2 min read
Red teams attack, blue teams defend.
That’s us – defending our network.
So what attack trends were observed in 2015? And what do they portend for us blue team members in 2016?
The range of threats included trojans, worms, trojan downloaders and droppers, exploits and bots (backdoor trojans), among others. When untargeted (more common), the goal was profit via theft. When targeted, they were often driven by ideology.
Over the years, attackers have had to evolve their tactics to get malware onto computers that have improved security levels. Attackers are increasingly using social engineering to compromise computer systems because vulnerabilities in operating systems have become harder to find and exploit.
Ransomware that seeks to extort victims by encrypting their data is the new normal, replacing rogue security software or fake antivirus software of yesteryear that was used to trick people into installing malware and disclosing credit card information. Commercial exploit kits now dominate the list of top exploits we see trying to compromise unpatched computers, which means the exploits that computers are exposed to on the Internet are professionally managed and constantly optimized at an increasingly quick rate.
However, one observation made by Tim Rains, Chief Security Advisor at Microsoft was, “although attackers have accumulated more tricks and tactics and seem to be using them in a more focused, fast paced way, they still focus on a relatively small number of ways to compromise computers.” These include:
- Unpatched vulnerabilities
- Misconfigured computers
- Weak passwords
- Social engineering
In fact, Rains goes on to note: “Notice I didn’t use the word ‘advanced.’”
As always, it’s back to basics for blue team members. The challenge is to defend:
- At scale (every device on the network, no exceptions)
- Continuously (even on weekends, holidays etc.), and
- Update/upgrade tactics constantly
If this feels like Mission Impossible, then you may be well served by a co-managed service offering in which some of the heavy lifting can be taken on by a dedicated team.
