The Syrian Electronic Army: Lessons to be learned

Davey Winder probes just who is doing just what and why, and asks what enterprises can learn from it.

Washington Post

The Guardian

BBC

The fact that SEA will choose any target to disrupt that is likely to enable a successful propaganda action might still mean you are relatively safe if you are an enterprise in the manufacturing sector and therefore well off the radar, for example. However, this rather misses the point methinks. If the Syrian Electronic Army can find weak points in the security of enterprises, which know they are on the hacker radar, someone else with potentially less political but more of a financial driver could find them in yours as well. Which is where the point of this analysis piece comes in: what lessons can you learn in the light of the ongoing SEA attacks, and how can you use that intelligence to improve your overall IT security strategy?

IT Pro has been asking a number of security experts this very question, so that we can provide the answers for you...

Lessons to be learned

George Tubin, senior security strategist at Trusteer, told us that "enterprises need to constantly rethink their cyber defence strategy and deploy technologies that are capable of stopping these continuously advancing threats." This is pretty good advice as implementing technology is not a once and done game.

"The SEA has used advanced spear-phishing and malware attacks to gain access to corporate networks and disrupt business," Tubin warns. "Obviously, the current defenses in place at the compromised companies, and most organisations for that matter, are not enough to block such a resourceful foe."

This is perhaps best exemplified by the Associated Press (AP) Twitter feed attack. Catalin Cosoi, chief security strategist at Bitdefender, takes up the story. "It is an exemplary incident, in that it shows how organisations can and should go about protecting themselves," Cosoi explains. "In the aftermath it emerged that the credentials for the Twitter account were shared between a number of people in the AP offices, some of them in very junior positions. They had not, in fact, been identified as security critical. The Twitter account was clearly not considered to be a possible target."

This use of a succession of phishing attacks which are combined into a sort of multi-tiered privilege escalation attack against the target organisation has been a common thread in the SEA attack strategy, it's less hacking and more social engineering of the old school variety. Here lies another, not so palatable, lesson: the targets of focused attacks are always people, not systems, as people can safely be assumed to be the weaker links. Cosoi adds: "They are doxed (that is, dossiers are built on their on- and off-line habits) then personalised phishing vectors (such as web pages and/or e-mails) are crafted and planted."

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Windows XP source code allegedly leaked online
Microsoft Windows

Windows XP source code allegedly leaked online

25 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020