ATMs are literally boxes of cash—too good for criminals of any stripe to pass up. When ATMs first emerged, thieves used brute-force tools like crowbars, explosives, and propane torches to remove the ATM machine itself or get at the cash inside. As recently as April, three men were charged in Salt Lake City, UT, for trying to blow up ATMs and steal the cash.
With cyber risk an executive- and board-level concern, it's not enough to try to prevent attackers from gaining entry to your network. Advanced, persistent attackers can still get through even the most advanced defenses. Once they're in, they have the arduous task of moving from their initial point of entry to their ultimate target. This is the time when attackers are most vulnerable—and where we, as defenders, have an opportunity to tip the balance in our favor.
On March 15, 2018, US CERT (U.S. Computer Emergency Readiness Team) issued a Technical Alert about “Russian government cyber actors” conducting a concerted cyberattack campaign against energy companies. Specifically, they gained access through small organizations connected to the target companies and then “conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems (ICS).”
As we survey the threat landscape, two things are certain—targeted attacks and advanced persistent threats (APTs) are here to stay, and organizations face increased risk from advanced attacks compared to the past two years. Several existing trends will continue, and we’re seeing attackers refine their tools in ways that will drive new trends in the coming months.
Digitization and digital transformation in healthcare are delivering amazing advances in everything from diagnostic imaging and patient monitoring to medication safety, insurance claims processing, medical devices, and genetic research. As healthcare organizations reap significant benefits from innovation, they also must protect themselves and their patients from cyber attackers who develop increasingly sophisticated attack tools and methodologies.
What do enterprise security teams have in common with Hannibal at the Battle of Cannae in 216 B.C.? A lot. Both face an onslaught of adversaries. Both have valuable reputations and territory (or markets) at stake. And both need a way to outdistance enemies by enlisting new tactics. With today’s cyberattacks, yesterday’s approaches are not enough. As it did for Hannibal, deception offers a way to turn attackers’ own methods against them. The history of deception shows that weapons and tactics might change, but the ability to make an adversary act on something that isn’t real offers modern enterprise defenders a new arsenal of tools.