David Merkel, CTO of Mandiant, a security company that specializes in incident response technology and services, talks about what he is seeing in targeted attacks, why they are effective and some basic ways organizations great and small can improve their ability to respond.
NR: Does advanced persistent threat (APT) really represent something new, or is it mostly hype?
Merkel: We’re talking about it more, but it’s not new; Kevin Mandia, our CEO, has been dealing with it for nigh unto a decade. It’s just more visible. It was initially the province of government and defense industrial base companies, but what brought it into the public eye was Aurora in early 2010, and the fact that Google was fairly straightforward in talking about the situation. That really raised awareness; right after that the vendor advertising machine started up and market got very crowded with APT messages.
That being said, here’s what we see that is new: We had historically seen a lot of government-defense industrial base focus; what we’ve seen through the years –year over year in 2008-9-10-now – is the number of other commercial entities that are targeted by the same threat groups using the same techniques is increasing. By commercial, I mean non-defense industrial base; you look at a company and say, that has nothing to do with planes, bombs, tanks; why the heck is that happening? It all comes down to international trade, business, resources. Those kinds of things that are issues of large scale, country economic impact seem to be areas of interest. That continues to be very prevalent.
NR: But, aren’t most attacks targets of opportunity?
Merkel: All can I can comment on is what we see; we’re not under the delusion that we are some accurate proxy for the world view. I am sure there are still plenty of criminal enterprises that operate under a broad range of targets of opportunity, but we still see a preponderance of targeted attacks in which particular threat actor has a specific set of companies they want to compromise, and focus very much on that activity. But there could be other companies that tend to get different types of investigations and probably have a different world view because of how they market their expertise, so we probably end up selecting from different sets of clientele with different problems; therefore, the data we have at hand is different.
NR: Fair enough. So from what you are seeing, what are the bad guys after?
Merkel: It depends on who the actor is. APT actors are all intel-based. They care about the business intelligence; they are not stealing financial instruments. It’s everything that may be considered national interest; you’re talking about weapons systems and things of that nature, to business dealings in China. There’s no question there is still very healthy criminal trade focused on financial instruments, ACH networks, credit cards, but it’s hard for me to say what’s more prevalent. From our seat in the theater we see a lot of each. We see tons of APT, but that has a lot to do with our position in the industry and our expertise.
NR: Do smaller organizations have to worry about APT?
Merkel: The tail on defense industrial companies is a long tail. There are a lot of 500, 1,000, 2,000 node network infrastructures in small DIB companies that are further down the supply chain. They are just as actively targeted by advanced threats like APT as anyone else, because stuff they are making is interesting in some intelligence context.
NR: What are attackers doing better than they did a year or two ago? Is it a matter of more sophisticated attacks, or is something else going on?
Merkel: In my opinion, it’s not new technical techniques that are making attackers more successful. It’s the aggression of the attacker, the persistence of the attacker and the adherence to process that they exercise relentlessly that is making them successful. There’s cool new kung fu being practiced, but what scares see me is when the cool new stuff is being commoditized and put into that really interesting, dedicated process. Then it gets really dangerous and scary.
NR: Please explain what do you mean by dedicated process?
Merkel: One thing we have seen on the targeted attack side that is kind of interesting is managing a social engineering campaign. It’s like managing a marketing campaign. If you are phishing credentials, it’s a communication that you want a result from. You have a population of targets you want to work through. So you start with an initial communication, shoot it out, measure response and adjust it. Then, again, shoot it out and measure response and adjust. I’m struck with the parallels between that and managing marketing campaigns. It’s just operationally well executed. It looks like a business, but the goal isn’t a page view but a compromised asset.
NR: Aside from buying Mandiant incident response products and/or services, and maybe have very little in the way of response resources, what is some of the very basic blocking and tackling that will help in terms of IR?
Merkel: Start with a little psychotherapy: Say to yourself, “I will be breached,” and believe it. Start with getting that cognizance in the right levels of the organization, so you can get the conversation going about: What we will do when this happens, as opposed to what are we going to do if this happens. If you come to that realization you are already way better off, even if you do nothing else
Next take a look at your processes for dealing with that. It’s very similar to a business continuity or disaster recovery drill; you’re thinking about a contingency that has a super high probability of happening. So, at least talk about what you are going to do: Who are stakeholders? Who do you need to coordinate with? Do you least have a playbook, so you’re not vapor-locked standing still so you make decisions in the moment. If not going to invest a lot of time and money in what true preparedness, you might make a small investment, if don’t have incident response expertise, to at least have third party help you with plan and assess your capabilities so you know what they are and let your stakeholders know what they are, so if something bad happens everyone knows what you can and can’t do and what you need to do to augment your program with outside parties.
NR: Before we wrap up, I have to ask you about Stuxnet. Was it a fluke – a very special case using very special resources against a very specific target? Should I be worried about this kind of thing? Should critical infrastructure be worried?
Merkel: Let s hypothesize that Stuxnet was state sponsored. I’m not necessarily saying it was, but how does your security budget stack up to that of a nation state? That’s a tough thing to sit and tell people, “Yep, you should be planning on dealing with that.” For a long time Kevin Mandia was saying, “Look, I’m less worried about attacks on controllers, not that they are not possible on SCADA systems, etc., but because the U.S.s response would be kinetic not cyber. What’s the defense department’s official stance on cyber attacks on the U.S.? War. We’ll drop bombs on you.
There’s a certain class of problem that I don’t know if it’s worth spending time and energy on. That doesn’t mean you should completely ignore it. You should still look at fundamental practices that can impact something like that. For example, if you choose to have your control network fully disconnected, make sure it is it fully disconnected. How do you get data from high side to low side? Do you allow that data to transit? Those are the sort of policies and controls you can be thinking about.
Worrying too much about trying to countrer all potential targeted attacks could be a lot of energy and effort, and you would still have a problem if a nation state decided it was coming in.