Security Think Tank: Five tips for killing the campers on your network

In cyber space, an enterprise represents a treasure trove of opportunity for cyber criminals. Attacking “from a distance”, a cyber criminal might attempt to cripple a company’s website by bombarding it with distributed denial of service (DDoS) attacks, or hold some of its information ransom by delivering malware-laden phishing emails to its employees.

However, it’s the cyber criminals “hiding within” the enterprise that can present the greatest threat.

A cyber criminal that has infiltrated a company network can monitor its systems traffic, observe regular activity and identify security weaknesses to build a digital picture of the organisation. The longer an attacker spends on the network, the easier it is for them to use this information to launch attacks from within, compromise systems and locate critical data to destroy or steal. 

Given time, attackers can also build profiles of employees by monitoring how they communicate with their regular correspondence. Known as signals intelligence, it enables attackers to see how busy networks are at particular times and map the frequency of communication between specific individuals to identify privileged accounts which could lead to a “golden ticket”.

These Kerberos tickets provide unlimited access as a domain administrator, giving attackers scope for more damaging and widespread attacks.

A highly skilled attacker will know how to get onto the network without being spotted and “lay low” until they have secured enough information to make an attack. The trick is to then identify the breach and eliminate the attacker as quickly as possible.

Worryingly, however, the average attacker dwell time in EMEA has grown. According to the latest M-Trends report by security firm FireEye, in 2017, the time taken by firms to detect breaches had increased by 40% since 2016 to an average of 175 days. Below, I’ve listed five tips for reducing attacker dwell time on your organisation’s network.