Breaches are inevitable, but sensitive data loss isn’t – thinking like an attacker to keep your data safe in the face of a breach



When thinking about data protection in today’s world, there is no shortage of attack vectors. Data is everywhere: on laptops, with vendors, on mobile devices, and in the cloud.

From an attacker’s standpoint, it’s a target-rich environment. They can attempt direct assaults on the target’s infrastructure, exploit vulnerabilities in their web applications, or go after the credentials of individual employees.

As defenders, we need to determine who might want to attack us, the types of attack vectors those adversaries have used in the past, and which of our attack vectors might be attractive. The idea of “thinking like an attacker” is not new. It’s a simplified way of describing threat modeling.

It’s not enough to assume a perimeter defense will keep the bad guys out. We need to start with the assumption that some adversaries will be successful in some of their attempts to bypass our defenses and deploy a layered defense at the network and endpoints to thwart those who do bypass initial layers. Common weak points include mobile devices and laptops that connect to the Internet when off of the corporate network and social engineering attacks such as phishing. The attack can target employees or members of your supply chain (e.g., an HVAC vendor’s credentials were stolen in the Target incident).

Many companies discuss the “kill chain” approach to data protection. Essentially, this means deploying defenses at each stage of an attack (planning, code introduction, command and control, expansion/lateral movement, target identification, exfiltration). This approach acknowledges that some attacks will succeed initially, but that we can “kill” the attack at any stage to prevent data loss.

Let’s take a simple example: the case of an attacker who is targeting a company’s design information. This information may be stored in many places, but the “mother lode” will be in the data stores used by the design software (or a version control system, in the case of source code). These devices are undoubtedly in secure areas, and network defenses are monitoring external traffic.

The attacker has a few options, but his first goal is to gain extended access to the systems, ideally with valid and privileged credentials. This will provide him with greater freedom to operate and explore the target. If he is successful, we have the worst-case scenario: an attacker with authentic credentials and access to the information they wish to steal.

The alternatives for data exfiltration are numerous, including:

  • Copying files to external devices
  • Copying files to a cloud server
  • Emailing files to external accounts
  • Taking screenshots of files, and exfiltrating the resulting image file (without a CAD or similar file extension)
  • Printing the files, locally or on a remote printer

The only way to protect data in this scenario is to control what actions can be taken with the data. Access control doesn’t help, as the credentials are authentic. Privileged user management can help, but is typically used to control administrative rights, not what can be done with data. Instead, we need to apply use privileges directly to the data.

Data-centric security allows organizations to control the actions taken with data, by any user. Even privileged users with root access can be prevented from accessing data, while still being allowed to administer devices and databases. By looking at each requested action in context – accounting for the data, the user, and the action (e.g., printing, on unapproved printers) – organizations can protect sensitive information without hampering legitimate business behavior.

Understanding attack vectors is part of threat modeling; we need to understand who might be an adversary and their likely approaches. At a practical level, it doesn’t matter if the attacker is a malicious insider, or an outsider with stolen credentials, both require the same protections. Threat modeling helps us set policies that protect the data from malicious (or inadvertent) actions.

As they say, It’s not a matter of “if” you will be attacked, but “when”. Deterring attackers from breaching your systems is certainly a goal, but stopping them before they can complete their mission is a requirement. This is only possible if you are tracking the movement and use of the data itself.

Mike Pittenger

Advanced Threat Protection - Building a Kill Chain Defense

Detect and stop targeted attacks with a data-centric approach that protects sensitive data regardless of the source of attack.

Download now

Related Articles
NIST Guidance Sets Course For Contractors’ Handling Sensitive Data

A new, draft document from NIST provides guidelines for protecting sensitive government information that resides on systems

Gadgets That Eavesdrop

This holiday season you might be receiving a voice-controlled gadget – a voice controlled TV, a phone, or even an Amazon Echo. The convenience of this is obvious. But what about the downside? In order for the device to respond to your command – even its wake up command – it must, by definition, be listening. And it could be listening – and recording – a business-related conversation.

5 Questions to Prepare for Your Next Security Audit

Use these five questions to gauge your audit readiness and prepare to demonstrate your security posture to corporate clients.

Mike Pittenger

Mike Pittenger is vice president, security strategy at Black Duck Software. Mike has over 30 years of technology business experience, including over 15 in application security. He was a co-founder of Veracode and led the product divisions of @stake and Cigital. He can be reached at mwpittenger [at] caddisadvisors.com.

Please post your comments here