26 May
SWAT Assessment for Cybersecurity

SWAT Assessment for Cybersecurity

by Albert E. Whale, CEH CHS CISA CISSP
Founder & CEO

Attacks are running full speed ahead

Static Testing reviews above the waterline
Figure 1 – Static Testing reviews above the waterline.

Everyday new attacks are reported in organizations of various sizes.  Some of the attacks are recent, most are attacks that occurred months earlier, and are just recently being discovered.  What makes these events so difficult to discover?  There are several reasons that these attacks are undiscovered.  Most of these are focused on existing People, Process and Technology (PPT).  Even though the intent is to secure the organization, there are several faults in utilizing the existing strategy.

What we have discovered, is that PPT Service offerings are exclusively focused on known attacks and threats.  This excludes the unknown activities, and the existing exploits that have been successful already.  There are other reasons why many tools do not identify, because they are focused on the Static Network[1]. This is great but misses opportunities which are present when the employees are using the network.

The static review essentially reviews the exposed tip of the iceberg.  This is only 10% of the iceberg, the other 90% of the environment is not reviewed.  This includes the use of Third Party Vendors and their Applications (think SolarWinds breach), active users (current attacks of the environment from the Internet), as well as attacks from personal devices[2]

Can you see now why Firewalls and Virus Scanners are not effective?

While the use of SIEMs improve coverage, they require the configuration of events.  SIEMs only discover the activities after the event has already occurred. Both the lack of configured events, and backlog of manual review lead to more activities going undiscovered.

With 90% of the environment not being reviewed, it’s clear why attacks are not detected for months later (if at all).

SWAT – Secret Weaknesses in Applications & Technology

Figure 2 – SWAT Analysis

The SWAT Analysis is our Proprietary assessment for businesses, which identifies the cyber secret faults which are left undetected by today’s security tools.  Think about it, all of the testing tools are focused upon the CWE and CWE rankings for information. Their detection is solely based on understanding what has already been detected.  That leaves a huge gap in understanding what is occurring within the environment. Our SWAT Analysis is based on several attack strategies, as well as the NIST Zero Trust Architecture. We take into account all of your current activities, including the Third Party Vendors, the activities of the Users, and the personal devices in your environment.  This is totally different than existing testing activities, and better yet, it fully automated to support your organization’s needs.

I want to get started with the SWAT Analysis – Please contact me

Taking it to the next level

Everyone thinks that they are secure until they are proven! There are so many hacks in the news lately, the Colonial Pipeline (Ransomware – $5M), US Insurer – CAN Financial (lost – $40 Million), Ubiquiti, Parler, Experian[1], Microsoft Build Engine[2] and Many more.


[1] I was recently interviewed by CSOnline.com – https://www.linkedin.com/posts/albertwhale_how-api-attacks-work-and-how-to-identify-activity-6801611480853807104-2JKr

[2] Hackers use Microsoft Build Engine to Deliver Malware Filelessly – https://thehackernews.com/2021/05/hackers-using-microsoft-build-engine-to.html

We are confident our SWAT Assessment will find activities.  Here is an assessment we performed on a WiFi Network.  

Figure 3 – Countries found inside the WiFi network

The point of the video is that the network was considered secure, before the SWAT Analysis.  The video shows that traffic of Laptops, Personal devices and other equipment on the WiFi have compromised activities during the review period.  With the amount of activity taking place, it appears that a significant amount of malicious activity exists in and out of the network. 

Everyone understands that there is no need for 46 countries to be active inside their network.  If you don’t know who is already inside, how can you develop a protection plan to support your business?

Tell me about ITS SafeTMset up a 10 minute call.

Seeing the activity inside

The SWAT Analysis examines the network traffic, the configuration of the devices, and assesses the security of the environment.  The SWAT analysis tests the use of the network with activity.  This analyzes the active devices, and their security as well.  In the case of WiFi we easily identified the infected devices that were connected to the environment and permitted to communicate with the organization.

The traffic we discovered did not trigger any sensors or activities with the security tools already in place.  This is further outlined in recent blog posts

Why do you need a SWAT Analysis?

Everyday new exploits are detected in the equipment we use which were not previously identified.  Additionally, more manufacturers are connecting back to their organizations from the equipment you are installing inside your networks.  Imagine the equipment inside your network offering a backdoor into your environment.  That includes connections inside and outside of the continental USA.  Every time we discover connections to outside locations, we are informed that they were not authorized, and also not identified.  Imagine the equipment that you have providing a back-door connection to China.  Is that what you wanted?

I developed the SWAT Analysis to uncover the activities which go undetected inside networks every day.  Some of these include:

  • Misconfigured security controls
  • Obsolete communication protocols
  • Deprecated encryption technology
  • Malware activity undetected in the network
  • Identify the origin of the breach
  • Abuse of existing Protocols
  • Use of protocols for other activities
  • Connecting to malicious DNS
  • Requesting your IP Address for access
  • Connecting to Malicious websites
  • Unauthorized backdoor connections to external sites

Just to name a few.  We look at how the Network reacts with activity from within.  This is totally a different perspective.

Next Steps

We have seen all Organizations at risk.  Mature organizations as well as new organizations have opportunities for malicious activities which are not normally discovered, until it is too late. Failure to detect the unwanted activities costs organizations Millions[5] at that time.

What can organizations do?

  • Backups will recover data to a certain extent,
    • but they will also include the problems which the tools you are using cannot see
  • Testing with the same tools will lead to the same results
  • Insurance does not fix the problem; in fact, it gives the organization a false sense of security
    • Insurance does not fix the security problem
    • Insurance does not pay to fix the security issues which caused the attack
  • Wait for the Breach to occur, and then pay the ransom
    • Fixing the problem may take from 6 to 18 months

SecOps

SecOps stands for Security Operations.  Security Operations sole purpose is to increase the operational security within an organization.  It does this by assuring that operational changes are implemented as soon as there is a change in the environment.  This completely trumps the Annual Scanning of the network, because operational changes are made almost every week, traditionally known as patch Tuesday.

If your organization is running Logfile analysis to see things that have already occurred, then you need our SWAT Analysis combined with the power of continuous monitoring to get ahead of the attackers.  Logfile analysis takes activities which have occurred within the network and recorded it.  This is a historical record of events that were successful[6].  With ITS Safe we can deploy the basis for Zero Trust in your environment and utilize the ability of Machine Speed to intercept and block malicious activities, BEFORE they can complete.

Let’s get started! –  Contact me

IT Security Solutions recommends at least an annual Security assessment to determine the security posture and formal detection of internal activities. While this is the minimum recommendation, even doing the Minimum does not detect the activities as well as our continuous monitoring solutions for our clients.

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

Contact IT Security Solutions to discuss how a SWAT Analysis will benefit your company today.

www.IT-Security-Solutions.com w www.ITS-Safe.com

412-889-6870 – info@IT-Security-Solutions.com

                 


[1] The Static Network is the network without any users active already.

[2] Personal devices normally have less security, and are either being used outside of the office, or connected to equipment in the office network (WiFi).

[3] I was recently interviewed by CSOnline.com – https://www.linkedin.com/posts/albertwhale_how-api-attacks-work-and-how-to-identify-activity-6801611480853807104-2JKr

[4] Hackers use Microsoft Build Engine to Deliver Malware Filelessly – https://thehackernews.com/2021/05/hackers-using-microsoft-build-engine-to.html

[5] In many cases the business closes from the weight of the breach, fines, ransom and loss of revenue.

[6] This is the reactive approach for cybersecurity, let it happen, then try to fix it.  Whereas, ITS Safe takes a proactive approach to blocking the unwanted activity, and not permitting it to occur.

14 Feb
5 Reasons that your Business is at Serious Risk

What you may have inside your Businesses

Here are just a few of the situations IT Security Solutions has encountered when performing an assessment.

All of the comments are focused on organizations with more than 2 computers in their network, a Firewall and Virus protection on each computer.  If this describes your organization, then your business could be at serious risk

  1. If your organization has ever had a Virus or Malware in your computer or personal device.  Today’s intruders deliver more than one piece of malware.  In fact each piece of malware also includes the ability to scan your network, and find how many other computers, printers and other devices there as well. 

    Also, the malware only resides on your computer as long as it’s needed to update the computer to include a backdoor for the attackers to return.  That means that the chance for a Virus scanner to see the malware on the computer is seriously limited.

    More than likely, the Malware succeeds in the attack of your computer, and you will not ever know that your computer was effected, until it’s too late.
  • If your office has an internet connection which is used for business activities during the day, what else is permitted?

    This about the activities on Social networks like Facebook, Instagram, Snap Chat, here is a list of 65+ Social Networking Sites –

    https://makeawebsitehub.com/social-media-sites/

Attackers exploit the distribution of Social Media channels to connect and control tens of thousands daily. To the intruders, this is like shooting fish in a barrel.

  • If your organization uses a generous work policy, that includes any of the following.  Remote Access, Remote Offices, Laptops which are permitted outside of the office, remote workers.

    Each of these are issues which require additional care and security needs.  All of them introduce their own threats into your environment.

The above was written before the Pandemic put all of us in a Work from Home effort.  

Before Pandemic    
Business Security During the Pandemic    

Before the Pandemic, there was a definite definition of security protecting the organization. This was how the security of the organization looked. However, the security of organizations evaporated during the Pandemic, see the figure just below.

Even the VPNs that connect back to the Office, bypass the firewall and are permitted directly.  Think about the security at your employees’ homes.  Is there any wonder why the attacks are concentrating now at home?

VPN Connections proceed past the firewall.

 

The part that is missing above is the lack of screening from employees and the use of VPNs.  The VPN is intended to Mask the communications from one endpoint to the other while connecting over the Internet. VPNs do not protect the connection or the business. The Firewalls permit the VPNs to connect internally and do not filter any information. You may expect that the VPN protects your business, but this is not the case.

The VPN permits direct communications to the office and repeats the same situation that was exposed during the Target breach.  The Target breach permitted the infected computer of the HVAC Vendor to get access to the entire network, and the credit card information.  That was a recipe for disaster.

  • Does your organization permit personal devices to connect to your network, or have business email on them?  (this could be considered two different issues)

    Give this a moment to sink in.  On your personal devices (iPhones, Tablets …), where are the Firewalls or Virus Scanners?  You should realize that these devices do not have one unless you have installed something yourself.  Even if the device has a firewall or scanner on it, what level of protection do you expect that this provides?

  • How long ago was your last Security/Risk Assessment?  These activities are recommended at least annually, and normally within 30 days of making a change to the network.

    The important thing to remember here is that the Security Assessment is performed by certified individuals that are interested in protecting your business.  Ultimately you can choose not to perform the assessment, in which case the intruders will be performing the assessment, and they are constantly doing that. 

    When the Intruders perform the assessment, you won’t be told the results of the assessment.  You may not be aware of what they have discovered until they want you to.  That’s right, they don’t need to let you know, and you may not know just how much of the company that they have accessed.  Your current tools are not able to detect the intrusion or stop it. 

    In fact, today’s security tools can only partially detect the next attack.  Firewalls and Virus Scanners are reported to be only 4% effective.

How many of the above items can you relate to?  Do you have the tools we describe above?  Do you want to prevent the attacks on your computers, or allow the Intruders to continue to have access to your environment?  (prevention is the cure).

Bonus

Your network has likely evolved beyond the initial PCs, and Printers.  Many networks have added WiFi, personal Devices, and many other Internet of Things (IoT) devices which have no protects either.

Our personal devices (cell phones, tablets) are never off of the Internet, and we insure that they have sufficient power at all times.  We are now so dependent on these devices, that we also allow Business Communications on them as well.

This presents the opportunity for attackers to engage in our want for information, as well as the convenience of connecting to everyone (including high value targets), to get the access and information that they are seeking.

The critical problem here is that you cannot stop, what you cannot see.  We have the tools and experience to highlight the unseen activities, and stop the attackers before they can succeed.

_______________________________________

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

Year after the year, the Pittsburgh business community recognizes IT Security Solutions, Inc. for their domain expertise and thought leadership in the cyber security space.

Contact IT Security Solutions to discuss how you will benefit by reviewing your security today.

www.IT-Security-Solutions.comwww.ITS-Safe.com

412-889-6870 – info@IT-Security-Solutions.com

Sidebar: