HealthMatters
Safety service edge (SSE) know-how was created to guard distant and department customers with a unified, cloud-delivered safety stack. To grasp how SSE options defend organizations and their customers, it’s worthwhile to research attacker methods, in addition to the protections and controls SSE options use to disrupt them.
It’s helpful to make use of the MITRE ATT&CK framework. MITRE ATT&CK is a big knowledgebase of attacker methods that cybersecurity specialists use to explain the assault kill chains noticed, when finding out menace exercise. This put up goes to make use of the Mitre ATT&CK framework to research particular methods inside the “lateral motion” class, describe how every method works, and element how Cisco’s SSE resolution, Cisco Safe Entry, can defend you from them.
Lateral Motion
Lateral motion is a important part within the cyber kill chain. As soon as attackers have breached a single system or person account, they should broaden their presence inside the community to entry priceless sources, delicate information, or extra permissive privileges. Lateral motion permits attackers to determine a foothold inside the community, broaden their attain, and obtain their goals.
Attackers use quite a lot of methods, similar to exploiting distant companies or infecting shared sources, to maneuver horizontally throughout the community and acquire unauthorized entry to extra important programs or privileged accounts. By maneuvering laterally, attackers can evade detection, preserve persistence, and maximize the influence of their assault.
In its Enterprise Matrix, the Mitre ATT&CK framework describes lateral motion as a class made up of 9 methods, a number of with quite a few sub-techniques. Whereas that’s an excessive amount of to cowl on this weblog put up, let’s analyze a number of of the commonest methods.
Exploitation of Distant Providers
One of many key methods utilized in lateral motion is the exploitation of distant companies. On this method, attackers are searching for a susceptible or misconfigured service that they will exploit to realize entry to the system it’s operating on. From there, they are going to proceed to use the distant system, usually establishing persistence to allow them to return to the system over and over and use it as launchpad to pivot deeper into the community.
Attackers normally begin with discovering what companies are operating on an organization’s distant programs, and so they use quite a lot of discovery methods to find out if any of them are susceptible to compromise. Most companies have had some kind of vulnerability in some unspecified time in the future, and if any of them are left unpatched and outdated, that vulnerability could also be lively. For instance, in 2017, the WannaCry ransomware used an exploit known as EternalBlue, which took benefit of a vulnerability within the server message block (SMB) protocol, to unfold all over the world. As well as, functions that could be used within the inner community, similar to MySQL, might comprise vulnerabilities that attackers can exploit. Whereas many of those vulnerabilities might have patches accessible for them, oftentimes it’s troublesome to patch a useful resource or simple to miss it, leaving them susceptible to assaults.
Distant Providers
Typically, the attacker doesn’t must assault the distant service itself, however as an alternative, they will use legitimate credentials which were stolen another approach to make the most of distant companies meant for workers. On this assault, the attacker obtains stolen credentials by methods similar to phishing or credential stuffing.
As soon as they’ve these credentials, they will use distant entry companies similar to safe shell (SSH) or distant desktop protocol (RDP) to maneuver deeper into the community. Typically these credentials are utilized in centralized identification administration with single sign-on, which provides the attacker broad attain within the community if they will efficiently authenticate with the central identification supplier.
In some instances, authentic functions might make the most of distant companies, similar to software program deployment instruments or native distant desktop functions, which may typically be abused to acquire distant code execution or lateral motion.
Taint Shared Content material
Attackers might acquire entry to a shared useful resource, similar to a shared storage location like a cloud storage supplier. In these instances, attackers can leverage this entry to inject malicious applications, scripts, or exploit code to in any other case authentic recordsdata. When a person accesses the contaminated shared content material, the malicious payload executes, giving the adversary entry to the distant system, permitting to maneuver laterally deeper into the community.
For instance, in April 2023, Google’s Cybersecurity Motion Crew described an increase in menace actors utilizing Google Drive to ship malware and exfiltrate information. The report detailed a nation-state assault that was delivering an ISO file containing a malicious DLL by way of Google Drive. One other menace actor saved malware on Google Drive to evade detection and despatched phishing emails that contained hyperlinks to the malicious file. Yet one more menace actor used Google Drive as location to exfiltrate information to.
How Cisco Safe Entry Can Assist
Lateral motion is important part of the cyber kill chain. Correctly addressing lateral motion requires a mix of menace detection and coverage enforcement. One of many challenges organizations face when stopping lateral motion, or cyberattacks on the whole, is the excessive variety of distant customers. Up to now, organizations relied on digital non-public networks (VPNs) to allow distant customers to entry non-public firm sources and to browse the Web with the safety of company safety.
There are a number of challenges to relying so closely on VPNs. For one, most corporations constructed their VPN structure to serve a small minority of customers. As distant and hybrid work turned commonplace, customers stretched the capability of VPNs, usually resulting in efficiency issues. This leads customers to disconnect from VPNs the place doable simply to remain productive, which jeopardizes safety.
The opposite drawback is zero belief entry insurance policies on VPNs are troublesome, usually requiring managing massive and sophisticated entry management lists. This has led to a situation the place many corporations don’t phase VPN site visitors in any respect. Because of this as soon as an attacker positive factors entry to a company VPN, they will transfer laterally all through the community with relative ease. Lately, this has been a part of a number of high-profile breaches.
Cisco Safe Entry was designed to guard distant customers, wherever they’re and no matter they’re accessing, and to safe company sources that should now be accessible over the Web.
This entails inserting non-public apps behind a layer of safety utilizing Zero Belief Community Entry (ZTNA). This know-how locations a safety boundary round your functions, and, because the title implies, applies zero belief entry insurance policies to any person attempting to connect with the protected useful resource. These insurance policies will be so simple as guaranteeing a person is authenticated with MFA to posture assessments, similar to guaranteeing they’re utilizing an up to date working system or a corporate-managed gadget. It additionally helps logical group insurance policies, similar to guaranteeing solely engineers can entry code repositories or solely gross sales and assist can entry buyer relationship administration options.
These insurance policies are utilized on a per-user and per-application foundation, which creates segmentation between functions. That is important in stopping lateral motion. If an attacker manages to bypass authentication and all entry insurance policies, their attain is restricted solely to that utility. They’re unable to pivot deeper into the community.
ZTNA isn’t the best selection for each utility, which is why Cisco Safe Entry additionally makes use of an built-in VPN-as-a-service (VPNaaS) for an entire Zero Belief Entry resolution. This enables organizations to maneuver off bodily VPN infrastructure, bettering efficiency for finish customers and decreasing administration complications. It’s also absolutely built-in into Cisco Safe Entry’ unified coverage administration, guaranteeing there’s nonetheless segmentation and 0 belief coverage enforcement.
As well as, Safe Entry consists of an built-in Firewall-as-a-service (FWaaS) with an intrusion prevention system. This protects site visitors over non-web protocols and blocks vulnerabilities similar to these utilized by WannaCry ransomware.
The opposite a part of stopping lateral motion is obstructing preliminary entry by defending the person when they’re browsing the Web. That is achieved by blocking phishing web sites, blocking malware, and imposing information loss prevention insurance policies. This tremendously decreases the chance the person’s account or machine will grow to be compromised, which may stop attackers from ever attending to the lateral motion part of the kill chain.
Cisco Safe Entry cancan ship all these outcomes and capabilities by unifying twelve completely different safety applied sciences right into a single, unified, cloud-delivered platform. This is named a safety service edge (SSE) resolution. At its core, an SSE resolution supplies safe entry to the Web, cloud companies, and personal functions for customers, no matter the place they’re positioned. It delivers zero belief entry management, menace safety, information safety, and acceptable use coverage enforcement for all customers and sources. SSE is the safety part of the safe entry service edge (SASE) structure, which mixes networking and safety to streamline operations, enhance safety resilience, present end-to-end safety, and securely join customers to sources.
Cisco Safe Entry supplies a greater expertise for finish customers by simplifying entry flows. Customers now not want to fret about managing VPN connections. After they attempt to entry functions, it simply works. It additionally makes IT administration simpler. It makes use of a single, unified coverage administration dashboard for all its part components. Lastly, it makes everybody safer by leveraging superior safety capabilities to mitigate threat.
To study extra about Cisco Safe Entry, watch the webinar Deep Dive right into a Trendy Zero Belief Entry (ZTA) Structure.
We’d love to listen to what you suppose. Ask a Query, Remark Under, and Keep Linked with Cisco Safety on social!
Cisco Safety Social Channels
Share:
GIPHY App Key not set. Please check settings