Third Party Connections' Security

Do you want your partners trust you directly? Well, do you trust your third party partners directly? When adversaries  are in, they always check different ways to reach more places. So, if one of your trusted third party connection got hacked, it means that there is just a short time they find your connection, and get inside if you did not make your connection secure.

 

Since 2018, we saw that attacks against third party connections increased. Most of them happened because of the small organizations that are giving support in any subject to larger organizations. Because of these small organizations’ low security budget, it is very difficult to secure the network and PCs for them. Most of these organizations do not have a domain structure, security devices for networks and even endpoint protection tools. What I saw while I am working with them that these type of organizations’ users are local admin in their laptops, and only using an antivirus agent to secure the rarely patched laptop. These laptops are being used to connect to other organizations, and sometimes to keep some sensitive data about of these organizations. They are very close to get hacked, but you must not get this risk while working with them.

Third Party Connection Management in Organizations

 

Especially in large organizations, since policies not working properly; and maybe since there is no any policy for third party connections, circulation of staff and sudden and fast developing projets, teams can create third party connections how it is easy at that time for them. This creates an unmanaged third party connections structure and so, it becomes worse day by day.

 

I remember we spent at least four months to fix the third party connections in a large organization. Dozens of leased lines reaching directly to different networks inside, hundereds of S2S VPNs established years ego, has certificates with low key sizes, and etc. Lack of a basic policy like third party connections policy causes a huge waste of time and effort to fix it.

 

What to Do?

 

Whoever you are connecting, or connecting to you, you should minimize threats. Because, all organizations are the target for hackers and they all can be hacked. You should not trust anybody else about security. You should understand what security controls they apply in the organization. If they have some weaknesses to determine the attacks made to themselves, it will put you at risk.

 

Create a 3rd party DMZ network. This is important because these 3rd party PCs should not connect to your network directly from any zone in your firewall. These PCs are something you cannot trust directly. So, at least, a 3rd party DMZ should be created to connect and control these type of connections. If there is no any 3rd party zone and policy, in a long period of time, with some of the activities explained at the beginning, you can see many different 3rd party organizations are connecting to your network from many different zones. And it will be something unmanagable day by day. For the beginning, I suggest to create a different zone for leased line connections to the internet facing firewall, and control these connections policies there. Also, a different firewall should be implemented for S2S VPN connections. It is important to receive these connections in a different firewall and control their connections.

 

You should use a vendor management program. It helps you to reduce the risk, by collecting more and more information about your third party connection and should be sure they comply with standards and regulations.

 

You should know what security controls, endpoint security (antivirus, EDR, encryption, etc.) and data leakage prevention methods do your third party connection imply to its users. Mostly, if you do not give a laptop to users that will connect to your network, third party organiztions’ staff uses their own or that company’s PCs. That means, these computer will be connected to your network most of the time, and these PCs will contain your some sensitive information. So, it is important to know whether they are protecting these PCs while working with you.

 

Screen recording is also a very useful tool. It is impossible to watch directly every consultant’s actions on your network. Most of the time they work on your test servers on test zones, and unfortunately, sometimes they can work directly on production zone or can reach to production zone because of the lack of controls. A screen recording tool will be an important deterrent action for you.

 

MFA is must. Multi-factor authentication should be used to connect your network. Mostly I suggest time based MFA tools to use. Any time a security incident occurs in 3rd party’s network, MFA will be important to secure you.

 

 

 

"MUST" Practices for AntiVirus

Last week, I hearth that an organization did not add antivirus agent to their PC image. They are formatting the PC with their image, then connecting to the network and waiting for the sccm installing the antivirus software to the PC. Also, for remote users working on the field, some contracted partners are formatting the PCs since these users cannot come to the company, they then join to the network via VPN after formatting and keeps working. Meanwhile, the IT team is waiting for the sccm install the antivirus software, but because of the VPN network, most of the time it fails. PC keeps working on the network for days. 

While I was sharing this situation with some friends in the industry, some of them also said that it is a normal process for the organizations. So, I wanted to write this article. 

A few months ago, I shared a post about falling of the AV. It is true that AV softwares are not very efficient in recent years. There are many other measures need to be taken to protect the endpoints. However, most of these measures are for APT attacks. As everyone says, and also I touch in the article, attackers' profile and techniques has changed a lot, since the times AV was popular and successful. But, despite all these situations, nobody can say that AVs are not necessary anymore. Organizations does not face attackers that using highly advanced techniques and tools only. There are still many script kiddies and those trying to learn hacking. These people are always looking for easy vulnerabilities to hack. It is very great possibility they find you. 

Another subject about AV, because of the hash databases downloaded, they can protect users for many of the malicious events, also while they are offline, or while they are not connected to the office. 

Even, most of the AV softwares are improving themselves with behavioral and AI capabilities. So, these can also detect and stop some of the APT attack phases. 

I am also curious your comments, but my opinion is an AV is still indispensable for all organizations. So, I want to some best (must) practices for using AV in an organization;

        - An AV software should be installed on all devices. Clients should be periodically followed whether has AV on it or not. If it is possible, a NAC solution should be positioned and PCs that does not have AV should be blocked.

        - AV solution should be centrally managed. So, updates can be managed centrally and out of date clients can be followed. 

        - Administrators should make sure all clients are sending logs properly. It is very important to response a suspicious situation quickly. 

        - AV software should be updated periodically. Meanwhile, administrators also should be sure that all clients are getting the latest updates properly.

        - AV software should be included into the PC and servers' regular images. When a PC formatted and re-installed, it should include AV before connecting the network. 

        - Users should not be able to disable the AV services and agent. Tamper protection and an uninstall password should be used and should be stored in a password management system. 

        - Malicious files should be blocked and quarantined to be analyzed by the administrators. 

        - Audit logs should be collected properly. Administrators should login to the software only by their own usernames. Generic usernames should not be used. 

        - Too many exceptions should not be given. If needed, exceptions should be given only as stated by the vendors. 

        - If including, host-based IDS should be enabled on the AV agent. 

Email Security - A Buyer's Guide

All IT professionals know that most of the cyber attacks begin with an email. Actually, according to statistics of Phishme Defense Guide 2017, 91% of cyber attacks began with an email. It is not surprise, since all we know that the human is the weakest part of cyber defense. If the users have not enough awareness – this might be the IT professionals’ fault of course – and especially, with today’s carefully designed phishing emails, users can easily download the malicious content or steal their identity. These phishing attacks and users make it easier to breach an organization for cyber criminals, instead of scanning the vulnerabilities on websites, and applying complex techniques to obtain the same gain.

As we told at the beginning, most of the successful attacks begin with phishing emails. Attackers may send a malicious content directly via email, or a link to a phishing site to download the malicious content or to a CnC server. Sometimes, to bypass the security devices, attackers may leave the back of the link empty at the beginning, then add the malicious content, so the users can download it once the link bypassed the security controls.

Traditional signature-based or reputation-based email security controls cannot stop these types of attacks. Signature-based controls cannot stop 0-day threats, and criminals uses unique malwares, URL sor phishing sites to bypass these signature-based security control mechanisms.

Most of the antispam solutions work like that, with including an antivirus to their solution. As explained, even if it is not enough, spam is also a very big problem against organizations, since more than 90% of emails reaching to an organization are spam emails. So, while choosing an email protection solution, antispam feature is one of the most important capabilities you have to check. If you do not stop known spam mails, it will be very difficult to combat against more sophisticated email attacks while trying to manage too many spam messages.

Feature 1: Antispam

As explained top, more than 90% of emails are spam in an organization. Most of these spam mails do not contain malicious content and just contain information about a sales campaign. Reputation database mostly used in cloud with intelligence of the vendor and other customers’ feedback. So, both intelligence capability and size of the customer becomes important for the vendor. It is important to note that some vendors use different black lists for more protection.

Also, antispam engine must be tested carefully, especially if the most used language in the organization’s is not English. Tool’s antispam engine capability may differ for different languages.  

Although spam mails are not very dangerous, they are annoying, due to the volume and content of some of them.A good antispam engine and reputation capability stopping these spam mails also provides a better analysis chance on remeining emails by reducing the number of the emails with stopping at the edge.

Feature 2: Antivirus

Like antispam feature, a signature-based antivirus feature can stop most of the known malicious contents sent to organization. Different email security vendors use different antivirus solutions in their solution, so even if you do not trust directly to the antivirus feature, it is important to use a well known vendor’s solution here.

Feature 3: Sandbox

With today’s developing attack types and more aggressive and focused attackers, sandboxes became mandatory for organizations. I do not want to explain the features of the sandboxes here but today, a sandbox that analyzing emails became very important. In traditional antispam solutions, antivirus engine can only stop known malwares. Organizations need a sandbox for analyzing both unknown files and URLs. For suspicious URLs, masking feature also can be used. So, users’ direct Access to the suspicious URL could be blocked.

Sandboxes for email protection can be completely from a different vendor from antispam solution, can be positioned after these antispam products to analyze remeining email after antispam or a cloud solution if the organization does not have a regulations against using cloud solutions.

Feature 4: Quick Response

Organizations receive thousands of alerts everyday. Most of the organizations do not have enough analysts to determine all these alerts whether they are true attacks or false positive. Even worse, most email security solutions do not give enough information to determine the alert. For responding quickly, a solution giving more detailed analysis about the content should be choosen.

Feature 5: End User Quarantine

One of the worst parts of email security gateway solutions is the false positive rates. Since attackers create more realistic emails to cheat the users, stricker rules may be required. The stricker rules mean more false positives. Emails required fort he work of the user lso begin to be blocked. Of course, this situation leaves IT professionals in trouble. This situation leads they leave all their important tasks and have to spend time clearing emails from quarantine. So, the end user quarantine feature that allows the user to manage their own quarantine and release the emails they think is clean is as important as the false positive rate.

One bad thing about end user quarantine, users can really release suspicious emails to themselves. So, this feature should be used very carefully. Workload or security? One more thing to think on for deciders.  

Feature 6: Scalability

With developing business models and growing organizations, scalability is always an important point. Not only email protection but also all security products should be scalable. These should be especially discussed during PoCs. Again, for the organizations do not have a regulation agains cloud usage, scalability becomes easier for native cloud solutions.

Questions To Ask

While choosing an email security gateway product, it is better to ask these questions to the vendors;

1-    Does the solution use multiple Technologies also including AI?

2-    Does the solution provides intelligible reports against suspicious or malicious activities for responding quickly?

3-    Which technologies does the solution have for identifying 0-day attacks?

4-    What is the false positive rate of the solution?

5-    Is the solution fed from any intelligence source?

6-    What is the quality of these intelligence sources?

7-    Can it be quickly updated against new threats?

8-    What is the success rate in preventing suspicious URLs?

9-    Can the solution share threat information with other security tools positioned at the organization?

10- What is the scalability capacity of the solution?

Corona Virus Phishing Threat

The top trend all over the world is Corona Virus now of course. Countries are trying to solve this big problem but incidents numbers are still increasing. By this situation, everyone's first topic became Corona Virus. People spend their time at home, working as home office and of course watching and reading the latest situations about this infection. So, this trend topic became the top trend for the attackers too. While people are always searching for the latest news on internet, attackers already started to turn it into threat.

Too many articles have been published about this threat in the last few months. Today's top threat is phishing about Corona Virus. According to @SophosLabs;

"Of the more than 37,000 domains that have been registered since February, at least 1765 of them also use the word "test" in the domain name. While many of these registrations may just come from domain speculators, some may be scams and a few legitimate."

And @SophosLabs also mentioned that someone registered a domain for every US state, followed by "covidtest" and parked them. This shows us that we will see new phishing campaigns including covid test, against people who are worrying about their health and want to make test.