Top 10 Ways to Protect Government IT against Sophisticated Cyber Attacks

IT security threats are getting increasingly sophisticated – zero-day threats, propagating worms, and low-and-slow attacks – each of which defy most detection mechanisms and keep CISOs increasingly on their toes.

Mitigating and preventing these attacks has traditionally been approached through layered security practices, but with the help of industry developments agencies have another option for pinpointing malicious intent and blocking would-be cybercriminals. This technology-based approach, developed by DLT partner, ForeScout, and discussed in my earlier blog: Going Beyond Layered Security To Respond Rapidly To Advanced Cyber Threats augments an agency’s security arsenal (one that already includes antivirus, patch management, firewalls, etc.).

While there is no single answer when it comes to protecting networks, systems and data from sophisticated attacks, ForeScout recommends[1] that IT organizations also incorporate the following top 10 best practice guidelines.

1. Identify your business critical / sensitive information and map respective infrastructure and data stores. Assess your defense architecture. Eliminate non-essential access to resources. Eliminate unnecessary copies of data. Reduce the attack surface. And determine gaps in your defense portfolio.

2. Establish clear security policies. Build a security awareness program to alleviate the likelihood of successful spear-phishing attacks. Create and enforce policies regarding government information on social media and websites.

3. Review configuration, change, and patch management policies and procedures. Employ respective tools and controls to monitor and ensure that configurations remain stable and operating platforms are secure / in compliance. Self-propagating malware and human attackers alike will exploit unpatched systems.

4. Invest in web filtering, email filtering and anti-malware technologies, which are instrumental in reducing the threat of advanced attacks such as propagating worms, the use of malicious and suspicious websites or IPs, or the distribution of personal identifiable information in clear text.

5. Assess if DLP (Data Leakage Prevention) approaches can further reduce inappropriate transmission of sensitive information.

6. Define log management policies and ensure the consistent activation, aggregation and review of event logs. Invest in SIEM tools that provide high levels of visibility and cross-correlation across the entire network and security infrastructure with the means to define rules that support identifying policy violations and suspicious behavior.

7. Supplement your investment in conventional perimeter security (e.g. firewall, IPS and web filtering) with more advanced threat prevention. ForeScout CounterACT Edge provides unique, real-time threat protection, including protection against zero-day attacks and low-and-slow attacks.

8. If you have not already implemented NAC, examine ForeScout CounterACT for Network Access Control. This integrated NAC solution provides complete visibility and control to: keep unauthorized people and systems off your network, enforce endpoint compliance, automate endpoint remediation, and provide post-connection monitoring to detect internal malicious activity.

9. Assume that your agency can and will become the victim of a zero-day attack. Keep up to date on new threats and their operating attributes. Utilize your SIEM to help identify such threats by assessing network and security infrastructure event logs. Identify the resources and expertise needed to analyze respective security information, as skilled personnel are essential to identify advanced threats, determine the risk to the enterprise, and understand the impact with regards to remediation and resumption. Be prepared for forensics — personnel, procedures and tools — to investigate the cause and nature of the breach, and how best to initiate mitigation and/or eradication procedures that maintain the integrity of evidence for both internal and possible law enforcement action. SIEMs and deep packet inspection (DPI) tools can support forensic endeavors.

10. Consider that your enterprise will be breached at some point, and have incident response capabilities in place for dealing with the intrusion quickly and effectively. Ensure that incident response policies and procedures are in place and tested to assure adequate response to breaches including communication, assessment, remediation and resumption. Effective incident response should include a written plan with complete guidelines for assessing different risk associated with certain security breach scenarios, and clearly designated personnel and notification procedures. Assess interdepartmental response procedures which, in addition to IT and security personnel, may enlist management, legal, HR, public relations. Define escalation guidelines with criteria, approvals, responsibilities and actions for extreme cases that may require shut down of production systems and involve disaster recovery procedures.

Thanks to our friends at ForeScout for their insight. Check out the ForeScout white paper, CISO Guide: Advanced Threat Prevention, to learn more about the APT threat, why traditional technologies fall short, and where ForeScout can help agencies respond more rapidly.

[1] “CISO Guide: Advanced Threat Prevention”.