CyberCrime & Doing Time

The ENISA Cybersecurity Threat Landscape

Read the original article: The ENISA Cybersecurity Threat Landscape

 ENISA, the European Union Agency for CyberSecurity, met on October 6, 2020 to review their current recommendations and get any last minute changes.  On October 20, 2020, they released a huge batch of reports that many folks seem to have not seen.  We wanted to take a moment to give you the guided tour and strongly recommend the consumption of these report.  Each publication is available “flip book” style on the ENISA website, and also as a downloadable PDF.

Let’s get started!

https://www.enisa.europa.eu/publications/year-in-review 

This is the 8th Year In Review for ENISA and their reporting just keeps getting better!  This year the main components of the report break down into topics like this: 

  • The Year In Review
  • Cyber Threat Intelligence Overview 
  • Sectoral and Thematic Threat Analysis 
  • Main Incidents in the EU and WorldWide
  • Research Topics
  • Emerging Trends
  • List of Top 15 Threats 

The Year In Review 

This report has a few key sections.  The first that we’ll cover is the “Ten Main Trends” that were observed during the reporting period: 

  1. Attack surface in cybersecurity continues to expand as we are entering a new phase of the digital transformation 
  2. There will be a new social and economic norm after the COVID-19 pandemic even more dependent on a secure and reliable cyberspace.
  3. The use of social media platforms in targeted attacks is a serious trend and reaches different domains and types of threats.
  4. Finely targeted and persistent attacks on high-value data (e.g. intellectual property and state secrets) are being meticulously planned and executed by state-sponsored actors
  5. Massively distributed attacks with a short duration and wide impact are used with multiple objectives such as credential theft
  6. The motivation behind the majority of cyberattacks is still financial 
  7. Ransomware remains widespread with costly consequences to many organisations
  8. Still many cybersecurity incidents go unnoticed or take a long time to be detected
  9. With more security automation, organizations will invest more in preparedness using Cyber Threat Intelligence as its main capability
  10. The number of phishing victims continues to grow since it exploits the human dimension being the weakest link.
Another key section in this area was the “What To Expect” which broke the topic into three areas — Nation States, Cyber Offenders, and Cyber Criminals.  The reader is invited to view the full report, but I did want to mention that with regards to Nation States, ENISA describes the coming year as an “Uncontrolled cyber-arms race” with a free-for-all of nation states trying to buy up and acquire the best attack tools for the “cyberspace warfare domain” possibly through sponsored agents who may not present as the purchasing nation.
In the area of What to Expect From Cyber Criminals … BEC – Business Email Compromise, and BPC – Business PROCESS Compromise are expected to continue, along with malware targeting Managed Service Providers.  They predict that “Deep Fakes Used for Fraud” may be a rising trend.  I’m not sold on this concept as being a 2021 reality, but it is certainly something to watch for.
I also wanted to call attention to the prediction that Cyberbullying is likely to greatly increase as a growing number of adolescents are spending a much greater time online, possibly with limited parental oversight of their activities, as Mom and Dad are busy working from home as well!

Cyber Threat Intelligence Overview 

In this area, training resource links are offered, however the report begins by calling attention to the great gap between higher performing CTI practices and the training and tools available to the average user.  While praising existing frameworks, such as MITRE: ATT&CK, they also point out the short-comings in addressing specialized sector-specific systems, emerging systems, and cloud-computing and managed service threats.
The call is made to spend more emphasis on PREVENTION, DETECTION, and MITIGATION rather than the current near-total obsession with IOCs and APT-naming. Some sectors are especially trailing in the CTI area due to the specialty nature of their equipment and practices.  ALL SECTORS need to be greatly improving their capabilities in PDR (to use the more common Prevent, Detect, Respond term that I still prefer.)  The report calls attention to the fact that trailing sectors are often dealing with limited trust between organizations.  The more isolated your organization is from its peers, the more likely that your sector is struggling in this way.  Improved information sharing is a key.  To quote the report: “one should note that the deficiencies described are not due to a lack of CTI knowledge per se but rather to the lengthy cross- and intra-sector communication and coordination cycles for exchanging CTI knowledge.”  A related quote => “Existing offerings concentrate on operational and tactical CTI, while strategic CTI is mostly offered independently.”
Results are shared of a “Comprehensive CTI Survey” conducted by ENISA.  Some key findings include: 
  • CTI is still primarily a MANUAL PROCESS in most organizations.
  • Much CTI data is still primarily being passed through spreadsheets and email.
  • CTI Requirements are becoming more defined and beginning to take significant guidance from business needs and executive input.
  • CTI from Public Sources combined with observations from internal network and system monitoring is a popular model
  • Open-source information, enriched by threat feeds from CTI vendors is a “clear upwards trend” indicating more focus on internal CTI production.
  • Threat Detection is described as the main use for CTI, with IOCs being a base, but more interest in TTPs in the area of threat behavior and adversary tactics.
  • Only 4% of respondents felt they could measure the effectiveness of their CTI programs!  OUCH!  Machine learning was ranked especially low, with most saying the skill of the analysts was the best predictor of success!
Several areas of interest in the “Next Steps” section to me included:
–  an emphasis on coordinating CTI requirements.  While the report called for this at the EU-member state level, I would say that SECTORS should be working together to determine appropriate CTI requirements and encouraging a sector-wide improvement through collaboration.  
– development of a CTI Maturity model and Threat Hierarchies model.
– ensuring that CTI is taking into account the geopolitical world state and not just the state of bits and bytes.
Please refer to the full report for more details!  

Sectoral and Thematic Threat Analysis 

This report begins by describing the difficulty of measuring and categorizing differences by sector. I must confess to being disappointed by the lack of insights in this particular report.  As sectors shifted to the cloud during the COVID-19 Pandemic, much of the “targeting” became less sector-targeting and more “target of opportunity” focused. 
While most attack trends were “stable” there were some “cross-sector” attack types described as “Increasing” … specifically Web Application Attacks, Phishing, and Malware.
The only sector actually that was called out as being at significantly greater risk than others based on incident trends was “Health/Medical” where increases in Malware, Insider Threat, and Web Application Attacks were all marked as Increasing.
After a lack-luster “trends” report, all of two pages long, the remainder of the report focuses on Threats to Emerging Technologies, where there are some interesting observations regarding 5G Mobile communications, Internet-of-Things (IoT), and Smart Cars.
The reader is invited to visit the report for more details.

Main Incidents in the EU and WorldWide

Unfortunately, with the official timeline of this report being January 2019 through April 2020, many of the “main incidents” here are quite dated.  Good to cover them for historical documentation, but not really worth re-hashing them at this time. Significant data breaches included the 770 million email addresses stolen from MEGA (the cloud data storage service in New Zealand run by “Kim Dot Com”.) They also mention breaches such as ElasticSearch, Canva, Dream Market, Verifications.io, and a couple big MongoDB breaches.
The most targeted services, according to this report, are Digital Services, Government Administration, Tech Industry, Financial Institutions, and Healthcare entitites.  In the area of Digital Services, we know that the primary use is to take the email address/password pairs and use them to attempt password replay attacks attempting to use the same pair against many additional online properties.  ENISA refers to those as “credential stuffing” attacks and indicates that “companies experience an average of 12 credential-stuffing attacks each month!” 

The report indicates that 84% of cyber attacks “rely on social engineering” and that 71% of the organizations with malware activity have seen the malware spread from one employee to another. 
Groups that are depicted in the report as “Most active actors” don’t really align with what we’ve seen from other sources, but are listed as: 
  • TURLA – attacking Microsoft Exchange serveres
  • APT27 – mentions attacks against government SharePoint servers in the Middle East 
  • Vicious Panda – targeting Mongolian government entities
  • Gamaredon – spear-phished the Ministry of Defence in Ukraine in December 2019

The report indicates that ENISA believes most cyber attacks originate from Organized Crime groups.

The Top Five motivations for attackers are: Financial, Espionage, Disruption, Political, and Retaliation.

The Top Five “Most Desired Assets” by Cyber Criminals are listed as: 

  1. Industrial property and Trade secrets
  2. State/Military classified information
  3. Server infrastructure
  4. Authentication Data
  5. Financial Data 
I won’t detail is here, but the report also has advice on “What changed in the landscape with the COVID-19 Pandemic?” and refers to several previous publications from ENISA for that topic.

Research Topics

ENISA says that “apart from basic cybersecurity hygiene and training, investing in research and innovation is the most viable option for defenders.” Some of the key areas that they are encouraging research to be performed are: 
  • Better understanding of the human dimension of security – (I know so many great researchers in this space, from UAB’s own Nitesh Saxena, to UAB’s Ragib Hasan and his current survey on “User Preferences in Authentication” to Carnegie Mellon’s Lorrie Cranor and the IIIT Delhi PreCog lab run by Ponnurangam “PK” Kumaraguru.) 
  • Cybersecurity research and innovation – with a special focus on building “test labs and cyber ranges” that better reflect real world deployments. 
  • 5G Security 
  • EU Research and Innovation Projects on Cybersecurity 
  • Rapid dissemination of CTI methods and content 

Emerging Trends

This report begins by pointing out that COVID-19 has initiated “new and profound changes in the physical world and in cyberspace” and pointing out that “cybersecurity risks

[…]

Read the original article: The ENISA Cybersecurity Threat Landscape