The Syrian Electronic Army: Lessons to be learned

Davey Winder probes just who is doing just what and why, and asks what enterprises can learn from it.

Washington Post

The Guardian

BBC

The fact that SEA will choose any target to disrupt that is likely to enable a successful propaganda action might still mean you are relatively safe if you are an enterprise in the manufacturing sector and therefore well off the radar, for example. However, this rather misses the point methinks. If the Syrian Electronic Army can find weak points in the security of enterprises, which know they are on the hacker radar, someone else with potentially less political but more of a financial driver could find them in yours as well. Which is where the point of this analysis piece comes in: what lessons can you learn in the light of the ongoing SEA attacks, and how can you use that intelligence to improve your overall IT security strategy?

IT Pro has been asking a number of security experts this very question, so that we can provide the answers for you...

Lessons to be learned

George Tubin, senior security strategist at Trusteer, told us that "enterprises need to constantly rethink their cyber defence strategy and deploy technologies that are capable of stopping these continuously advancing threats." This is pretty good advice as implementing technology is not a once and done game.

"The SEA has used advanced spear-phishing and malware attacks to gain access to corporate networks and disrupt business," Tubin warns. "Obviously, the current defenses in place at the compromised companies, and most organisations for that matter, are not enough to block such a resourceful foe."

This is perhaps best exemplified by the Associated Press (AP) Twitter feed attack. Catalin Cosoi, chief security strategist at Bitdefender, takes up the story. "It is an exemplary incident, in that it shows how organisations can and should go about protecting themselves," Cosoi explains. "In the aftermath it emerged that the credentials for the Twitter account were shared between a number of people in the AP offices, some of them in very junior positions. They had not, in fact, been identified as security critical. The Twitter account was clearly not considered to be a possible target."

This use of a succession of phishing attacks which are combined into a sort of multi-tiered privilege escalation attack against the target organisation has been a common thread in the SEA attack strategy, it's less hacking and more social engineering of the old school variety. Here lies another, not so palatable, lesson: the targets of focused attacks are always people, not systems, as people can safely be assumed to be the weaker links. Cosoi adds: "They are doxed (that is, dossiers are built on their on- and off-line habits) then personalised phishing vectors (such as web pages and/or e-mails) are crafted and planted."

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Most Popular

REvil threatens to release Apple’s hardware schematics
ransomware

REvil threatens to release Apple’s hardware schematics

21 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Samsung Galaxy S21 Ultra review: Ultra in every sense of the word
Mobile Phones

Samsung Galaxy S21 Ultra review: Ultra in every sense of the word

22 Apr 2021