Earlier this year at the USENIX Enigma information security conference held in San Francisco, NSA’s Rob Joyce gave a talk, Disrupting Nation State Hackers on how to keep people like him (nation state and other types of hackers) out of their systems.
Rob has been with the NSA for 25 years, and now works as head of their Tailored Access Operations (TAO) taskforce that hacks into systems of foreign adversaries, as Wired reported in January.
Why It’s So Hard to Secure Everything
Network boundaries are becoming more amorphous and blurred, due to:
- Bring Your Own Device (BYOD) – Personal devices, including mobile phones, tablets and other devices are being trusted on your network
- Cloud computing – By putting your data in the cloud, you’re putting trust in your cloud provider’s security protocols – but it’s still part of your risk and liability
- Internet of Things (IoT) – Many elements of your building infrastructure (such as heating/cooling systems) are now part of your network and liability
- Work from … anywhere – Logging in from different, possibly unsecured networks can put transmitted and accessed data at risk, especially if done with outdated devices
How to Secure All The Things
There are things organizations can do to protect against known vulnerabilities, malware and other ways attackers try to get in:
Upgrades and automatic patching – If there’s a known bug in software that’s exploitable, you should fix that and get it off your network.
Automatic patching that is beyond user control is ideal for security, as it cuts down on the hacker’s opportunity window between a vulnerability becoming public and actual execution.
Known vulnerabilities are used more often than zero-days, and are effective only because organizations don’t update as often as they should.
Implement application whitelisting – Establish a list of applications that have been granted permission to execute on your machines – when an app attempts to execute, it’ll be checked against the list before allowing it to run.
The concept of trusted devices and networks works in a similar way. Make a list of devices and networks that you allow to access your applications, and block any anonymous networks or certain locations based on a list of IP addresses.
Credential security – Rob notes that in almost any intrusion during the initial exploitation phase of hacking, attackers try to get credentials to gain legitimate access.
Monitoring and setting a baseline for normal user behavior can help you recognize when a user is acting differently once logged in with legit credentials.
Ensure you use the least privilege principle for your users’ accounts, and only allow a small number of accounts to have the keys to the kingdom.
And more authentication security – Eliminate the reuse of administrator credentials to servers, which can lead to wide-scale compromises.
Eliminate the use of hardcoded admin or other system-wide credentials, and ensure they’re not accessible on any devices.
Ensure all authentication is only done with modern protocols, keeping passwords out of plaintext. While most modern protocols don’t pass plaintext credentials, older ones do – and nation-state hackers do take advantage of the ones that are
Two-factor authentication – The use of two-factor technology makes it harder to steal credentials. It’s important to ensure that lost credentials doesn’t get turned into a pivot at a later stage, allowing for greater access
Defend Against Lateral Movement
Most networks have a hard outer shell, but soft gooey center. Here’s how you can harden it:
Network segmentation – Identify what you need to protect, segment and manage the trust to the most important places to make it difficult for hackers to access. Consider who really needs access, and again, employ least privilege.
Two-factor authentication – Again, use it everywhere to stop hackers from moving around inside your network. Attackers will leverage multiple stolen credentials or reused passwords to get closer to their target data.
Disable software you’re not using – While not new advice, this can greatly reduce the attack surface.
Watch the video for Rob Joyce’s full talk.
