What We’re Reading This Month: September Edition

In the Cyber Threat Intelligence world, a reasonably popular question for interviews or establishing street cred on Twitter is asking what blogs or other news sources people follow to stay current. We’re continuing this series to showcase some of the brilliance our team finds while seeking the answers to cybersecurity’s woes every day. We want to call your attention to some great articles out there dealing with different facets of cybersecurity, so sit back, relax, and prepare to be amazed by the brilliance!

Rory: Critical Infrastructure changes with us

Critical infrastructure (CI) is an increasingly prevalent theme in the cyber threat landscape. Historically, policy-wonks and academics saw CI in terms of nuclear power stations, water treatment plants, and government buildings. But as economies and industries continue to merge, there’s no space left for this traditional approach. For example, I could make the case that, right now, heavy goods vehicle (HGV) drivers in the United Kingdom form a part of national infrastructure. The shortage of HGV drivers has led to a substantial shortage in fuel deliveries and evokes pre-apocalypse vibes with discourse swirling around jerry cans full of gas and blocked-off forecourts. This issue has shown us that delivery systems are just as important as the products being delivered. You can indeed say the same for the cyber threat landscape, too.

Take the recently disclosed cyberattack on the Port of Houston, as reported by the Washington Post. Although it was thwarted, and the Port’s CISO justifiably presented with an award of merit (see image below), the impact could have been catastrophic; the Port is ranked 1st in the US for foreign waterborne cargo; 74% of its inbound freight is “Liquid Bulk,” which can include petroleum, chemicals, oils, and consumable and edible liquids.

 

In a hypothetically successful attack, pivoting to the port’s core systems could have rendered it inoperable. Ships could have been left floating for days or weeks on end. This could have spiraled into a fuel shortage, which of course, has its own knock-on effects. All of this could have happened if the attackers had successfully compromised a password management program. Again, we can see the importance of every link in the chain, no matter how intangible it may seem to be. An attack on a password management system could create a severe crisis; this shows us that CI is expanding and morphing alongside industries. Take heed!

Read more on the recent attack on the Port of Houston here.

Stefano: FireEye sheds light on pervasive influence campaign

Back in my uni days, I spent quite some time researching disinformation and how different nation-states would build their influence campaigns to cause favorable political movements somewhere beyond their borders. This topic fascinated me because of the subtleness of some of the tactics used by these actors and their ability to exploit human cognitive biases. 

The advent of the Internet and social media greatly expanded the possibilities of nation-state actors in this field. The relative ease of use of these powerful means of communication, along with the ubiquitous presence of smartphones in every corner of the world, made these tools a primary choice for spreading disinformation and, in some instances, to physically mobilize foreign citizens.

This is the focus of one of the most recent FireEye blog posts. Having tracked a pro-People’s Republic of China (PRC) campaign since mid-2019, FireEye’s researchers have been able to observe the shift in tactics adopted by these actors, including narrative linked with COVID-19 and internal US politics. 

Most importantly, this article sheds light on two key developments in this disinformation campaign. First, the researchers observed this campaign expanding across 30 social media platforms, 40 websites, and niche forums, including Russian, German, Spanish, Korean, and Japanese content. Second, the blog post details how accounts in the networks sought to mobilize local protestors on US soil physically.

Although the researchers didn’t see any indication of real-world activity stemming from these attempts, this article provides an excellent insight into the pervasiveness and the boldness reached by recent internet-driven influence campaigns. The number of websites reached by this campaign and the numerous language used indicates that this campaign received significant funds and resources and thus constitute an essential strategic tool for the actor responsible for it.

Attempts to physically mobilize foreign citizens are nothing new, and several examples of that have been observed during the 2016 US Presidential elections. In that instance, the themes leveraged to sow discord were similar. Highly divisive and politicized topics are perfect for influence campaigns and will highly likely be exploited in the future to cause conflict. And as foreign nation-states improve and sharpen their tactics, they will probably be more effective in their strategy.

You can read more about this campaign here.

Sean: Anomali’s Guide on the Cyber Fusion Center

One of the fascinating concepts to evolve in recent years is that of the cyber fusion center. As Mark Alba from Anomali phrases it, it’s “the hub for actionable threat intelligence. Structurally it pulls together information and coordinates efforts across security teams; SOC, IT, physical security, fraud, etc. It also integrates multiple automation tools, collecting data from internal and external sources, curating data, and providing actionable intelligence to stakeholders to make informed decisions.”

What’s truly remarkable is that it elevates a threat intelligence team to a position where it’s not necessarily beholden to a SOC, as it would be in a lot of the more traditional models one might encounter elsewhere in cybersecurity. A cyber fusion center would likely have specialists with fraud investigation backgrounds, traditional physical security experience, and insider threat, among others, working under one umbrella in this incarnation. With this many specialties, a cyber fusion center could potentially look at every intelligence problem from several perspectives. This practice could be beneficial to a large enterprise in need of an intelligence shop that can support many different business areas, which (more importantly, to the bean counters) can often provide a more significant return on investment for tools and personnel.

To those of us coming from military and defense backgrounds particularly, this all seems to be a very familiar and workable concept, which it should be. In the US military, you might have a G-2 or J-2 element, which typically sits at echelons above a division (usually a theater or regional-level command), coordinating various intelligence functions in a given area of responsibility, as well as by providing intelligence to supported units. Typically an intelligence shop at this level is composed of all the -INTs (SIGINT, IMINT, HUMINT, etc.), as well as other needed functional areas: airspace and maneuver commanders, engineer support, communications, and other operational leaders who help support various units and missions in the space, but with an eye on intelligence. 

In practice, a cyber fusion center becomes a one-stop-shop for many. A tipoff on indicators that might’ve been only shared with a SOC team previously might also become helpful to a fraud team, or it helps close an insider threat case. In its best form, a cyber fusion center breaks down silos by enabling sharing and communication from the jump, supports a wide variety of strategic, operational, and tactical intelligence needs, and ensures stakeholder needs are met.

Personally, I’m excited to see the concept gaining more traction in cybersecurity. From a job perspective, analysts working within a similar team will get to see a wider variety of threats while also developing new skills, which, speaking from experience, can often help break the doldrums and fight analyst burnout. It also means that more people are involved in helping develop better products and requirements that are actually useful to the business and improving processes to coordinate teams’ efforts. 

This line just about sums up everything great about all of this working: “feedback ensures that the threat intelligence team remains focused on collecting and delivering threat intelligence aligned to organizational PIRs (priority intelligence requirements).” Wow. Goosebumps, y’all.

Read more from Anomali here.

Understanding the Threat Landscape

At Digital Shadows (now ReliaQuest), not only are we aiming to know what the threats are, we’re also striving to understand them. For an intelligence analyst this often means stepping outside of the usual and researching what people are saying and what new concepts are out there. These outside perspectives can often help add context or gain new information and insights on the problems we face out there in cybersecurity.

One of the tools we use daily is SearchLight, which can help you understand more about the threats that you might be facing. If you’re curious about what kinds of intelligence is there for you, you can always take SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) for a 7-day test drive, or talk to us to schedule a demo so that we can better understand your intelligence use case.