Advanced Threat Protection in the Public Sector: Addressing 3 Critical Shortfalls

Advanced Threat Protection in the Public Sector: Addressing 3 Critical Shortfalls

Industry Perspective

INTRODUCTION: UNDER SIEGE

Federal networks and systems

today are under unrelenting

attack by persistent, sophisticat-

ed and resourceful adversaries

who operate on behalf of na-

tion states or criminal groups

with the aim of stealing sensitive

data, causing harm or exploit-

ing federal and military systems.

Furthermore the problem is

worsening: The Government Ac-

countability Office reported that

cyber incidents affecting federal

systems spiked from 5,503 in

2006 to 67,168 in 2014 — an

incredible 1,121% increase.

Many of these incidents are likely from advanced persistent threats, or APTs. This category of cyberthreat is particularly difficult to de-tect and protect against for several reasons. For one thing, APTs are tailored to penetrate specific targeted networks or organizations. For example, an attacker may insert malicious code via an email customized to a specific person with access to a targeted network. The email will be designed to appear as though from a friend, relative or colleague so as to gain that person’s trust in disclosing a password or opening a malicious attachment. Or an attacker may rely on other sophisticated means, sometimes employing so-called

“zero day” tactics, which exploit vulnerabilities in software or hard-ware that are not publicly known.

Also, APTs approach from multiple vectors, such as email, a Web page or a shared file. They are often the product of extensive plan-ning and resources. They take the form of a campaign over time, not just a single piece of malware, which increases the chances of success. They enter a network quietly and remain stealthy long afterward. If and when they are detected, it is often already too late to prevent damage.

The proliferation of cyber incidents reported by federal agencies reflects many challenges confronting government. For example, many agencies struggle to assess risks and develop and implement security controls. Many are also vulnerable due to poor basic cyber hygiene, budget constraints, excessive access points to the Internet, cyber skills shortages and the prevalence of legacy IT systems ill-de-signed for security. These are generally well-known challenges that policymakers are working to address.

But there also are technical challenges that complicate the govern-ment’s ability to counter advanced threats. Three industry experts— Ken Durbin, Unified Security Practice Manager, and Tom Blauvelt, Security Architect, both at cybersecurity company Symantec, and Don Maclean, Chief Cybersecurity Technologist at DLT Solutions

— discussed these technical challenges with GovLoop and how federal managers can address them.

They agree that federal agencies can contain advanced threats if they bolster identification and authentication capabilities, imple-ment data loss prevention, and automate cybersecurity functions as much as possible.

This Industry Perspective will assess each of these challenges and offer insights into how existing solutions and technologies can help agencies address them effectively.

2 Advanced Threat Protection

Industry Perspective 3

3 Critical Capabilities for Fending off CyberthreatsDefending any vast enterprise against advanced, per-

sistent cyberthreats requires a holistic and layered

approach that integrates the smart use of policy,

processes, technology, strategy, education, skillsets

and architecture.

In this report, we examine three specific technical

dimensions of the problem that federal agencies are

struggling to master and offer insights into how they

might better address them.

The ability to ensure that only the right

people have access to the right information

The ability to prevent the catastrophic loss of critical data, either

from outside or within

The ability to automate many aspects of cyber-

threat detection, analysis and response

4 Advanced Threat Protection

One of the biggest technical weaknesses plaguing federal agencies is the inability to authenticate the identities of people logging on to their networks. The Office of Management and Budget conclud-ed that nearly a third of federal cybersecurity incidents reported

“are related to or could have been prevented by strong authentica-tion implementation.”

Many agencies are strengthening their identity authentication regimes by requiring multiple factors of identification for those who must access a privileged network. These factors include: (1) some-thing the user has, such as a Personal Identity Verification (PIV) card or Common Access Card (CAC); (2) something the user is, such as a fingerprint or iris scan and (3) something the user knows, such as a password, key code or answers to security questions.

Across the government, the goal today is to stand up two-factor authentication regimes — typically, the swipe of a PIV or CAC card and a password — to provide network access to their workforces. Many agencies made progress at this during the 2015 Cybersecuri-ty Sprint initiative directed by OMB.

But in many quarters of government, network access still rests on single-factor authentication: the password. The problem is that passwords are fairly easily hacked. People choose weak passwords because they are easier to remember or because they underestimate the need for security. When agencies do impose tighter rules for more complex passwords, help desk call volumes spike, prompting some organizations to relax password standards. Shorter, less complex passwords can often be cracked in minutes through so-called “brute force attacks” in which specialized soft-ware is employed to guess millions of combinations of letters and words per second. Hackers also employ keyloggers, guessing, sift-ing through password dumps or conning an IT customer support agent into resetting it, among other tricks.

Multi-factor AuthenticationBut even as some federal agencies are still working to stand up two-factor identity authentication regimes, the landscape is shifting. The increasing sophistication of APTs is prompting more securi-ty-savvy organizations to adopt three-factor identity authentication and even to abandon the use of passwords entirely because they have proven unreliable as a security device.

“[Federal agencies] are just getting to two-factor authentication when there are plenty of three-factor authentication solutions that would exponentially increase the ability to make sure the person logging in is who they say they are and should be granted access,” Symantec’s Durbin said.

So what does three-factor authentication look like? It could work like this, Symantec’s Blauvelt said: A federal employee logs into a network and enters a password (Factor 1: Something she knows). Then a prompt is sent to her smart phone, which contains a digital certificate verifying the phone belongs to her (Factor 2: Something she has). The prompt asks the employee to confirm she is trying to access the network. She responds to the prompt by scanning her fingerprint on the smart phone (Factor 3: Something she is).

“The problem in the past with getting people away from username and password has been they don’t want to add any more complex-ity to their login process,” said Blauvelt. “But with this new tech-nology, it’s simply using your username and password and then putting your thumbprint on your phone, or just pressing the ‘accept’ pop-up button [on the smartphone]. That adds very little additional overhead to the user’s process and for the amount of security this buys you, it’s well worth it.”

These capabilities are embodied in Symantec Identity Access Manager, which enables an agency to enforce identity and/or context-based (identity, group, device, IP range) policies that allow enterprises to shift applications to the cloud without loss of control. It supports integration with strong authentication technologies, such as Validation and ID Protection (VIP) Service, one-time-pass-word (OTP) and Managed PKI Service digital certificates, to validate user access. Strong authentication can be implemented at initial login, in addition to a “step-up” policy for any Web application that warrants it. Identity Access Manager provides user-friendly authen-tication options to enable employees to access agency apps and data to work anywhere, anytime, and is available as an on-premise or hosted cloud-based service.

IDENTITY AUTHENTICATION & ACCESS MANAGEMENT

DATA-LOSS PREVENTION

Industry Perspective 5

Cyber attackers are usually after one thing: data. And their intent is to steal it, alter it or eliminate it. Guarding against and preventing the loss or manipulation of mission-critical and sensitive data is a complex challenge for federal agencies.

“One of the big difficulties for federal agencies is simply identifying what data they actually have and the sensitivity level of that data,” said DLT’s Maclean. “That sounds like it would be fairly fundamen-tal — and it is — but it’s not as easy to know what you have as you might think.”

An agency does not need to devote resources to data that is not sensitive or important. However, agencies need to be able to iden-tify where all of their data is stored; classify that data in terms of mission-importance and impact if stolen; set appropriate monitor-ing and security controls for how varying classifications of data are accessed and used and have automatic responses in place to block inappropriate actions. Federal agencies have been slow to do these things, instead placing greater emphasis on strengthening identity authentication and access management protocols to ensure that only the right people are gaining access to sensitive data. While good, this approach does little to prevent privileged employees from inappropriately moving sensitive data to non-secure devices or platforms, whether the intentions are malicious or not. Durbin and Blauvelt note that there is no explicit federal policy to deploy data-loss prevention technology, and that’s part of the problem. However, federal policies and regulations– such as NIST 800-53, and the DHS CDM program – do mandate inventory of assets, including data. They also require identification and documentation of data flows between systems. Symantec’s DLP capability can therefore do double duty: come for the data inventory, stay for the loss prevention.

What Data-Loss Prevention DeliversDeploying data-loss prevention (DLP) capabilities is important for several reasons. First, DLP can help agencies identify data, its loca-tion, and its sensitivity levels. In addition, it can inform managers when someone with privileged access is doing something inappro-priate with critical data, such as downloading it to a thumb drive or including it in an email. DLP can also counter advanced threats by enabling security managers to prioritize incident response— a vital capability for federal agencies who face thousands or hundreds of thousands of attacks per day. Blauvelt explained: “We can use the inventory of sensitive data from our data-loss prevention system, and mesh that with an incident-response process. This enables us to prioritize the incidents that are affecting systems that have our crown jewels, our sensitive information. Let’s bring those incidents to the top of our to-do list, and if we don’t get to anything else to-day because limited resources force us to let stuff drop, we can at least prioritize the events with the potential to do the most damage to our organization or to our mission.”

The Symantec Data Loss Prevention (DLP) solution offers this kind of comprehensive approach to information protection that embrac-es today’s cloud- and mobile-centered realities. Symantec’s best-of-breed DLP solution enables IT managers to discover where data is stored across all cloud, mobile, network, endpoint and storage systems; monitor how data is being used, whether employees are on or off the network and protect data from being leaked or stolen

— no matter where it’s stored or how it’s used.

Symantec DLP employs a combination of advanced technologies that can accurately detect critical and sensitive data throughout the enterprise, whether it’s at rest, in motion or in use. It also features a unified management console, the DLP Enforce Platform, and a business intelligence reporting tool, IT Analytics for DLP, that allows agency security managers to write policies once and then enforce them everywhere, measurably reducing information risks.

6 Advanced Threat Protection

CYBERSECURITY AUTOMATIONThe scale and speed of the cyberthreat landscape that federal agencies face is far too complex and fast to address manually. To keep pace, cybersecurity functions and tasks, such as incident detection, categorization, prioritization and response orchestration, must happen at machine speed.

“[Agencies] have lots of devices that are collecting logs, but you can get inundated with information,” Durbin said. “So how do you comb through all of that to find out if something is going on, if something bad is happening or is about to happen? Tools that can help ease that burden through automation are widely recognized as the key to moving forward to addressing the advanced threat. Different control points across the network need to be able to communicate, report and, when necessary, respond without having to wait for a human being to intervene. That’s a huge challenge.”

An example of this kind of automation exists with Symantec Data Loss Prevention (DLP) in terms of its ability to discover where critical data is stored, monitoring how that data is being used and protecting that data from being leaked or stolen. But automation is needed at all levels of the cybersecurity lifecycle. Threat data, for example, needs to be merged from multiple sources to provide a more complete picture and then shared in a relevant way with other nodes in the security community for analysis or collation with other data streams.

The Many Levels of Cybersecurity Automation

“The analysis of cyberthreats and vulnerabilities also needs to be automated”, Blauvelt said.

“Once we get the information about threats, how do we quickly ana-lyze and prioritize that information? Today for most agencies this is a manual effort. What if we want to share cyberthreat information with a colleague? That’s often a manual effort as well. So there’s a lot of emails going back and forth,” he said.

The same goes for the investigation phase that follows a breach — it too needs to be automated. That includes gathering and analyzing relevant evidence to understand what was compromised and to what extent. The same for the process of remediating the environment after a breach to make sure it is threat-free and safe to operate in.

“All that work is manual. If we can automate any and all of those efforts, we’re going to enable greater protection against advanced threats for our organizations,” Blauvelt said.

Automation at all of these levels is available. Symantec’s DeepSight Intelligence solution, for example, provides in-depth threat intelli-gence on current and emerging threats to spot and block threats before they hit, enabling agencies to react faster to changes in the threat environment. And by offering combined threat, vulnerability and reputation information, DeepSight Intelligence allows agencies to customize threat alerts based on their IT infrastructure and security policies.

The most comprehensive level of automation can be found with Symantec’s suite of Advanced Threat Protection (ATP) offerings

— Symantec™ Advanced Threat Protection: Email, Symantec™ Advanced Threat Protection: Network, Symantec™ Advanced Threat Protection: Endpoint and Symantec™ Email Security.cloud — which are capable of discovering and remediating advanced threats across the enterprise from a single console. Maclean said a partic-ularly impressive feature of ATP is called Symantec Synapse, which automatically correlates related events across all protected end points to prioritize and block the most critical of suspicious threats confronting the enterprise. ATP automatically sends suspicious files to a cloud-based sandboxing and payload detonation service, called Symantec Cynic, for rapid detection and safe activation. Cynic is even capable of detecting the estimated 28 percent of advanced threats that are “virtual machine-aware,” meaning they are de-signed to evade detection by traditional sandboxing systems.

GovLoop’s mission is to “connect government to improve govern-ment.” We aim to inspire public-sector professionals by serving as the knowledge network for government. GovLoop connects more than 250,000 members, fostering cross-government collaboration, solving common problems and advancing government careers. GovLoop is headquartered in Washington, D.C., with a team of dedicated professionals who share a commitment to connect and improve government.

For more information about this report, please reach out to info@govloop.com.

ABOUT SYMANTEC

ABOUT DLT SOLUTIONS

ABOUT GOVLOOP

The cybersecurity landscape

continues to evolve in scale

and complexity. APTs are

approaching federal agencies

with unprecedented frequency,

velocity and cunning. In this

daunting environment, few

capabilities will be more critical

to federal agencies going

forward than being able to

effectively authenticate the

identities and control access of

their privileged network users;

prevent the loss of their most

critical data and automating

most, if not all, aspects of the

detection-to-response lifecycle.

Symantec helps federal agencies develop and implement compre-hensive and resilient security strategies to reduce risk and meet Cross-Agency Priority Goals, the NIST Cybersecurity Framework, the Joint Information Environment and other federal mandates.

For 25 years, DLT Solutions has been dedicated to solving pub-lic-sector IT challenges. Guided by our relentless focus, we have grown to be one of the nation’s top providers of world-class IT solu-tions. Leveraging our strategic partnerships with top IT companies, we develop best-fit solutions for our federal customers.

CONCLUSION

Industry Perspective 7

1152 15th Street NW, Suite 800 Washington, DC 20005Phone: (202) 407-7421 | Fax: (202) 407-7501

www.govloop.com@GovLoop