From the Front Lines of Cyber Warfare

Just another breach.  We’ve heard about a lot of breaches, more records lost, and we’re getting numb to it.  But in this post, we highlight why December 2020 is a watershed moment in Cybersecurity.  We’ve officially entered the 21^st Century game of cyberwarfare. We’ve always talked about the importance of Cybersecurity, and now we’ve been hit in the face. Hard. It may take months to years to discover the depth of penetration, and all along – the Attackers will have already moved on, using different tools, techniques, and circumventing our defenses.

The implications of this moment are simple: we get serious about Cybersecurity, right now, or we wave the flag of surrender.  We do the former with focus and budget, the latter we simply let our systems, networks, data, and e-commerce be “owned.”  Cyber insurance isn’t going to come in on a white horse to save the day, or your business, or our country.  The only thing that will work is to accept the reality that this is warfare.  Adopt the posture of a warrior, focus your budget, amass your tools, and step up your game.

No, Cybersecurity isn’t easy, and dealing with the seriousness of this breach will significantly burden every enterprise and government agency.  But the threat model has changed, so should your behavior.

Critical breaches have changed the game: Game On.

Situation Report: FireEye, SolarWinds, and the Departments of Treasury, Commerce, and Homeland Security all announced critical breaches in December 2020. It’s early in the game, but by all reports, it appears to have been executed by a nation-state actor. Intellectual property stolen, footholds planted, depth-of-exposure, and penetration completely unknown. The Intelligence Community (IC) is calling this the largest, most significant cyber-attack in United States history. The Actors are bold, hostile, intentional, methodical, and now in command of more advanced, customized attack toolkits.

Observations: To put the new and alarming situation into more context, let’s examine each element with a bit of a sharper lens:

• FireEye (FE): an industry-leading threat intelligence, forensics, network, and endpoint security company was breached. FireEye/Mandiant has been called to work on the highest-profile breaches in the world. This is what we know as of early December 2020:
  • FE says a 15-year collection of “Red Team Attack Toolkits” were stolen by the nation-state actor (will not provide attribution, but all indicators are Russia).
  • o This means techniques, custom evasion tools, and frameworks, and defensive capability information is now in the hands of this nation-state actor.
  • o FE has been forthcoming and helpful to the defender community, providing signatures, rules, a repository of information, and regular communication.
  • o FE customers are not in increased danger, and likely more enhanced with new detection updates FE is applying to their products.

• SolarWinds (SW): an industry-leading IT management toolset, offering full control, monitoring, and remote administration capabilities of network and host infrastructure within customer’s environments.
  • The Supply Chain was compromised; a backdoor was planted into a download update for their “Orion” software on the official SolarWinds update site.
  • SW states 18,000 systems (i.e., customers) affected during March-June of 2020.
    • SW has 300,000 customers, so it’s fair to assume more exposure is TBA.
  • Due to severity, The Department of Homeland Security (DHS) issued an emergency notification to all Federal departments to disconnect SolarWinds from networks.

• US Departments of Treasury, Commerce, and other critical Federal agencies
  • Multiple reports with confirmed sources announced these and other agencies, technology, consulting, and other industry firms had been breached.
  • SolarWinds was the entry point, confirmed by FireEye.
  • Attack behaviors strongly indicate Cozy Bear, a nickname for a Russian foreign intelligence service group that also attacked the State Department and White House systems during the Obama administration.
  • “Ongoing active exploitation.” The DHS warning included this language with SolarWinds as the foothold. Other systems and agencies are compromised for remote surveillance and potential sabotage.

Recommendations:

• Perform a risk assessment. The threat landscape has changed significantly, and so should the threat model. Expect to increase your budget and take this threat seriously.
• Implement and/or enhance an enterprise-wide Cybersecurity framework.
• It doesn’t need to be complex; use consultants to make this practical.
• Increase threat monitoring, management, response, and hunt capabilities.
• Increase vigilance across all sectors, industries, and internet-attached systems.

Conclusion:

The Threat landscape has changed significantly. In all sectors, all enterprises are now on serious notice to increase their security posture, and accordingly, their budgets. This bold attack against the United States and commercial entities has yielded a significant advantage to our adversaries. FireEye, known for actively tracking, reporting, and combatting nation-state actors, investigating the top breaches, was a prized target. This clearly shows the increased hostile nature of cyberwarfare. This successful attack against a prestigious Cybersecurity firm led to the theft of vital intellectual property, a collection of the most advanced, customized cyber weaponry, coupled with defense-evasion information. This is a devastating loss in the game of cyberwarfare.

Game On. We will undoubtedly see many more enterprises compromised because of both the information from the FireEye breach, as it trickles out or becomes part of an active campaign in the future, and the footholds with “ongoing active exploitation” already established by the SolarWinds backdoor. It is proactively smart to assume any organization that owns Orion is compromised, and not just the SolarWinds platform, but the systems under SW management (entire networks, servers, workstations, etc.). Recognizably a non-trivial implication, disconnecting Orion from the Internet must be a top priority until the fog clears.  Seek guidance on patch vs. flatten.  If you don’t know, ask somebody.  The same goes for advanced Threat hunting.

Convene a senior leadership meeting to be smart, clear-eyed, and proactive in your approach. Update your threat models, prioritize your risks based upon criticality.  Contain and mitigate the SolarWinds threat, assume compromise, increase Threat hunting and management, refine your strategy with a framework. Finally, adopt a framework with a continuous improvement mindset; as it’s the only way to be adaptive, resilient, budget-smart, and able to withstand the realities of this 21^st Century game.