Security assessment and identity management provider CyberArk’s vice president of Red Team services Shay Nahari is committed to giving enterprises the tools to find the holes in their security before the bad guys do, and prepare them on what to do should an attack happen.
With data breaches making the news more and more – both due to the increasing sophistication of attackers as well as mandatory data breach legislation requiring disclosure – boards around the globe are increasingly looking to penetration testing and cyber insurance for protection.
Yet, these can only go so far; and while penetration testing is valuable, the ethical nature of the engagement means the white-hat hacker is constrained in what they touch and what they break.
The bad guys have no such limitations upon them. Thus here comes Shay Nahari and his Red Team at CyberArk, assisting organisations in detecting and reacting to targeted attacks using adversary simulation and advanced real-life tactics and techniques.
|
|
His team bring a wealth of deep experience in combating threats, especially within financial institutions. Nahari himself comes from a technical background including time in the Israeli army, and now he and his team are building up CyberArk’s own specialised IP and capabilities.
This cumulative expertise means the team has pretty much seen it all. And, what’s more, often the complexity of the diverse tech stacks within such enterprises makes it easier for the threat actors to gain privileged access to sensitive data.
For example, Nahari explains, the bad actors can steal session cookies to bypass security controls – with vast ramifications when we’re speaking about the SWIFT terminal at the bank. The attacker can make transfers by stealing two different cookies from two different people; they can circumvent the entire security stack and perform arbitrary wire transfers. And that’s only the start.
Knowing your environment is vulnerable is one thing; mitigating these known risks is another. And by far and away, being able to identify the threats, detect when you are being compromised, and respond appropriately is another. It’s this latter set of skills that a regular penetration test won’t impart, and where you need the experience of the CyberArk Red Team.
In fact, Nahari explains, one common misconception in business today is that security is an IT concern. Yes, he says, five years ago the typical target for an identity attack was the IT administrator with keys to the network and server infrastructure.
Today, it’s different; identity theft has proliferated and firewalls are no longer the protection they once were due to the growth of remote working and working from home. The bad guys have got smarter and recognised every identity is a privileged identity. Why pursue the IT admin when the financial controller may possibly be easier to compromise and with full access to payroll, billing, bank accounts, and more.
Thus, the first attack for an identity compromise attack can really be any employee who is able to connect from anywhere. We must stop thinking about identity in traditional ways, Nahari says, with the concept of IT admins being “privileged” on the network, vs. other users being “non-privileged.”
“Start thinking about multi-privileged users,” he says. “There is financial info, SalesForce, consumer data, PII (personally identifiable information) … Every single user in your environment is privileged in some way.”
Of course, basic security hygiene must always be in place, Nahari says. These are things like multi-factor authentication and application controls and how you manage your identity.
However, today we all have hundreds of identities, so managing and securing that sprawl becomes a much more difficult challenge at scale. Compound that with the complexity and silos within an enterprise’s tech stack, and the relentless desire from bad actors to access your data for criminal purposes, and it almost seems hopeless how you can ever hope to keep this all secure.
Fortunately, you’re not on your own. Shay Nahari and his Red Team at CyberArk have your back, and with real-world attack simulations, they can help any organisation not only deal with known flaws but be prepared for the unknown ones too.
Click Here For The Original Source.
