Hi everyone.
I'm Chris.
Welcome back to my.
Course on Enterprise Security fundamentals in this lesson.
We are going to discuss the assumed compromise philosophy are first of all let's let's talk about an
overview of the some compromise philosophy.
So in the best of all worlds our organizations information systems are in a let's say pristine state.
When we start implementing security controls in this model intrusions are something that exists as a
future possibility rather than something that may have happened before you started thinking about how
to secure your organization's information systems.
The assumed compromise philosophy takes the position that an organization should build and maintain
its security posture based on the idea that the organization's information systems have already been
compromised another part of the assume compromised philosophy is that the organization should assume
that preventive technologies such as firewalls antivirus and intrusion detection systems ideas will
fail and they will under the assumed compromised philosophy information security teams focus instead
on detecting and responding to suspicious activity rather than simply preventing an intrusion detection
of suspicious activity can be assisted by leveraging cloud based analytic services that are constantly
monitoring information system telemetry for animals.
When you design a security posture with the assumed compromise in mind you restrict basically on attackers
ability to move laterally between information systems and to restrict their ability to escalate privileges
within those systems.
These goals can be done by implementing technologies such as let's say just enough administration and
just in time administration.
Other technologies that worth mentioning would be segmenting the networks or deploying code integrity
policies as well as enforcing good administrative practices as restricted restricting administrative
sessions so that they can only be initiated from us specially configured privileged access workstation.
Next let's talk about some of the most common let's see compromise examples.
Well a few attackers compromised an organization without having an objective beyond proving that the
organization can be compromised attackers target organizations because they wished to accomplish one
or more goals.
When an organization is compromised the attackers often do.
One of the following.
Come on.
Things or let's see what they have in mind.
One of the following is the following common objectives like X military trade data deploy around somewhere
in road systems in a botnet or deploy Queen mining software.
So let's briefly discuss each of these compromise attacks so data exfiltration are the attackers extract
sensitive data from the organization.
Basically this is what it means.
This data may have been stolen for a variety of reasons from the theft of commercially sensitive information
to exposing organizational secrets to damage the organization's reputation some of the most famous attacks
have involved.
Detox filtration such as gaining access to a substantial number of customer credit card numbers ransomware
off in ransomware attacks.
The attackers basically encrypt the organization's data and render the organization's information systems
non-functional.
The attackers do this in the hope that the organization will pay a ransom usually in the form of cryptocurrency
was the targeted organization pays the ransom the attackers will provide the organization with an unlock
key after putting in or inputting this key the data will be decrypted and the information systems previously
rendered non-functional will be returned to full functionality the next one on our list as a botnet.
Well Bartlet's are a collection of computers that can be configured to perform a specific task such
as performing a distributed denial of service attack or botnet s can be monetized in several ways including
extorting money through the performance of distributed denial of service attacks or used to relay Spam.
Spam stands for unsolicited commercial email the next one and the let's say most to the latest one is
coin mining tax.
As of early 2018 coin mining attacks are becoming increasingly prevalent due to their lucrative nature.
Coin mining malware deployed in attacks since is sophisticated enough only to use some not all of the
host system resources meaning that it isn't always obvious when a system is infected.
Coin mining attacks have also been perpetrated let's say by insiders who use the or their organization
as information infrastructure to generate illicit income.
In the next part of our lesson I want to talk about some security myths.
Some information security myths and this let's say most common security myths would be the following.
Basically there are kind of mindsets Okay Sue.
The first myth is that the attackers need to be sophisticated.
The second one is our organization isn't the target.
The next one attackers are outside the firewall all the time and our systems are already secure so let's
quickly talk about this.
The Smiths and each of one of them.
The Smiths are especially prevalent amongst the decision makers that aren't.
Let's see experienced information security professional in many cases decision makers make decisions
based on this myths rather than the reality of the cybersecurity landscape and thus myths which I'm
going to cover are the ones that I have enumerated but they they're not limited to those
so let's talk about a little bit about these myths for each and one of them.
The first one.
Attackers need to be sophisticated.
Well one of the prevalent myth is that attackers need to be highly skilled individuals.
The reality is that unskilled individuals have access to tools where the complex attack chains are coded
into those tools and basically all an unskilled individual has to do is point the tool at a specific
target and click attack or whatever.
The built in the built in functionality the tool has now.
These tools continue to evolve greatly basically enhancing the capacity of an attacker that uses them.
Even if the attacker themselves has only the vaguest grasp on the process the tools employed employ
sorry they are still going to be very efficient now.
While it's true that successfully compromising competently security information systems infrastructure
does require a high level amount of skill and effort the truth is that the vast majority of the world's
information system infrastructure has not been completely secured.
The history of information security is full of instances where a relatively unskilled attacker has managed
to compromise a target because they've had access to excellent automated tools and the target's information
systems weren't completely secured
the next month on our list is the one where the decision maker assumes that our organization isn't the
target now decision makers at some organizations assume that because they've got no obvious let's say
digital assets such as commercial secrets
they assume that their organization isn't the target.
But attackers are going to ignore them and select higher value targets.
Now the rise of ransomware
in let's see coin mining malware ensures that the attacker can extract value from even the most prized
of organizations.
In the case of ransomware it may be a direct payment to to allow for the recovery of files and in the
case of coin mining it in the case of gold mining.
It's can run software on the simplest hardware and given enough time it can lead to a good financial
gain.
Put it in another way everybody's kind of a target.
Now the malware is a lot easier to monetize nowadays and that makes everybody a target.
The next myth on our list is that our attackers are outside the firewall and it's a big information
security myth.
These people these are the people that want to attack the organization and they are all externally
well.
The reality is that a small small percentage of people within the organization are willing to attack
the organization.
There are cases where they are beat for stealing information or confidential data or damaging information
systems especially if it's unlikely that they will be detected.
There are many cases where people who have been fired from an organization but haven't had the their
access terminated have used this access to come back later and attack the organization.
Now as this coin mining malware becomes more prevalent it's also more likely that some insiders will
use their knowledges and their privileges on the organization's information systems to covertly deploy
and run coining malware as a way of you know making some money on the site.
Now the final security myth I want to discuss is the one that says
our systems are already secure now just because systems are kept up to date with patches and a firewall
in place.
This does not necessarily mean that your organization is secure what you've got to understand is that
how to put it
security and I want to emphasize this and I will emphasize this throughout the course.
Security is an ongoing process and your organization security posture needs to be continuously reassessed
just because the most recent Red Team penetration test against your organization's system was unsuccessful.
That doesn't mean that your organization has security posture that is impenetrable.
Now complacency is a big danger in the information security industry.
And the moment an organization assumes that it's attained an impenetrable security posture that is the
moment the attackers will successfully breach the network barriers
I will see you in the next lesson where we are going to be discussing about the concept of cost of breach
which is more like an business point of view to a security breach.
I hope this has been informative for you.
And thank you for watching.