INFORMATION SECURITY

Cyber Security - A massive Hazard to Enterprises

Certain cyber attacks - also called Advanced Persistent Threats (APT) - offer a means to overcome an enterprise's competitive edge in product design, engineering prowess, or infrastructure services, and to do so leveraging target specific methods.

APTs are directed by foreign intelligence services, organized crime, or competing companies. Hence cyber assaults are strictly targeted, highly sophisticated, and are aimed at rigorous objectives; Examples are the Stuxnet worm infecting industrial SCADA controllers or the Flame APT framework. Design and implementation of an intricate APT require substantial resources and persistence. In manifest contrast to a humble DoS, e.g., an APT is devised to operate noiseless and slow poison almost always exploiting 0-day vulnerabilities and gearing dedicated assault code not yet covered by existing anti-virus signatures.

Known APT infection methods are:

Methods to identify infections:

The current trend of relocating more and more corporate network services and applications into a public cloud simplifies cyber assaults, since clouds not always provide sec measures such as MFA, data-at-rest confidentiality, or data remanence elimination

Corporate Cybersecurity Strategy

It is pretty complicated to trace the genuine originator of a sophisticated cyberattack because the assault can be relayed easily across lots of warped zombie servers which don't excel at thorough traffic logging. That is, the usual 'military' strategy of a counterstroke threat is only theoretical as the presumed originator could resort to the plausible deniability acquittal. Hence, also the threat of legal action won't be deterring for a mischievous organization. Accordingly, neither deterrence nor preemption is a viable corporate strategy.

A stringent corporate security strategy contains: