It is increasingly evident that even the most secure environments are compromised. While the successful penetrations might not be targeted in all cases there are enough incidents now public to indicate the extent of the present danger. Every organization should revisit their security plans based on a new assumption: that their enterprise is already compromised and that their data is being exfiltrated.
Consider just these few incidents taken from a Heritage Foundation report published in 2008.
I am not stressing the China factor here only the loss of data and the methods used.
Titan Rain. In 2004 Shawn Carpenter discovered significant amounts of data from government research labs, NASA, and defense organizations residing on servers outside the United States.
United Kingdom. Throughout December 2005, British Parliament offices were surreptitiously penetrated, also from computers using the Guangdong network. Britain's National infrastructure Security Coordination Center investigators told reporters, "These were not normal hackers.... The degree of sophistication was extremely high. They were very clever programmers." Some of the attacks targeted files in British government offices that deal with human rights issues.
The Trojan e-mail attacks targeted specific victims. "One email was targeted at one company in aviation. It was a Word document that had a Math/ cad component. If you did not have math/cad on your computer it would not open," said one expert. "The point was to find documents that had been written in that particular program and then send them back.(McAfee whitepaper )
Taiwan. According to an official of Taiwan's Ministry of National Defense, in 2006, Taiwan detected 13 PLA zero-day attacks launched within Microsoft applications and experienced a total of 178 days of vulnerability between notifying Microsoft of the attacks and receiving the appropriate patches. One PowerPoint-based attack was so sophisticated that it took Microsoft engineers over two months to construct a patch.
Spring 2007, a program was discovered at a foreign coast guard agency that systematically searched for documents that had shipping schedules, then forwarded them to an e-mail address in China, according to David Rand, chief technology officer of Trend Micro
And more recently we have seen the extent of the network of infiltrated machines specifically targeting organizations that impact Tibet-China relations as documented by research teams at the University of Toronto and SecDev in their GhostNet report. Techniques that look remarkably like those used to traget Rio-Tinto, the Autralian mining giant.
The methodologies employed in these wide spread attacks is typically the combination of new vulnerabilities and custom Trojan horses delivered over the web or through email. This January’s revelation that Google and dozens of other companies had succumbed to such attacks was a wakeup call for industry, the US State Department, and now Congress, which is responding with legislation to address the issue.
What should you be doing to address the presence of compromised internal resources? While Data Leak Prevention attempts to provide an overlay of classification, network monitoring, and end point management (for USB devices), there is another approach that uses advanced agents on the desktop that continuously check for abnormal behavior that is indicative of root kits and custom Trojans. I just posted a white paper on such a technology that is coupled with forensics tools from Guidance Software. By identifying, disabling, and repairing infected machines you will engage in a constant battle against the enemy within. But at least you will have a weapon for that battle instead of flying blind and trusting to ineffective AV, IDS, and firewalls.
Go here to read the rest:
Act now to address your compromised networks