Photo by Geran de Klerk on Unsplash

Cyber security for the weakest link

Secret, Quick, Quiet

Article from ADMIN 49/2019

By Matthias Wessner

The balance between IT threats and IT security is woefully unbalanced in a Windows environment, requiring the enforcement of company-wide security standards.

Virus scanners and firewalls have been around in the IT world for years and have established themselves in people's minds as recognized security measures – which is unfortunate, because attacks on computer systems are no longer just amusement for script kiddies. Instead, attackers, sometimes even autonomous states, systematically target IT resources. The proven defenses are no longer capable of withstanding the current threat situation.

Why should a firewall not be sufficient against these directed attacks? A city wall is a good example of what can happen: It is constructed to protect a city against uninvited guests, much like a firewall, although cyberattacks against a firewall can't necessarily be compared with a cannon that tears city walls down. Instead, imagine the city to be a heavily frequented trading town, where the hackers have disguised themselves as traders. The city wall (firewall) and the city guards (virus scanners) fail to identify the hitherto unknown thieves, because they first behave like normal merchants. However, once they are inside the city, the city wall no longer helps, and the city guards are limited in the extent to which they can check the criminal activity.

How does such a hacker currently proceed in practice? In principle, an attack always follows the same phases:

1. Break-in

2. Persistence

3. Preparatory work (lateral movement)

4. Perseverance and system surveillance

First, the hacker needs to gain access to the system, either by exploiting a vulnerability or inducing a user to execute malicious code. Security gaps are always present (e.g., the well-known Spectre and Meltdown threats). Attackers automatically and permanently check whether they can find computers on the Internet that have the kind of vulnerabilities they can exploit. Keep in mind that the attacker only needs one computer capable of being compromised, so the chain is only as strong as its weakest link.

Therefore, it is

...

Use Express-Checkout link below to read the full article (PDF).