The Syrian Electronic Army: Lessons to be learned

Davey Winder probes just who is doing just what and why, and asks what enterprises can learn from it.

Washington Post

The Guardian

BBC

The fact that SEA will choose any target to disrupt that is likely to enable a successful propaganda action might still mean you are relatively safe if you are an enterprise in the manufacturing sector and therefore well off the radar, for example. However, this rather misses the point methinks. If the Syrian Electronic Army can find weak points in the security of enterprises, which know they are on the hacker radar, someone else with potentially less political but more of a financial driver could find them in yours as well. Which is where the point of this analysis piece comes in: what lessons can you learn in the light of the ongoing SEA attacks, and how can you use that intelligence to improve your overall IT security strategy?

IT Pro has been asking a number of security experts this very question, so that we can provide the answers for you...

Lessons to be learned

George Tubin, senior security strategist at Trusteer, told us that "enterprises need to constantly rethink their cyber defence strategy and deploy technologies that are capable of stopping these continuously advancing threats." This is pretty good advice as implementing technology is not a once and done game.

"The SEA has used advanced spear-phishing and malware attacks to gain access to corporate networks and disrupt business," Tubin warns. "Obviously, the current defenses in place at the compromised companies, and most organisations for that matter, are not enough to block such a resourceful foe."

This is perhaps best exemplified by the Associated Press (AP) Twitter feed attack. Catalin Cosoi, chief security strategist at Bitdefender, takes up the story. "It is an exemplary incident, in that it shows how organisations can and should go about protecting themselves," Cosoi explains. "In the aftermath it emerged that the credentials for the Twitter account were shared between a number of people in the AP offices, some of them in very junior positions. They had not, in fact, been identified as security critical. The Twitter account was clearly not considered to be a possible target."

This use of a succession of phishing attacks which are combined into a sort of multi-tiered privilege escalation attack against the target organisation has been a common thread in the SEA attack strategy, it's less hacking and more social engineering of the old school variety. Here lies another, not so palatable, lesson: the targets of focused attacks are always people, not systems, as people can safely be assumed to be the weaker links. Cosoi adds: "They are doxed (that is, dossiers are built on their on- and off-line habits) then personalised phishing vectors (such as web pages and/or e-mails) are crafted and planted."

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Most Popular

SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021