The Syrian Electronic Army: Lessons to be learned

Davey Winder probes just who is doing just what and why, and asks what enterprises can learn from it.

Washington Post

The Guardian

BBC

The fact that SEA will choose any target to disrupt that is likely to enable a successful propaganda action might still mean you are relatively safe if you are an enterprise in the manufacturing sector and therefore well off the radar, for example. However, this rather misses the point methinks. If the Syrian Electronic Army can find weak points in the security of enterprises, which know they are on the hacker radar, someone else with potentially less political but more of a financial driver could find them in yours as well. Which is where the point of this analysis piece comes in: what lessons can you learn in the light of the ongoing SEA attacks, and how can you use that intelligence to improve your overall IT security strategy?

IT Pro has been asking a number of security experts this very question, so that we can provide the answers for you...

Lessons to be learned

George Tubin, senior security strategist at Trusteer, told us that "enterprises need to constantly rethink their cyber defence strategy and deploy technologies that are capable of stopping these continuously advancing threats." This is pretty good advice as implementing technology is not a once and done game.

"The SEA has used advanced spear-phishing and malware attacks to gain access to corporate networks and disrupt business," Tubin warns. "Obviously, the current defenses in place at the compromised companies, and most organisations for that matter, are not enough to block such a resourceful foe."

This is perhaps best exemplified by the Associated Press (AP) Twitter feed attack. Catalin Cosoi, chief security strategist at Bitdefender, takes up the story. "It is an exemplary incident, in that it shows how organisations can and should go about protecting themselves," Cosoi explains. "In the aftermath it emerged that the credentials for the Twitter account were shared between a number of people in the AP offices, some of them in very junior positions. They had not, in fact, been identified as security critical. The Twitter account was clearly not considered to be a possible target."

This use of a succession of phishing attacks which are combined into a sort of multi-tiered privilege escalation attack against the target organisation has been a common thread in the SEA attack strategy, it's less hacking and more social engineering of the old school variety. Here lies another, not so palatable, lesson: the targets of focused attacks are always people, not systems, as people can safely be assumed to be the weaker links. Cosoi adds: "They are doxed (that is, dossiers are built on their on- and off-line habits) then personalised phishing vectors (such as web pages and/or e-mails) are crafted and planted."

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Tesla Megapack goes up in flames at Australian battery site
Hardware

Tesla Megapack goes up in flames at Australian battery site

30 Jul 2021