So,
I think we talked about this in our first module when we
talked about criminals putting in backdoors,
but when you see infrastructure attacks,
are you seeing persistence there,
that criminals' trying to get persistence in there?
Yeah, and sometimes it's fairly sophisticated.
We see,
we still see attacks where the attacker will come in
and do really deep-level stuff,
like running kernel-mode drivers that will start up the
malware when you start up your computer,
and it bypasses all of your antivirus, all of your FIM.
It doesn't check any of that because it's in kernel mode.
And, when that happens, those persistence attacks can stay a long time,
and they're really difficult to detect.
You have to do an image and really look at what's happening on startup,
and we see those attacks --- Is that common?
Should people be quite worried about the sophistication of the attacker?
I often find that merchants underestimate the sophistication of attackers.
It really depends on how valuable of a target you are.
If you're a level one merchant, yeah,
you better be worried about those sophisticated type of attacks.
You can spend lots of time making sure you have the best,
most expensive, cool firewall in the world,
but if somebody gets in through any of the other
smaller attacks that you don't see about,
or even the MouseJacking type of attacks,
they can get really sophisticated,
so you have to worry about those more sophisticated attacks or those
obscure attacks that you don't even think about.
If you're a valuable enough target, they will come after you.
Whereas, as smaller merchant,
they may just need a good security policy that doesn't
make them the lowest-hanging fruit.
So, I guess thinking about level one merchant and service providers,
people where the criminal has a vested interest for trying really hard.
What advice would you give to those type of organizations?
What sort of things should they be doing even that
are over and above the standard?
What's the good security stuff they should be doing?
They need to understand their network as a whole to see
that everything is being covered.
That they're not just checking the box to say, hey, we're compliant.
They need to be going above and beyond.
They need to be having their pen tests done.
And PCI says annually.
Would you suggest people did that more frequently?
Again, that's going to be the floor.
That is the minimum, and the more valuable of a target you are,
the more robust I would have your pen tests being.
Because the pen tests,
they're going to put themselves in the place of the attacker,
and they're going to find the weak points in your network.
So, when I work in financial services, I very rarely pen test.
I go for red team exercises.
I actually want aggressive, persistent attackers to see how,
to see what a criminal would do.
And we want to see social networking, or excuse me,
social engineering tests done as well.
A lot of times, merchants will spend the money on a great robust security system,
and then they forget to have their employees reporting
suspicious activity or alerting if antivirus pops up.
It's going to /dev/null or somewhere.
Nobody's looking at those alerts.
And so you can have the greatest security in the world,
but if you're not monitoring it, not watching your alerts,
when those trigger, what good did it do you?
But then that's cultural.
That's more than buying a box, isn't it, as you well know.
That's actually training people to report,
and then getting helpless people to go, thank you for the report,
and not, why did you tell me?
I don't care.
It's that whole thing of being a security, living and breathing, organization.
Yeah.
It starts at the top.
The executive team needs to have that security culture in mind and enforce it.