: "Why us? We do not stick out, why would anybody target our employees?" Almost nobody thinks they will have a traffic accident, but still, people do. Sometimes, a spoonful of paranoia is a good first step.

About the author:
Dr. Markus Jakobsson is a Principal Scientist at Palo Alto Research Center. He is a founder of the security startup RavenWhite, which addresses security problems associated with authentication, malware and click-fraud. He is also one of the founders of SecurityCartoon, an educational approach targeting typical Internet users.

Previously, he has held positions as Associate Professor at Indiana University, Adjunct Associate Professor at New York University, Principal Research Scientist at RSA Security, and was a member of the Technical Staff at Bell Labs. He is a visiting research fellow of the Anti-Phishing Working Group (APWG), and is a consultant to the financial sector.

Dr. Jakobsson teaches on phishing and counter-measures, click-fraud, the human factor in security, cryptography, network security and protocol design.