The first 2020 challenges for cyber professionals: three new vulnerabilities and rising nation-state threats

Just a few days into 2020, CISOs were already facing an uncommon test of resilience. Makers of three widely used technology products disclosed remote-code-execution vulnerabilities that could affect billions of users. 

Responding quickly and effectively to these threats is urgent for protecting critical business services and infrastructures. Now is also the time to strengthen your defenses and test your digital and operational resilience for what promises to be the most challenging decade yet for cybersecurity. 

Guard against exploitation of these vulnerabilities amid fresh geopolitical tensions

Rising geopolitical tensions and the 2020 US elections could affect the exploitation of these vulnerabilities. Earlier in January, we published guidance following an alert from US-CERT on the potential for a cyber response to recent geopolitical events. Organizations concerned about being affected by this should understand the actors likely to be involved and the company’s potential vulnerability to the types of attacks these actors are likely to carry out. They should then rapidly mobilize targeted activities to shore up relevant security capabilities.

What you should do to address these vulnerabilities

Short-term actions

1. Re-engage with your executive business leadership.
   Provide this key message: Threats are coming more quickly than ever. We're monitoring the situation and have a plan to address it.
2. Understand and re-assess your organization's unique threat profile.
   • Are you more likely to be targeted by nation-state actors because you are part of US critical infrastructure or somehow connected to national interests?
   • Which of the vulnerable technologies described above do you use?
   • Do you have other known vulnerabilities that you haven’t addressed?
3. Adopt a state of heightened awareness.
   Minimize coverage gaps in your personnel availability, consume relevant threat intelligence such as Cybersecurity and Infrastructure Security Agency (CISA) alerts promptly and consistently and update your emergency call trees.
4. Increase organizational vigilance. Ensure information security personnel are monitoring key internal security capabilities and that they know how to identify anomalous behavior. Flag any known Iranian indicators of compromise and tactics, techniques and procedures for immediate response.
5. Organize a “swat team.” The team’s mission is to deploy patches and interim mitigations such as updating detection tools and techniques used by the attackers. Your team can do this by writing custom detection use cases and rules based upon the advisories listed above.

Longer-term considerations

1. Know your assets, interdependencies and critical functions. Step one in building resilience against operational and IT disruptions is to have real-time visibility into your assets, interdependencies and critical functions. Position your organization to catch potential disruptions before they happen.
2. Implement defense in depth, with an emphasis on shoring up these capabilities:
   • Prevent malicious files from being delivered via phishing emails by restricting the file types permitted by email and web filtering tools
   • Restrict what can be executed on workstations, including scripts (e.g., PowerShell, HTA and CHM files) and untrusted macros in Microsoft Office files
   • Prevent the abuse of compromised credentials by deploying multi-factor authentication on all externally accessible services, critical internal services and services used by managed service providers to access internal systems
   • Protect domain admin accounts by onboarding them onto privileged access management solutions and limiting their use
   • Limit the ability of attackers to gain administrative access to systems by restricting membership of local admin groups and setting unique random passwords on default local admin accounts
   • Protect (typically highly privileged) service accounts by ensuring these have strong passwords and are prevented from logging in interactively
   • Limit attackers’ ability to access sensitive data by restricting access to open network shares and other potentially sensitive data stores (e.g., intranet, internal wikis and file servers)
   • Improve detection of and response to attacker activity by deploying additional security tools such as endpoint detection and response technology and anti-virus products with support for the Windows Anti-Malware Scan Interface
3. Continue to enhance patch and vulnerability management processes.
   Make sure you are having discussions with leadership and with partners and suppliers. The case of vulnerabilities in medical devices, for example, points to the shortsightedness of dealing with vulnerability management as an IT problem alone.
4. Engage in industry collaboration and information sharing.
5. Be ready with response and recovery plans. Use these new 2020 challenges as an occasion to double down on building resilience into your organization.