All roads to the Olympics start with a dream. For the over 15,000 Olympic and Paralympic athletes from 205 countries who congregated in Rio de Janeiro in 2016, it’s the dream of competing at the highest level possible. It’s also about standing on the podium wearing a gold medal while their country’s flag rises and the national anthem plays. For Cisco, as a proud supporter of the 2016 Olympic and Paralympic Games in Rio, it also starts with a dream: that when we securely connect everything,anything is possible. Supporting a global event of this size is a monumental task that demands a network like no other. The Rio 2016 Games required connectivity, bandwidth, security, and support for: • 37 competition venues • More than 100 support venues • 15,000 athletes • 70,000 volunteers • 9 million ticketholders • 25,000 media personnel • 123 network broadcasters from around the world All this while delivering 170,000 hours of video content and providing infrastructure for 5 billion TV viewers – up from 4 billion viewers for the London Olympics in 2012. In short, if this network were competing in the Olympics, it would break world records. However, simply providing the infrastructure wasn’t enough. Cisco also had to provide effective security. “The challenge we faced at Rio 2016 was making memorable Games, and one crucial aspect was to provide uninterrupted connectivity to our athletes, guests, media, and critical systems, all while keeping everything secure,” said Marcelo Souza, Technology Systems General Manager of the Rio 2016 Organizing Committee for the Olympic Games. “We needed a vendor that could handle the traffic demands in a complex environment and deliver the security needed for such a monumental event.” Comparisons don’t come easy when we talk about a world stage event such as the Olympic Games. Securely connecting the Games required 60 tons of equipment and more than 60,000 hours of work. As the official networking and enterprise server supporter and supplier, Cisco deployed over 5,000 access points (a 400 percent increase from the London 2012 Games) and over 113,000 local area network (LAN) ports. Cisco also supplied 440 Cisco Unified Computing System™ (Cisco UCS®) servers, 480 vehicle routers, and 177 security devices. IIn addition, the Cisco network protected core activities such as accreditation, volunteers, sports entries and qualifications, and workforce management. The network connected 183,044 unique devices of which 168,158 were wireless (92 percent of all devices). Cisco Identity Services Engine (ISE) and Cisco TrustSec technology were used to identify devices and segment accordingly. Any unrecognized device would connect to the guest network. Network traffic was extremely heavy – 2.144 petabytes of traffic over the course of the Games. To put that into perspective, it’s equivalent to 950,000 hours of HD video, which would take more than 110 years of nonstop streaming to watch. As a highly visible target for sophisticated threats from around the world, the Rio 2016 Games demanded a security architecture that is fundamentally integrated into the network. Cisco Talos, an industry-leading threat intelligence organization, reviewed the sheer number of threats mitigated on the network. During the first two weeks of the Games, there were 674 times the number of Trojans detected on the network compared to a typical large retail corporate environment during the same time. “The network had to handle a substantially larger number of BYOD (Bring Your Own Device) technology than you would commonly see in a corporate environment. A larger percentage of these devices were infected with Trojans and various other malware families. This goes to show how important it is to have proper checks in place for corporate devices from both an external and internal network perspective,” said JJ Cummings of Cisco Talos. As the first line of defense, Cisco Umbrella (formerly OpenDNS) was deployed to prevent access to malicious sites. Umbrella found and blocked hundreds of Olympic-related fake domains. Over the course of the Rio 2016 Games, it protected on average 22 million DNS requests and blocked 23,000 suspicious sites daily. At the network edge, Cisco Firepower Next- Generation Firewall and NextGeneration Intrusion Prevention System appliances prevented close to 7 million security events during the Games. On the network, millions of devices were monitored for anomalous activity through Cisco Stealthwatch, and potentially vulnerable endpoints were identified and automatically segmented away from the rest of the network using Cisco ISE and Cisco TrustSec technology. “The result was an amazing experience for everyone in Rio. Cisco provided us with the connectivity and security that allowed Rio 2016 to connect with the world,” remarked Souza. In a span of just 40 days, Cisco successfully secured and connected key networks that made the Olympic and Paralympic Games a resounding success. From London to Rio, to Tokyo and beyond, there has never been a better time to build an Olympic legacy. Products and Services Cisco ASA 5500-X with FirePOWER Services Cisco FirePOWER Services in use: • Cisco Advanced Malware Protection (AMP) for Networks • URL filtering • Application Visibility and Control (AVC) • Next-Generation IPS Cisco FirePOWER Next-Generation Intrusion Prevention System Cisco Security Manager Cisco Identity Services Engine Cisco TrustSec Technology Cisco Secure Access Control System Cisco Stealthwatch Cisco Umbrella Cisco Prime Network Registrar
At the Rio 2016 Olympic Games, Cisco:

• Blocked an average of 23,000 suspicious sites daily using Cisco Umbrella
• Delivered a secure network that handled over 2.144 PB of traffic
• Provided secure access for attendees, staff, media, and athletes across 37 competition venues

Large Enterprise Computer Software Company This case study of a large enterprise computer software company is based on a May 2018 survey of Cisco Email Security customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.
“We have been able to make extensive use of Cisco Email Security’s ability to create custom content filters. We have relied on those to better protect against BEC emails, W2 and payroll fraud, and other phishing emails.”
“I appreciate the ability to customize the way the platform works, specifically with regards to the content filters – they can be powerful.”
Challenges The business challenges that led the profiled company to evaluate and ultimately select Cisco Email Security:
Chose Cisco Email Security to protect their Office 365 email because Cisco has: Stronger protection from advanced email threats (business email compromise (BEC), advanced malware and/or phishing) Protects sensitive information in outgoing emails with: Microsoft Office 365 built-in tools Evaluated the following vendors prior to choosing Cisco Email Security:

• Proofpoint
• Symantec
• Mimecast

Use Case The key features and functionalities of Cisco Email Security that the surveyed company uses:
Purchased Advanced Malware Protection (AMP) and Cisco Email Security at the same time. Using the following Cisco products in addition to Cisco Email Security:

• AMP for Endpoints or AMP on another product
• AnyConnect
• Identity Services Engine (ISE)
• Next-Generation Intrusion Prevention System
• Umbrella
• Cisco Web Security (CWS)

Results The surveyed company achieved the following results with Cisco Email Security: Protecting users from threats in incoming email to prevent breaches Company Profile The company featured in this case study asked to have its name publicly blinded because publicly endorsing vendors is against their policies.TechValidate stands behind the authenticity of this data.
Company Size:Large Enterprise
Industry:Computer Software

This case study of a small business insurance company is based on a June 2018 survey of Cisco Email Security customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.
“Cisco Email Security allows us to get insight and control spam/malicious email. It also allows us to better track all email.”
Challenges Evaluated the following vendors prior to choosing Cisco Email Security: None. Our 3rd party vendor offered no alternatives. Use Case The key features and functionalities of Cisco Email Security that the surveyed company uses:

• Purchased Advanced Malware Protection (AMP) after purchasing Cisco Email Security.
• Using the following Cisco products in addition to Cisco Email Security:
• Identity Services Engine (ISE)

Results The surveyed company achieved the following results with Cisco Email Security:

• Protected users from threats in incoming email to prevent breaches
• Act as a Spam and Graymail filter

Company Profile The company featured in this case study asked to have its name publicly blinded because publicly endorsing vendors is against their policies.
TechValidate stands behind the authenticity of this data.
Company Size: Small Business
Industry: Insurance
About Cisco Email Security Defend against ransomware, business email compromise, spoofing, phishing, and spam while protecting sensitive data with data loss prevention (DLP) and encryption.

Integrating McAfee® Advanced Threat Defense and the Bro open-source network security platform widens the scope of threat detection to include unmanaged devices Multinational Software Company

• Large global software company
• Industry: Technology
• Environment: Fluid environment with up to 150,000 endpoints at any given time, many of them virtual, across 20 countries

Challenges

• Protect against zero-day threats across extended global enterprise
• Shrink detection to remediation gap

McAfee solution

• McAfee® Advanced Threat Defense
• McAfee® Complete Endpoint Threat Protection
• McAfee® ePolicy Orchestrator®
• McAfee® Threat Intelligence Exchange

Results

• Accelerates time to protection, thanks to automation
• Augments threat reputation information shared across
• McAfee ePO softwaremanaged devices with information gleaned from incidents involving unmanaged devices
• Facilitates endpoint incident forensics and accelerates response
• Saves security operations time and hassle

Automated submission of threat information to McAfee Advanced Threat Defense and automated sharing of that information across the enterprise improves protection while saving security operations time and hassle. This large global software company with more than 20,000 employees in 20 countries has implemented an IT infrastructure that is highly virtual and fluid. Systems come and go daily on the company’s network. For instance, in a recent week, 45,000 systems, including virtual machines, connected to the corporate network. However, during peak periods, up to 150,000 endpoints can be connected. For the company’s senior manager of security engineering, who oversees the team responsible for deployment of all security tools across the global enterprise, this environment poses distinct challenges. Challenge: Close Gaps to Block Zero-Day Attacks Although the company employs the McAfee Complete Endpoint Threat Protection suite on all its high-risk physical and virtual endpoints, it also has many virtual endpoints connecting to its network that do not have a McAfee agent installed and are therefore not updated with the latest threat protection via the McAfee ePolicy Orchestrator (McAfee® ePO™) management console. The company’s more important virtual machines host a McAfee agent but many “low-risk” systems do not. Until recently, if one of these unmanaged endpoints downloaded a malicious file, the McAfee ePO softwaremanaged endpoints would be at risk because they had no way of knowing of the existence of that threat within the environment. “Zero-day threats are our biggest concern,” remarks the senior manager of security engineering. “If any of our endpoints—managed or unmanaged—downloads a zero-day threat, we want our whole environment to know about it, and we want to be able to react appropriately as fast as possible.” In addition, if a managed endpoint became infected, security analysts would receive an alert, but, because of the fluidity of systems coming on and off the network, by the time an analyst has logged in and has attempted to find the suspicious payload, the system could easily have moved offline, essentially removing the information needed to understand what had transpired. As a result, security operations center (SOC) engineers found that they had to spend extra time tracking down infected systems and remediating them. Hunting and Blocking Zero-Day Threats with McAfee Advanced Threat Defense Along with McAfee Complete Endpoint Threat Protection, the company had implemented the Data Exchange Layer (DXL) communication fabric and McAfee Threat Intelligence Exchange. DXL connects and optimizes security actions across multiple vendor products, as well as internally developed and open source solutions, and McAfee Threat Intelligence Exchange leverages DXL to bi-directionally share threat information across all DXL-connected systems. To this automated threat reputation-sharing framework, the company added McAfee Advanced Threat Defense for “zero-day hunting,” as the senior manager of security engineering describes the appliance’s main role.  “If an unknown or suspicious file comes across one ofour endpoints protected by McAfee Endpoint Security, the file is automatically sent to McAfee Advanced ThreatDefense for sophisticated static and dynamic behavioralanalysis,” explains the senior manager of securityengineering. “If McAfee Advanced Threat Defensedeems the file to be malicious, its reputation is thenautomatically broadcast via McAfee Threat IntelligenceExchange to all the endpoints connected to DXL. Thisautomatic distribution of threat reputation informationhelps us block zero-day threats before they can harmour environment.” Enhancing Intrusion Detection with Bro But what about threats entering the environment through the company’s many unmanaged endpoints? To extend detection to these systems, the company turned to the open-source Bro network security monitoring platform. Bro ingests the company’s network traffic off a span or inline tap and converts the traffic data into logs and metadata in binary format. In a typical week, Bro submits approximately 6,000 files to McAfee Advanced Threat Defense for analysis. Of those, approximately 10% to 20% end up in the McAfee Threat Intelligence Exchange threat reputation database and are subsequently shared throughout the enterprise. “Bro gives us the ability to retain network traffic in a searchable format, which is extremely useful,” the senior manager of security engineering explains. “For instance, using Bro, we can search for source or distributed IP so we can easily conduct lightweight investigations— discover who or what connected to a specific IP address, what the payload looks like, determine the packet size, and so on.” The information captured by Bro supplements the threat information delivered via the McAfee Global Threat Intelligence cloud and disseminated via McAfee Threat Intelligence Exchange. With the Bro script and advice provided by McAfee (now available as a deployment kit), the senior manager of security engineering’s team integrated Bro with McAfee Advanced Threat Defense so that the Bro traffic data is automatically submitted to McAfee Advanced Threat Defense, just as suspicious files from McAfee Endpoint Security are automatically submitted through McAfee Threat Intelligence Exchange. Since the team was already very familiar with Bro, the integration was straightforward. Automatic Immunization Against Threats that Hit Unmanaged Endpoints “If one of our unmanaged endpoints downloads a malicious file, Bro will capture that event among the network traffic and submit it to McAfee AdvancedThreat Defense for analysis,” notes the senior managerof security engineering. “If McAfee Advanced ThreatDefense determines the file is malicious, then thatmalicious reputation will be shared automatically withevery McAfee ePO software-managed system in ourentire enterprise—in other words, with all the systemswe care about. Put another way, if one of our unmanagedvirtual machines downloads a malicious file, all of ourmanaged devices automatically receive an immune shot.” Facilitating and Accelerating Incident Response With the McAfee Advanced Threat Defense/Bro integration and threat reputation information automatically disseminated across endpoints via McAfee Threat Intelligence Exchange, inoculation of endpoints happens much faster than it did before. Consequently, there is a much greater likelihood that a system will “receive the immune shot” before it goes offline. In addition, because the actual event and surrounding intelligence is captured by Bro, even if the system goes offline, McAfee Advanced Threat Defense, as well as security analysts, have a great deal more information to help determine appropriate action, and, if necessary, to remediate more quickly. “With the McAfee automated threat framework and supporting intelligence from the Bro integration, plus automated remediation that we have also set up, our SOC very rarely needs to pay attention to endpoint incidents,” points out the senior manager of security engineering. “The Bro integration and all that automation save a ton of time.” To fortify its defenses further, the company continues to build upon its DXL-based integrated security framework. For instance, the company is currently in the process of adding McAfee DLP Monitor to gather, track, and report on data in motion across its entire network and augment its McAfee DLP Endpoint host-based data protection. “The more we can integrate our systems and automate responses, the safer we will be,” says the senior managerof security engineering.

The manufacturing case study focuses on one of the largest manufacturers of steel products to include tubing, pipe and sheet. Assets included a very large network for industrial control systems (ICS) and the necessary supervisory control and data acquisition (SCADA) components which run their manufacturing processes end to end. Prior to our involvement, this manufacturer had routinely removed routine threats but were unaware of sophisticated malware infection or advanced persistent threats. The customer had a large industry suite of cyber defense products which included a firewall, anti-virus suites, multiple intrusion detection software products, endpoint security and other software. Immediately upon installation, the TrapX DeceptionGrid generated ALERTS and identified malicious activity in two key locations. Both of these were on SCADA processors which were central to the manufacturing process. An attack in this area could severely disrupt ongoing manufacturing processes causing both a shut-down and millions of dollars in potential loss. Our analysis it was determined that both of these malicious processes were communicating through TOR to their attackers. In one case the malicious process was attempting to establish a new command and control connection through TOR. In the other case command and control was established and many types of malware were resident on the station. Broad Scale Attack Deployed Through One Entry Point TrapX found several types of malware deployed in this SCADA processor. TR-Dropper.Gen2.trojan allowed full access and control of the infected end-point. It allows for the collection and exfiltration of confidential data. Additionally we found Packed.Win32.Katusha.e malware stealing passwords which was communicating back to attacker IP addresses through TOR. Over several additional weeks, DeceptionGrid detected lateral movement by attackers that identified two additional command and control sites. The customer coordinated with TrapX and SCADA component vendors to determine the impact of the attack, to eliminate it and then to reprovision the software in all of the effected components.

Attackers Target Authentication Data Project Background - a Technology Evaluation Our financial case study focuses on a global insurance institution. Prior toour involvement, there were absolutely no indicators of malware infection or persistent threats visible to the customer. The customer had a robustindustry suite of cyber defense products which included a firewall, antivirussuites, intrusion detection software, endpoint security and othersoftware. Within a short period of time, the TrapX DeceptionGrid generatedALERTS and identified two malicious separate processes involved inunauthorized lateral movement within the insurance company network. Upon analysis it was determined that both of these malicious processeswere communicating with multiple connection points in Russia. These connection points in Russia and the other injected softwarecaptured worked together as an advanced password stealer. The attackerspenetrated the network and had captured password information. This targeted theft of authentication credentials represented a serious threat tothe integrity of the company's overall operations. At this time it has notbeen determined to what extent passwords were captured prior todetection. Other malware of lower risk identified by DeceptionGrid included Trj/Downloader.LEK Trojan, TROJ_QHOST.DB Trojan, and theW32.Greypack worm. All of these were not detected by the customersexisting cyber suite. Analysis suggests at least one of them might havebeen detected but the alerts were missed against the volume of overallalert traffic. Critical and Confidential Authentication Credentials at Risk TrapX determined that critical and confidential password data was beingexfiltrated to Russia. The scope of data compromise is still underinvestigation at this time and the global insurance firm has taken preemptivemeasures to replace credentials on suspected software systems. 

Attackers Target Law Enforcement Data Project Background - a Technology Evaluation Our case study focuses on a prominent law enforcement agency. This agency has responsibility for many activities which may include highly sensitive investigations into organized crime and terrorist activity. This agency is always interested in improving their cyber defenses and has a large budget dedicated to technology acquisition. Priorities for this agency include the protection of the confidentiality of their ongoing operations, internal processes and their personnel. This agency conducted a survey of technology vendors and wanted to learn more about deception technology. They were familiar with legacy honeypot technology and found it to be far to expensive to implement both in terms of resources and financial cost. This agency was very cautious and had partitioned several networks within the enterprise. Some were to be used for highly confidential (classified) data only - others for data of lesser confidentiality. Advanced Persistent Threat Leverages Lapse in Protocol DeceptionGrid was placed into operation. Within one week the customer security operations (SOC) team received a High Priority Alert indicating the lateral movement of an advanced threat. The malware was automatically trapped and injected into the sandbox for continued analysis. The attackers had established sophisticated command and control and had bypassed the complete array of existing intrusion detection, firewall, endpoint and perimeter cyber software defense. A full investigation continued as DeceptionGrid continued to monitor and capture malware movement. The agency's security operations team determined that there was an internal breach in their protocol. A connection, in breach of the agency's operting procedures, was found between their secure network and one of the less secure networks (lower security rating). This breach in protocol enabled the attacker's access . Exfiltration of Data Discovered and Halted The attacker was found to have moved without detection throughout the law enforcement agency network and servers. There were over ten explicit lateral movements made prior to detection by DeceptionGrid. The attacker found and exfiltrated data including the confidential records of agency personnel, their I.D information, their photographs and other highly confidential data. DeceptionGrid enabled the agency to disrupt the attack and then confidently restore normal security protocols.

Multiple Attackers Penetrate National Agency Project Background - a Technology Evaluation Our case study focuses on a large national government agency. This agency has hundreds of employees and has multiple facilities disbursed over a large geographic area. This agency wanted to learn more about deception technology as part of their regular evaluation of cyber security vendors. Massive Penetration by Attackers Detected in Multiple Areas DeceptionGrid was placed into operation. Starting almost immediately and over the course of several weeks the government security operations command (SOC) team received multiple High Priority Alerts. This was one of the most massive attacks we have ever discovered. We identified multiple attackers in several areas to include over five (5+) attackers using malware servers, over five (5+) attackers linking back data flow to botnet c&c servers and over fifty (50+) remote attackers using TOR anonymous proxy to hide source IP addresses. In some cases the malware was automatically trapped and injected into the sandbox for continued analysis. Multiple attackers had established command and control and had bypassed the complete array of existing intrusion detection, firewall, endpoint and perimeter cyber software defense. Malware found included Cryptowall, P2P Malware, Trojan-Banker, TrojanRansome, Mobogenie.B and WS.Reputation.1.  Exfiltration of Data Discovered - Broadscale Remediation Required It is clear that multiple attackers have successfully exfiltrated data from this government agency. The attack vectors varied substantially and compromised workstations and servers across multiple departments. Required remediation was done on a broad scale and included reprovisioning of both workstations and servers. The government involved has been forced to either re-provision on a large scale, or, to perform more time intensive memory dump analysis to better understand the extent of the penetration by this varied mix of attackers. Source attacker IP adresses as known are confidential at this time and part of an ongoing criminal investigation.

Attackers Target Software Company Project Background - a Technology Evaluation Our case study focuses on a leading software vendor that provides software through cloud services to their customers in healthcare. This customer's information technology team invested very substantially in defense-in-depth cyber defense software. Their security operations center regularly detected malware and was able to routinely remediate all of these known incidents. The customer had a strong industry suite of cyber defense products which included firewalls, anti virus suites, intrusion detection software, endpoint security and other software. Our initial installation included over ten (10) vLANS. DeceptionGrid was placed into operation. Almost immediately the customer information technology staff received multiple High Priority Alerts. These included identified suspicious activity and led to the discovery of several network misconfigurations. Several internal internet addresses were exposed to the internet and open to a variety of high risk protocols. Inbound connections from attackers were operational via SSH, Telnet and Remote Desktop. A TOR (anonymous proxy) obfuscated web crawler had mapped all of the exposed hosts. Some of the malware was automatically trapped and injected into the sandbox by DeceptionGrid for continued analysis. The attackers had multiple command and control points and had bypassed the complete array of existing security. Multiple Concurrent Attackers Detected and Remediated A full investigation continued as DeceptionGrid continued to monitor and capture malware movement. Multiple command and control point in six (6) workstations were linked to attackers in Beijing China, Moldava, and the multiple locations within Ukraine. Dozens of workstations had to be reprovisioned to eliminate access. Manual memory dump and analysis was required across many information technology assets to identify the full scope of the extensive and previously undetected attacker activity. Scope of Data Theft Remains Indeterminate Multiple attackers accessed this technology company's networks workstations and servers. The scope of intellectual property data exfiltration and theft is unknown but under continued investigation. 

Кибер атаки на правительственную организацию

Предыстория проекта - оценка технологии

Крупное национальное правительственное агентство имеет сотни сотрудников и множество объектов, распределнных по большой географической площади. Это агентство хотело узнать больше о технологии ловушек как части своей регулярной оценки вендоров кибербезопасности.

Атаки обнаружены в нескольких районах 

Практически сразу после введения DeceptionGrid в действие и в течение нескольких недель команда государственной безопасности получила несколько предупреждений об атаках высокой важности. Это была одна из самых массивных атак, которые мы когда-либо открывали. Мы идентифицировали нескольких злоумышленников в нескольких областях, чтобы включить более пяти (5+) злоумышленников с использованием вредоносных серверов, более пяти (5+) злоумышленников, связывающих обратный поток данных с серверами botnet c и c и более пятидесяти (50+) удаленных злоумышленников с использованием анонимного прокси TOR, чтобы скрыть исходные IP-адреса. В некоторых случаях вредоносное ПО автоматически захватывалось и вводилось в песочницу для дальнейшего анализа. Несколько злоумышленников установили команду и контроль и обошли весь массив существующих средств защиты от вторжений, защиты брандмауэра, конечной точки и периметра.

Вредоносные программы, кторые были обнаружены: Cryptowall, P2P Malware, Trojan-Banker, TrojanRansome, Mobogenie.B и WS.Reputation.1.

Эксфильтрация обнаруженных данных - Требуется широкомасштабное восстановление

Векторы атаки существенно различались и скомпрометировали рабочие станции и серверы в разных отделах. Необходимая коррекция была выполнена в широких масштабах и включала в себя репродуцирование как рабочих станций, так и серверов. Привлеченное правительство было вынуждено либо повторно предусмотреть в больших масштабах, либо выполнить более продолжительный анализ дампа памяти, чтобы лучше понять степень проникновения этого разнообразного сочетания нападавших. Исходные IP-адреса злоумышленников, как известно, являются конфиденциальными в настоящее время и частью продолжающегося уголовного расследования.

Целевые атаки на правоохранительные данные
Предыстория проекта - оценка технологии
Правоохранительный орган, несет ответственность за многие виды деятельности, которые могут включать расследования организованной преступности и террористической деятельности с высоким уровнем секретности. Это агентство всегда заинтересовано в улучшении своей киберзащиты и выделяет большой бюджет для приобретения технологий защиты. Приоритеты этого агентства включают защиту конфиденциальности их текущих операций, внутренних процессов и их персонала. Это агентство провело опрос поставщиков технологий и захотело узнать больше об технологии ловушек. Они были знакомы с унаследованной технологией honeypot и нашли эту технологию слишком дорогой, как с точки зрения ресурсов, так и с учетом финансовых затрат. Это агентство было очень осторожным и разделило несколько сетей внутри предприятия. Некоторые из них должны использоваться исключительно для конфиденциальных (классифицированных) данных - для данных с меньшей конфиденциальностью. DeceptionGrid был введен в действие. В течение одной недели команда безопасности клиентов (SOC) получила сообщение с высоким приоритетом, указывающее на боковое перемещение передовой угрозы. Вредоносная программа была автоматически захвачена и введена в песочницу для дальнейшего анализа. Нападавшие установили сложную команду и контроль и обошли весь набор существующих средств защиты от вторжений, защиты брандмауэра, конечной точки и периметра. Продолжалось полное расследование, так как DeceptionGrid продолжал отслеживать и отслеживать движение вредоносных программ. Группа по операциям по обеспечению безопасности агентства установила, что в их протоколе произошло внутреннее нарушение. Связь, нарушающая процедуры обслуживания агентства, была обнаружена между их защищенной сетью и одной из менее безопасных сетей (более низкий рейтинг безопасности). Это нарушение в протоколе позволило получить доступ злоумышленника.
Эксфиляция данных, обнаружение и остановка
Было обнаружено, что злоумышленник двинулся без обнаружения во всей сети правоохранительных органов и на серверах. Было более десяти явных боковых движений, сделанных до обнаружения DeceptionGrid. Нападавший обнаружил и расширил данные, включая конфиденциальные записи персонала агентства, их информацию о I.D., их фотографии и другие конфиденциальные данные. DeceptionGrid позволил агентству нарушить атаку, а затем уверенно восстановить обычные протоколы безопасности.

Атаки нацелены на ведущего вендра программного обеспечения
Предыстория проекта - оценка технологии
Ведущий поставщик программного обеспечения предоставляет программное обеспечение через облачные сервисы своим клиентам в сфере здравоохранения. Команда информационных технологий этого клиента в значительной степени инвестировала средства в защиту компьютерной безопасности. Их центр оперативной безопасности регулярно обнаруживал вредоносное ПО и смог регулярно исправлять все эти известные инциденты. У клиента был сильный отраслевой пакет продуктов для защиты от кибернетики, который включал брандмауэры, антивирусные комплекты, программное обеспечение для обнаружения вторжений, защиту конечных точек и другое программное обеспечение. Наша первоначальная установка включала более десяти (10) vLANS. DeceptionGrid был введен в действие. Практически сразу клиентские информационные технологии получили несколько предупреждений о высокого приоритета. Они включали выявленную подозрительную деятельность и привели к обнаружению нескольких сетевых неверных конфигураций. Несколько внутренних интернет-адресов были открыты в Интернете и открыты для различных протоколов высокого риска. Входящие подключения от злоумышленников осуществлялись через SSH, Telnet и Remote Desktop. Обманный прокси-сервер TOR (анонимный прокси-сервер) отображал все выставленные хосты. Некоторые из вредоносных программ были автоматически захвачены и инъецированы в песочницу DeceptionGrid для продолжения анализа. Нападавшие имели несколько контрольных точек и обходили весь массив существующей безопасности.
Обнаружено и устранено несколько одновременных атакующих
Продолжалось полное расследование, так как DeceptionGrid продолжал отслеживать и отслеживать движение вредоносных программ. Несколько командных и контрольных точек на шести (6) рабочих станциях были связаны с нападавшими в Пекине, Китае, Молдове, и в нескольких точках на территории Украины. Десятки рабочих станций должны были быть репродуцированы для устранения доступа. Для многих объектов информационной технологии необходимо было отображать дамп и анализ вручную, чтобы определить весь масштаб обширной и ранее не обнаруженной активности злоумышленника. Объем кражи данных остается неопределенным. Несколько злоумышленников обращались к сетевым рабочим станциям и серверам этой технологической компании. Объем исследований и хищения данных об интеллектуальной собственности неизвестен, но расследование продолжается.

Целевая атака на данные аутентификации Предыстория проекта - оценка технологии В нашем финансовом исследовании основное внимание уделяется глобальному страховому учреждению. До этого времени абсолютно никаких индикаторов заражения вредоносными программами или постоянных угроз, видимых клиенту, не было. У клиента была обширная комплектация продуктов для защиты от кибер атак, которая включала брандмауэр, антивирусы, программное обеспечение для обнаружения вторжений, Endpoint и другое программное обеспечение. В течение короткого периода времени TrapX DeceptionGrid создал ALERTS и идентифицировал два злонамеренных отдельных процесса, связанных с неавторизованным боковым движением в сети страховой компании. После анализа было установлено, что оба этих вредоносных процесса связывались с несколькими точками соединения в России. Эти точки соединения в России и другое вложенное программное обеспечение взяты вместе как расширенный перехватчик паролей. Нападавшие открыли сеть и записали информацию о пароле. Это адресная кража учетных данных для проверки подлинности представляла собой серьезную угрозу целостности общих операций компании. В настоящее время он не определил, в какой степени пароли были захвачены до обнаружения. Другие вредоносные программы с меньшим уровнем риска, идентифицированные DeceptionGrid, включают Trj / Downloader.LEK Trojan, Trojan_QHOST.DB Trojan и червь W32.Greypack. Все они не были обнаружены клиентами существующего кибер-пакета. Анализ предполагает, что, по крайней мере, один из них мог быть обнаружен, но оповещения были пропущены против объема общего трафика. Критические и конфиденциальные учетные данные под угрозой TrapX определил, что критически важные и конфиденциальные данные пароля были отправлены в Россию. В настоящее время масштабы компрометации данных все еще недостаточно изучены, и глобальная страховая фирма взяла на себя превентивные меры по замене полномочий на подозрительные программные системы.