Hi everyone.
I'm Chris.
And welcome back to my.
Course on Enterprise Security fundamentals in this lesson we are going to talk about the current security
landscape and understanding the cybersecurity landscape.
So let's dig into it and let's discuss a brief overview of the current security landscape the current
cyber security landscape is complex.
Attackers developed new and ingenious methods of compromising system on a daily basis.
Intrusion tools originally developed by the intelligence agencies of nation states have been leaked.
Reverse engineered and then made available to everyone clever enough to know where to look for them
new credential breaches are published on breach notification services such as a ahead.
Have I been pond dot com every few days.
Exploit frameworks are updated to leverage newly discovered vulnerability var vulnerabilities.
Every day every month a new set of vulnerabilities is patched by vendors and security researchers continue
to find vulnerabilities in Applications Products and operating systems on a daily basis.
Often vendors are able to release updates before knowledge of those vulnerabilities makes it to the
public.
Well the vendors are usually diligent in releasing updates to address vulnerabilities or information
security personnel don't always like get around to installing those updates in a timely manner.
In the current security landscape the attackers are finding it simpler to monetize their activities
either by developing ransomware that encrypts the target's data and systems and after that demanding
payment for a solution or by deploying coin mining software that generates crypto currency using the
resources of the target organizations infrastructure making a profit by compromising the target's infrastructure
is becoming way way easier nowadays.
This is likely to lead to more rather than less aggressive cybersecurity landscape.
Well let's talk about when you talk about the cybersecurity landscape.
Basically it's vast and likely impossible for any one individual to comprehend its entirety.
But however there are several aspects of this landscape which those who are interested in the fundamentals
of enterprise security should pay much attention to this aspect.
We are going to enumerate them and then we are going to discuss each one of them in greater detail so
the aspects of the current cybersecurity landscape which we're interested in are the following.
But of course not limited to the technology lack the application development security the skill gap
the asymmetry of attack and defense increasing availability and sophistication of attack tools monetization
of malware automation of detection Internet of Things the transition to the cloud.
And last but not least increasing regulation now let's uh in to each one of these aspects so we can
have greater understanding of each and one of them.
The first one the technology lag when considering the cybersecurity landscape it's important to note
that the versions of the products that organizations have deployed exist on a spectrum with a small
number of organizations running the latest versions.
Most organizations are running older but still supported versions and quite a substantial number of
organizations are running information systems that are no longer supported by the vendor.
While the latest operating systems and applications still have vulnerabilities.
Organizations can substantially improve their security posture by ensuring that they are running the
most recent versions of the operating systems and of course the applications within that operating system
and by keeping those products current with the latest releases of updates.
It's also important to note that many vendors are less diligent about addressing security vulnerabilities
that are discovered in older versions of their products.
A vulnerability that may be addressed in the current edition of a product may not be addressed for previous
versions of the same product.
So it's usually the organizations running outdated or unsupported products that you most hear about
when a large cybersecurity incident occurs.
For example in the 2017 one to cry ransomware attack
that attack disproportionately impacted organizations that have that had sorry servers running the Windows
Server 2003 operating system for example where the ports that are used for us and b storage protocol
were exposed to the public Internet.
The one crying incident is let's see a reflective or substantive part of the cybersecurity landscape
in that it demonstrated that not only a large number of organizations are running outdated or unsupported
information systems but that the security configuration of the networks that host those systems fell
far below the best practices of the industry going on to the next aspect of the cybersecurity landscape.
We are going to talk about application development security.
There are many many other many let's see components when talking about application development security.
But I am going to try to summarize it very briefly so the adoption of a secure application development
practices is one of the most important parts of the cybersecurity landscape.
Many application developers create applications that are subject to attacks including well-known attacks
like cross site scripting shortly X SS and SQL injection.
Even though these attack vectors have been known and understood in great detail for many years as applications
move from being locally installed on computers and devices to running as web applications in the cloud
it is very very important for organizations to ensure that a secure application development practice
is followed thoroughly.
The next one and in my opinion this is one of the most important aspects of our current cybersecurity
landscape is the skill gap and the skill gap.
Basically
means that there is not enough trained personnel to meet the industry's needs.
So basically this is regularly reported that the field of information security doesn't have enough properly
trained and knowledgeable personnel to meet the industry needs the cybersecurity industry the recent
global information and security workforce study which was done by the Center for Cyber safety and education
projected a global shortfall of one point eight million information security workers by the end of the
year.
Twenty twenty two organizations cannot begin to protect themselves from various security threats that
exist if they are unstable to hire the personnel to manage a secure their information systems.
As you will be remembered throughout this course and as I will emphasize throughout this course information
security is an ongoing process.
It's not enough to have a consultant come in deploying configure software and hardware and then your
organization's information systems are secure going forward.
That's not how it works.
Instead the process of securing information systems is ongoing.
It's an ongoing process.
For most the foremost organizations this means having I.T. staff that are trained in information security
processes until this skill gap is closed the cyber security landscape will be littered with organizations
who are unable to substantively improve their security posture because they simply don't have access
to the personnel that would enable them to do so.
And the existing personnel they have are overworked due to the shortage of filled headcount.
And that's most commonly encountered in many many organizations.
Nowadays
going to the next one.
And again very important aspect of the landscape is the asymmetry of attack and defense.
Basically what this would translate to is the availability and sophistication of the attack tools so
an adage within the cybersecurity insta the stream is that tools that are only available to the elite
hacking teams of let's see nation state intelligence agencies
today will be available to teenage script kiddies.
And well I think it's too much said today but definitely within five years of a hacking tool that's
available to to a very sophisticated nation state agency let's say within five years that tool will
definitely be available to script kiddies are a script kiddie is basically to receive a term to describe
an individual who uses sophisticated scripts and application developed by experts to attack systems
well having no real understanding of the underlying functionality of the tool put it in another way.
Script gives a kiddie story is a point and click.
Hacker is a click and click simply just that attack tools are increasing of our increasingly sophisticated
this automated exploit tools are relatively straightforward to procure and take little in the way of
expertise.
Let's say to use whereas in the past.
Access to basic tools required for gaining access to select communities on hidden bulletin boards or
Internet Relay channels or C channels.
Today it doesn't take an enthusiastic immature.
More than let's save a few minutes with the result of the right search engine queries to get started
and get a hold of this kind of tools should they need to learn more about let's see.
The tools they have acquired there are hundreds of hours of video tutorials available on the web to
assist them in in this while a sophisticated attack tools are available often for free.
There is a paucity of similar tools available for defenders as well.
While the process of launching a basic or even moderately complex attack against an organization's information
system may be as simple as a mouse click the defenders process on on the opposite part of securing the
configuration of those information systems is manual complex lengthy ongoing and it requires a good
deal of expertise to be done properly.
All well again talking about the asymmetry of attack and defense within the cybersecurity landscape
there is a real asymmetry between the attacker and the defender.
Asymmetric in that the resources required for an organization to be reasonably assured that they are
protected from let's say the vast majority of intrusions vastly encountered vastly vastly exceeds the
resources required for a competent attacker to perform a successful intrusion.
Well one key of understanding one key understanding of the cybersecurity landscape is that the vast
majority of attackers are unsophisticated and are using automated vulnerability scanners and exploit
tools.
Put it another way.
Most attackers by volume are likely to be script kiddies rather than professional hackers assess the
vulnerabilities
those automated tools attempt to exploit are often already addressed by vendor updates.
Sue if an organization is diligent and let's say applies a consistent effort to its security posture
it will be able to protect its information systems against the common attacker.
If you view it in another way.
Let's see.
So if you take an ongoing and systematic approach to securing your organization's information systems
it's reasonably unlikely that script kiddies will be able to compromise that system your system or a
diligent well resourced defender is likely to be protected against all but the most highly resourced
and persistent attacker while there isn't a symmetry in terms of the effort required to properly securing
information systems.
It is possible to reach a stage where your organization systems security posture is such that those
systems are impervious to all but the most skilled and well resourced attackers with the time and effort
you can protect yourself against matures who randomly attack organizations to see if they just just
to see if they can get access into its network.
But with greater time effort resources and skill you'll be able to protect your organization's information
systems against let's say the more competent attackers that deliberately target your organization.
The unfortunate reality is that even when organizations have highly skilled personnel those personnel
are rarely rarely given the necessary amount of time and resources to ensure that the organization's
information systems are configured in the most secure manner possible.
The existing problem of asymmetry between the attacker and defender is made worse by organizations not
giving their defenders the resources they need to actually do their job
going on to the next one on our list is monetization of malware.
When talking about the monetization of model where we need to understand that a big change in the recent
cybersecurity landscape is the coin mining software the coin mining software it is software that mines
for cryptocurrency such as Monaro Bitcoin or ethereal rim so this is a big change and I'm saying this
because in the past it was difficult for an attacker to actually monetize an intrusion.
Well coin mining software makes monetizing intrusion intrusions.
Pretty straightforward an attacker who successfully deploys coin mining software on a target's organization
information system just has to sit back and wait for the crypto currency to start rolling.
In the past amateurs may have been motivated to learn how a tech how to attack information systems by
a variety of factors including curiosity out of just plain curiosity.
With the current let's say a mania mania against around crypto currencies D.
And of course the problem is that it may be possible to earn such currency by running freely available
exploit tools.
It's not unreasonable unreasonable to assume that amateurs will be even more motivated to attack information
systems in the hope of generating quick income.
Going next.
It's the automation of detection.
One expert the cybersecurity landscape that has become brighter for defenders is that it has become
easier to detect attacks that would have otherwise only been apparent through let's say expert analysis
of information systems event logs or event logged telemetry.
While some attackers are over down to do little to hide their presence on the network.
Competent attackers often spent quite some time performing reconnaissance.
Once they have established a beachhead on the organization's network so these attackers leave only is
very very subtle traces of their presence that you might not be alerted to unless you have some kind
of sophisticated intrusion detection systems that can recognize the signs of an intruder activities.
If an organization can detect attackers Well the attackers are still performing reconnaissance.
They can highly reduce the amount of damage done in the past.
Security Information and Event Management shortly seem tools would analyze information and detect suspicious
suspicious activity based on heuristics developed by the vendor while these systems are effective in
discovering suspicious activity.
They only are able to detect suspicious activity if the vendor recognizes that the characteristic of
that suspicious activity to recognize new types of suspicious activity.
The same seemed to must be updated with new signatures that allow it to recognize the characteristics
of that new activity.
On the other hand cloud based services and I'm talking about the latest security tools available in
the cloud such as the Asian security center or Asia advanced threat protection and Windows Defender
advanced threat protection.
These tools provide organizations with more effective threat that text detection functionality rather
than traditional methods such as manual telemetry analysis.
This cloud based services have access to the Microsoft Security graph
to get an idea of the Microsoft Security Microsoft's security graph centralize the security information
and telemetry that Microsoft collects across all its sources.
This includes telemetry related to attacker activity across all Microsoft's customers as well as information
from Microsoft's own ongoing security research efforts.
So through machine learning analysis of this vast trove of data Microsoft can recognize the subtle characteristics
of attacker activities once the characteristics of a specific attack are recognized through analysis.
This immense data set.
Similar activity will be detected should it occur on other customers networks the cybersecurity landscape
has also changed now that defenders increasingly have access to tools like the ones I have enumerated
earlier.
Like Asia's security center that can highlight in some cases remediate security configuration problems
on the monitored information systems.
In the past information security professionals would have to walk through configuration checklists when
hardening servers clients and other equipment.
Today service services such as Asia's security sensor can provide actually can provide you with recommendations
as to what configuration changes should be made to on premises and cloud hosted workloads to make them
more secure.
Your security configuration recommendations provided by these services can also be updated as new threats
emerge.
This helps and ensures that an organization's security posture remains up to date.
Defenders also have access to breach and attack simulation tools.
So what I'm talking about here is rather than relying on experienced penetration testers to perform
Red Team exercises to locate known vulnerabilities in an organization's information systems configuration
breach and attack simulation tools simulate an attack and locate known vulnerabilities.
While such tools won't find every possible vulnerability they are likely to detect the vulnerabilities
most often exploited by attackers.
In that if defenders remediate all vulnerabilities found by such tools their engagement with the penetration
testers performing Red Team exercises is likely to be more valuable.
Using such tools before engaging a Red Team will certainly reduce the likelihood of expensive examinations
of expensive penetration testers discovering a list of let's see obvious configuration vulnerabilities
that should have been found by even the most cursory of examinations.
When an organization engages penetration testers the hope is that they'll discover something that the
organization's information security staff couldn't have seen.
Not something that they knew about but didn't get around to addressing.
Let's see if that makes sense.
Going on to the next one next one is the Internet of Things.
And this is another big change in my opinion in the cyber security landscape that has occurred over
the past decade and this is the rise of the Internet of Things or shortly.
The IO T O T is the network of physical objects devices televisions refrigerators home climate systems
cars and other items that are increasingly embedded with electronics software sensors and network connectivity
that enables these subjects to collect and exchange data between them while consumer operating systems
such as let's say Windows 10 Mac OS.
IOW Android have increased security features with every release and update the operating systems of
the IO T devices rarely receive long term security updates support from their vendors.
The IO team presents an ongoing challenge on the cybersecurity landscape in that these devices are likely
to remain in secure just that this is because even when vendors do provide updates unless those updates
army installed automatically.
Very few owners of those devices will bother to apply those subnets.
Well people will apply software updates to their computers and phones when reminded most are less diligent
when it comes to less applying software updates to their refrigerator washing machine or television.
How does this impact the cybersecurity landscape.
Well just think of this.
Bought nuts compromised of IoT devices have already been used to perform distributed denial of service
attacks while the processing capability of the IO T devices is much less significant than that of a
desktop computer or server.
It's likely only a matter of time I would see before an enterprising attacker works out how to get rich
using a bot not the refrigerators let's say to my cryptocurrency.
That's a hypothesis of course but not that far from the truth.
Going on to the next one is of course the transition to the cloud.
The cybersecurity landscape has been substantially altered by organizations moving on premises workloads
to the cloud important to note here as though is that moving infrastructure applications and data to
the cloud doesn't mean that the responsibility for information security shifts from the organizational
personnel to the cloud provider.
As has been amply demonstrated by developers leaving cloud storage containers globally accessible the
security of a deployment in the cloud is only as good as it is configured by the cloud talent to be
just with on premise information.
Just as with on premise Information System Security the settings to secure the workloads are present
but they must actually be configured.
Why.
The information technology professionals responsible for those workloads for.
Just to give you a quick example.
A cloud storage container used by a major U.S. newspaper to host a Web site.
The code allowed read access to anyone in the world.
Attackers use used this access to inject coin mining code into the web pages delivered by the newspapers
to its readers so you can imagine each time a reader visited the new newspaper's Web site.
Some cycle some cycles of their computers.
You worked on generating cryptocurrency for the attackers who had modified the contents of the cloud
storage container and that's just one example out of many many which have occurred in the Boston the
next one is increasing regulation.
One final aspect of the cybersecurity landscape that is worthy of attention isn't strictly technology
related but instead relates to regulation and legislation.
For many years the information technology industry was left to its own devices when it came to how much
energy they put into protecting information systems infrastructure.
Unfortunately the industry hasn't been successful enough in containing such breaches the public and
eventually politicians have noticed that breaches continue to occur even as all of us move more for
all of our lives and sensitive information online.
So this has led to an increasing number of jurisdictions to introduce legislation and regulation mandating
the security controls that should be present over certain types of data hosted in organizational Information
Systems the cybersecurity landscape has changed in that I.T. security staff need to d not only to be
conversant with the security controls available for the technologies they are responsible for managing
but also with the rules and regulations that apply to the organizations information systems and responsibilities
that must be upheld in the event that an intruder let's say successfully breaches the organization's
systems.
That was a brief let's say a brief overview of the aspects of the current cybersecurity landscape.
I will see you in the next lesson where we'll discuss about the assumed compromise approach.
I hope this has been informative for you.
And thank you for watching.