Washington Post
The Guardian
BBC
The fact that SEA will choose any target to disrupt that is likely to enable a successful propaganda action might still mean you are relatively safe if you are an enterprise in the manufacturing sector and therefore well off the radar, for example. However, this rather misses the point methinks. If the Syrian Electronic Army can find weak points in the security of enterprises, which know they are on the hacker radar, someone else with potentially less political but more of a financial driver could find them in yours as well. Which is where the point of this analysis piece comes in: what lessons can you learn in the light of the ongoing SEA attacks, and how can you use that intelligence to improve your overall IT security strategy?
IT Pro has been asking a number of security experts this very question, so that we can provide the answers for you...
Lessons to be learned
George Tubin, senior security strategist at Trusteer, told us that "enterprises need to constantly rethink their cyber defence strategy and deploy technologies that are capable of stopping these continuously advancing threats." This is pretty good advice as implementing technology is not a once and done game.
"The SEA has used advanced spear-phishing and malware attacks to gain access to corporate networks and disrupt business," Tubin warns. "Obviously, the current defenses in place at the compromised companies, and most organisations for that matter, are not enough to block such a resourceful foe."
This is perhaps best exemplified by the Associated Press (AP) Twitter feed attack. Catalin Cosoi, chief security strategist at Bitdefender, takes up the story. "It is an exemplary incident, in that it shows how organisations can and should go about protecting themselves," Cosoi explains. "In the aftermath it emerged that the credentials for the Twitter account were shared between a number of people in the AP offices, some of them in very junior positions. They had not, in fact, been identified as security critical. The Twitter account was clearly not considered to be a possible target."
This use of a succession of phishing attacks which are combined into a sort of multi-tiered privilege escalation attack against the target organisation has been a common thread in the SEA attack strategy, it's less hacking and more social engineering of the old school variety. Here lies another, not so palatable, lesson: the targets of focused attacks are always people, not systems, as people can safely be assumed to be the weaker links. Cosoi adds: "They are doxed (that is, dossiers are built on their on- and off-line habits) then personalised phishing vectors (such as web pages and/or e-mails) are crafted and planted."
