Tag Archives: Advanced Persistent Threat

November 2011 Cyber Attacks Timeline (Part II)

The second half of November has confirmed the trend seen in the previous report covering the first half of the month. The period under examination has confirmed a remarkable increase in Cyber Attacks from both a quality and quantity perspective.

Although the month has been characterized by many small attacks, several remarkable events have really made the difference.

read more

Moving Security Model From Content To Context

In these days I visited several customers to talk about technology trends for 2012. With the occasion I decided to collect all the articles written in my blog concerning Advanced Persistent Threats and Related Technologies in a single, very short, presentation, and consequently uploaded it to SlideShare. Feel free to give it a look as a reference. My perception is that next year we will often hear talking about APTs and NG-IPS (and, more in general, about context-aware security Technologies).

read more

Advanced Persistent Threats and Human Errors

In these days many people are asking me what they can do to stop an Advanced Persistent Threat. Although security firms are running fast to develop new technologies to thwart these attack vectors (sophisticated SIEMs and a new breed of network security devices, the so called Next Generation IPSs), unfortunately I am afraid the answer is not so easy. I might spend thousands of words to figure out the answer, but I would not be able to give a better representation than this cartoon I found a couple of days ago in the Imperva Blog.

read more

October 2011 Cyber Attacks Timeline (Part I)

October has come and here it is, also for this month, the first part of my Cyber Attacks Timeline covering the cyber events occurred in the first half of the current month.

Three events in particular have marked this month: The German Trojan R2-D2 (that is raising many questions and concerns inside the infosec community), the keylogger hitting U.S. Drones and a new cyber attack to Sony involving this time “only” 93,000 accounts (oops! They did it again).

read more

Advanced Persistent Threats and Security Information Management

Advanced Persistent Threats are probably the most remarkable events for Information Security in 2011 since they are redefining the infosec landscape from both technology and market perspective.

I consider the recent shopping in the SIEM arena made by IBM and McAfee a sign of the times and a demonstration of this trend. This is not a coincidence: as a matter of fact the only way to stop an APT before it reaches its goal (the Organization data), is an accurate analysis and correlation of data collected by security devices. An APT attack deploys different stages with different tactics, different techniques and different timeframes, which moreover affect different portion of the infrastructure. As a consequence an holistic view and an holistic information management are needed in order to correlate pieces of information spread in different pieces of the networks and collected by different, somewhat heterogeneous and apparently unrelated, security devices.

read more

September 2011 Cyber Attacks Timeline (Part II)

Here it is the second part of my traditional monthly Cyber Attacks Timeline (Part I available here). From an information Security Perspective the main events of this month were the infamous Diginotar breach which led to Bankrupt for the Dutch Company and also the BEAST attack to SSL, two events which, together, thumbed the Infosec Community in its stomach.

read more

Some Random Thoughts On RSA Breach

Security tokens from RSA Security designed as ...
Image via Wikipedia

June 7 Update: RSA admits some stolen seeds were used to attack Lockeed Martin and will replace SecurID tokens for customers with concentrated user bases typically focused on protecting intellectual property and corporate networks.

May 31 Update: Wired reports that L-3, a Second Defense Contractor, has been targeted by an attack using information stolen during the RSA Breach

read more

Report Symantec Q4 2010: Fate Presto… Prima che la sicurezza SCADA!

Symantec è particolarmente attiva in questo scorcio del 2011, così, dopo la pubblicazione del Dossier Stuxnet aggiornato, ha appena rivelato alla comunità di sicurezza il Symantec Intelligence Quarterly Report: October – December, 2010 che è interessante analizzare, notando, come questo si discosti notevolmente dall’analogo report recentemente pubblicato dalla livrea rossa di McAfee, principale concorrente del produttore di sicurezza di Cupertino.

read more

I Cinque Domini Dell’Apocalisse

Quando la sicurezza Informatica incontra (involontariamente) l’arte…

Zoom Del Grafico Infezione al Dominio E (Aprile 2010 - Dati Symantec)

Symantec ha da poco pubblicato un aggiornamento relativo al proprio documento di analisi del malware Stuxnet. In questa versione del documento, che rappresenta forse il lavoro più esaustivo dedicato al malware delle centrali nucleari, il produttore di sicurezza di Cupertino ha aggregato i dati raccolti relativi al traffico effettuato dal malware verso i server di controllo remoto, con lo scopo di tracciare la linea spazio-temporale che ha caratterizzato l’infezione.

read more

Previsioni di sicurezza 2011: 4 produttori a confronto

Mi sono divertito a confrontare una sintesi dei report sulle previsioni per il 2011 emessi dai principali produttori di Sicurezza (Symantec, McAfee, Trend Micro) che ho già commentato in queste pagine.

Ho scelto, non a caso, i produttori che sono considerati leader di mercato e riferimento tecnologico da parte dei principali analisti. A questa lista, come termine di paragone, ho aggiunto Kaspersky considerato un importante outsider. Sebbene nell’elenco spicca un illustre assente, ovvero Sophos, da parte del quale non sono state, almeno per ora, rilasciate previsioni per il 2011, è comunque interessante confrontare globalmente le indicazioni fornite dai singoli vendor per valutare quali nubi offuscheranno maggiormente il panorama della sicurezza informatica nel corso del 2011.

read more