US government urges organizations to prepare for Russian-sponsored cyber threats

Image: iStock/Aterrassi

Cyberattacks sponsored by hostile nation-states are ever a large concern, for governments and organizations. Using precocious and blase tactics, these types of attacks tin inflict superior and wide damage, arsenic we've already seen successful specified incidents arsenic the SolarWinds exploit. As such, organizations request to beryllium vigilant for specified attacks and marque definite they person the means to forestall oregon combat them. In an advisory issued connected Tuesday, the U.S. authorities provides proposal connected however to bash that.

SEE: Zero spot security: A cheat expanse (free PDF) (TechRepublic)  

Authored by the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the NSA, the associated advisory doesn't constituent to a circumstantial menace but does counsel organizations to follow a "heightened authorities of awareness" astir Russia-sponsored cyberattacks. The informing comes astatine a clip erstwhile hostility betwixt the Kremlin and NATO is precocious implicit fears that Russia is readying a caller penetration of Ukraine.

"The advisory doesn't notation the existent Russian-Ukraine tensions, but if the struggle escalates, you tin expect Russian cyber threats to summation their operations," said Rick Holland, main accusation information serviceman astatine Digital Shadows. "Cyberspace has go a cardinal constituent of geopolitics. Russian APT groups aren't astatine the apical of the menace exemplary for each companies, dissimilar the captious infrastructure providers mentioned successful the alert, but could extremity up being collateral damage."

On a wide level, the advisory provides 3 pieces of proposal to guarantee that your enactment is acceptable to support itself against these state-sponsored attacks.

• Be prepared. Confirm your processes for reporting a cyber incidental and marque definite determination are nary gaps among your IT unit for handling information threats. Create and trial a cyber incidental effect plan, a resiliency program and a continuity of operations program truthful that captious concern operations aren't disrupted successful the lawsuit of a cyberattack.
• Beef up your cyber posture. Adopt champion practices for individuality and entree management, protective controls and architecture, and vulnerability and configuration management.
• Increase your vigilance. Stay existent connected imaginable cyber threats. Subscribe to CISA's mailing database and feeds to get notifications erstwhile details are released astir a information taxable oregon threat.

The advisory besides describes immoderate of the circumstantial vulnerabilities that Russian-sponsored hackers person targeted oregon exploited successful the past to summation archetypal entree into an organization:

• FortiGate VPNs
• Cisco routers
• Oracle WebLogic Server
• Kibana
• Zimbra software
• Exim Simple Mail Transfer Protocol
• Pulse Secure
• Citrix
• Microsoft Exchange
• VMWare
• F5 Big-IP
• Oracle WebLogic

Further, organizations should beryllium alert of immoderate of the tactics and targets utilized successful Russian state-sponsored attacks. In galore cases, these hackers volition people third-party infrastructure and bundle arsenic a mode of impacting an full proviso chain, arsenic seen successful the SolarWinds attack. In different cases, they'll spell aft operational exertion (OT) and concern power systems (ICS) networks by installing malware. Further, these attackers often usage morganatic and stolen relationship credentials to infiltrate a web oregon unreality situation wherever they stay undetected arsenic they crippled their malicious campaigns.

SEE: Password breach: Why popular civilization and passwords don't premix (free PDF) (TechRepublic)

The advisory besides offers much circumstantial tips for organizations connected protection, detection and effect to a cyberattack oregon different information incident.

Protection

1. Require multi-factor authentication for each users without exception.
2. Require that accounts person beardown passwords. Don't let passwords to beryllium utilized crossed aggregate accounts to which an attacker mightiness person access.
3. Establish a beardown password argumentation for work accounts.
4. Secure your relationship and login credentials. Russian state-sponsored hackers often instrumentality vantage of compromised credentials.
5. Disable the retention of wide substance passwords successful LSASS memory.
6. Enable beardown spam filters to halt phishing emails from reaching your users.
7. Update and spot each operating systems, applications and firmware. Prioritize patching the astir captious and exploited vulnerabilities. Consider adopting a centralized spot absorption strategy to assistance with this process.
8. Disable each unnecessary ports and protocols.
9. Ensure that each OT hardware is successful read-only mode.

Detection

1. Make definite you show for and cod logs astir information incidents truthful you tin afloat analyse them. For this, you tin crook to specified tools arsenic Microsoft Sentinel, CISA's escaped Sparrow tool, the open-source Hawk tool or CrowdStrike's Azure Reporting Tool.
2. Watch retired for grounds of known Russian state-sponsored tactics, techniques and procedures (TTPs). For this, reappraisal your authentication logs for login failures of valid accounts, particularly aggregate failed attempts. Look for "impossible logins" specified arsenic ones with changing usernames and ones that don't lucifer the existent user's geographic location.

Response

1. Upon detecting a cyber incidental connected your network, rapidly isolate immoderate affected systems. 
2. Secure your backups. Make definite your backed information is offline and secure. Scan your backup to marque definite it's escaped of malware.
3. Review immoderate applicable logs and different artifacts.
4. Consider contacting a third-party IT institution to counsel you and assistance you guarantee that the attacker is removed from your network.
5. Report incidents to CISA and/or the FBI via your local FBI tract office oregon the FBI's 24/7 CyWatch astatine (855) 292-3937 oregon CyWatch@fbi.gov.

"Russia has precise precocious cyber warfare skills which support them hidden erstwhile a web is compromised, though ironically, the archetypal onslaught vectors are typically those of low-tech email phishing campaigns, taking vantage of radical reusing already compromised passwords oregon utilizing easy guessed passwords," said Erich Kron, information consciousness advocator astatine KnowBe4.

"To fortify organizations against these attacks, it is captious that they person a broad information consciousness programme successful spot to assistance users spot and study suspected phishing attacks and to amended them connected bully password hygiene," Kron added. "In addition, method controls specified arsenic multi-factor authentication and monitoring against imaginable brute unit attacks tin play a captious relation successful avoiding the archetypal web intrusion."

Also see

• Cybersecurity: Don't blasted employees—make them consciousness similar portion of the solution (TechRepublic) 
  
• Top 5 things to cognize astir web shells (TechRepublic) 
  
• How to go a cybersecurity pro: A cheat sheet (TechRepublic)
• Social engineering: A cheat expanse for concern professionals (free PDF) (TechRepublic)
• Shadow IT policy (TechRepublic Premium)
• Cybersecurity and cyberwar: More must-read coverage (TechRepublic connected Flipboard)