DSD > Information Security > Strategies to Mitigate Targeted Cyber Intrusions > Strategies to Mitigate Targeted Cyber Intrusions

Strategies to Mitigate Targeted Cyber Intrusions

Download 35 Strategies to Mitigate Targeted Cyber Intrusions (PDF), updated October 2012

Introduction

Australian computer networks are being targeted by adversaries seeking access to sensitive information.
A commonly used technique is social engineering, where malicious 'spear phishing' emails are tailored to entice the reader to open them. Users may be tempted to open malicious email attachments or follow embedded links to malicious websites. Either action can compromise the network and disclose sensitive information.
The Defence Signals Directorate (DSD) has developed a list of strategies to mitigate targeted cyber intrusions. The list is informed by DSD's experience in operational cyber security, including responding to serious cyber incidents and performing vulnerability assessments and penetration testing for Australian government agencies.

Mitigation strategies

DSD's list of mitigation strategies, first published in February 2010, is revised for 2012 based on DSD's most recent analysis of incidents across the Australian Government.
While no single strategy can prevent malicious activity, the effectiveness of implementing the Top 4 strategies remains very high. At least 85% of the intrusions that DSD responded to in 2011 involved adversaries using unsophisticated techniques that would have been mitigated by implementing the Top 4 mitigation strategies as a package.
Implementing the Top 4 strategies can be achieved gradually, starting with computers used by the employees most likely to be targeted by intrusions, and eventually extending them to all users. Once this is achieved, organisations can selectively implement additional mitigation strategies based on the risk to their information.
This document provides information about mitigation implementation costs and user resistance to help organisations select the best set of strategies for their requirements.
These strategies complement the guidance provided in the Australian Government Information Security Manual (ISM).

Further information

Additional supporting advice is available on the DSD website:
On 24 October 2012 DSD launched a non-technical publication and accompanying video for user education, Catch Patch Match, which explains the cyber threat and how organisations can mitigate targeted cyber intrusion techniques in simple terms. The Top 4 Strategies to Mitigate Targeted Cyber Intrusions are simplified to Catch malicious software with a whitelist, Patch all applications and operating systems with updates and Match the right people with the right access.

Contact

Australian government customers with questions regarding this advice can contact DSD Advice and Assistance.

Australian businesses and other private sector organisations seeking further information should contact CERT Australia.

Mitigation strategies summary


Mitigation Strategy Effectiveness Ranking	Mitigation Strategy	Overall Security Effectiveness	User Resistance	Upfront Cost (Staff, Equipment, Technical Complexity)	Maintenance Cost (Mainly Staff)	Designed to Prevent or Detect an Intrusion	Helps Mitigate Intrusion Stage 1: Code Execution	Helps Mitigate Intrusion Stage 2: Network Propagation	Helps Mitigate Intrusion Stage 3: Data Exfiltration
1	Application whitelisting of permitted/trusted programs, to prevent execution of malicious or unapproved programs	Essential	Medium	High	Medium	Both	Yes	Yes	Yes
2	Patch applications e.g. PDF viewer, Flash Player, Microsoft Office and Java. Patch or mitigate high risk vulnerabilities within two days. Avoid Adobe Reader prior to X.	Essential	Low	High	High	Prevent	Yes	Possible	No
3	Patch operating system vulnerabilities. Patch or mitigate high risk vulnerabilities within two days. Avoid running Windows XP or earlier.	Essential	Low	Medium	Medium	Prevent	Yes	Possible	Possible
4	Minimise the number of users with domain or local administrative privileges. Such users should use a separate unprivileged account for email and web browsing.	Essential	Medium	Medium	Low	Prevent	Possible	Yes	Possible
Once organisations have implemented the top four mitigation strategies, firstly on computers used by employees most likely to be targeted by intrusions and then for all users, additional mitigation strategies can then be selected to address system security gaps to reach an acceptable level of residual risk.
5	Disable local administrator accounts to prevent network propagation using compromised credentials that are shared by several computers.	Excellent	Low	Medium	Low	Prevent	No	Yes	No
6	Multi-factor authentication especially implemented for remote access, when the user is about to perform a privileged action or access a sensitive information repository.	Excellent	Medium	High	Medium	Prevent	No	Yes	No
7	Network segmentation and segregation into security zones to protect sensitive information and critical services such as user authentication and user directory information.	Excellent	Low	High	Medium	Prevent	Possible	Yes	Possible
8	Application-based workstation firewall configured to deny traffic by default, to protect against malicious or otherwise unauthorised incoming network traffic.	Excellent	Low	Medium	Medium	Prevent	Yes	Yes	No
9	Application-based workstation firewall configured to deny traffic by default, that whitelists applications allowed to generate outgoing network traffic.	Excellent	Medium	Medium	Medium	Both	No	Yes	Yes
10	Non-persistent virtualised trusted operating environment, hosted within the internet gateway, for risky activities such as reading email and web browsing.	Excellent	High	High	Medium	Prevent	No	Yes	Possible
11	Host-based Intrusion Detection/Prevention System to identify anomalous behaviour such as process injection, keystroke logging, driver loading and call hooking.	Excellent	Low	Medium	Medium	Both	Yes	No	Possible
12	Centralised and time-synchronised logging of successful and failed computer events, with regular log analysis, storing logs for at least 18 months.	Excellent	Low	High	High	Detect	Possible	Possible	Possible
13	Centralised and time-synchronised logging of allowed and blocked network activity, with regular log analysis, storing logs for at least 18 months.	Excellent	Low	High	High	Detect	Possible	Possible	Possible
14	Whitelisted email content filtering allowing only business-related attachment types. Preferably convert/sanitise links, PDF and Microsoft Office attachments.	Excellent	High	High	Medium	Prevent	Yes	No	Possible
15	Web content filtering of incoming and outgoing traffic, using whitelisting, behavioural analysis, reputation ratings, heuristics and signatures.	Excellent	Medium	Medium	Medium	Prevent	Yes	No	Possible
16	Web domain whitelisting for all domains, since this approach is more proactive and thorough than blacklisting a tiny percentage of malicious domains.	Excellent	High	High	Medium	Prevent	Yes	No	Yes
17	Web domain whitelisting for HTTPS/SSL domains, since this approach is more proactive and thorough than blacklisting a tiny percentage of malicious domains.	Excellent	Medium	Medium	Medium	Prevent	Yes	No	Yes
18	Workstation application security configuration hardening e.g. disable unrequired features in PDF viewers, Microsoft Office applications, and web browsers.	Excellent	Medium	Medium	Medium	Prevent	Yes	No	No
19	Block spoofed emails using Sender Policy Framework checking of incoming emails, and a 'hard fail' SPF record to help prevent spoofing of your organisation's domain.	Excellent	Low	Low	Low	Prevent	Yes	No	No
20	User education e.g. Internet threats and spear phishing socially engineered emails. Avoid weak passphrases, passphrase re-use, exposing email addresses, unapproved USB devices.	Good	Medium	High	Medium	Both	Possible	No	No
21	Operating system exploit mitigation mechanisms such as Data Execution Prevention and Address Space Layout Randomisation.	Good	Low	Low	Low	Prevent	Yes	No	No
22	Computer configuration management based on a hardened Standard Operating Environment with unrequired functionality disabled e.g. IPv6, autorun.	Good	Medium	Medium	Low	Prevent	Yes	Yes	Possible
23	Server application security configuration hardening e.g. databases, web applications, customer relationship management and other data storage systems.	Good	Low	High	Medium	Prevent	Yes	No	Yes
24	Deny direct internet access from workstations by using an IPv6-capable firewall to force traffic through a split DNS server, an email server or an authenticated web proxy.	Good	Low	Low	Low	Both	Possible	No	Yes
25	Antivirus software with up-to-date signatures, reputation ratings and other heuristic detection capabilities. Use gateway and desktop antivirus software from different vendors.	Good	Low	Low	Low	Both	Yes	No	No
26	Workstation inspection of Microsoft Office files for abnormalities e.g. using the Microsoft Office File Validation feature.	Good	Low	Low	Low	Prevent	Yes	No	No
27	Enforce a strong passphrase policy covering complexity, length, and avoiding both passphrase reuse and the use of dictionary words.	Good	Medium	Medium	Low	Prevent	No	Yes	No
28	Restrict access to Server Message Block (SMB) and NetBIOS services running on workstations and on servers where possible.	Good	Low	Medium	Low	Prevent	Yes	Yes	No
29	Removable and portable media control as part of a data loss prevention strategy, including storage, handling, whitelisting allowed USB devices, encryption and destruction.	Good	High	Medium	Medium	Prevent	Yes	Possible	Yes
30	TLS encryption between email servers to help prevent legitimate emails being intercepted and used for social engineering. Perform content scanning after email traffic is decrypted.	Good	Low	Low	Low	Prevent	Possible	No	No
31	Disable LanMan password support and cached credentials on workstations and servers, to make it harder for adversaries to crack password hashes.	Good	Low	Low	Low	Prevent	No	Yes	No
32	Block attempts to access web sites by their IP address instead of by their domain name.	Good	Low	Low	Low	Both	Yes	No	Yes
33	Network-based Intrusion Detection/Prevention System using signatures and heuristics to identify anomalous traffic both internally and crossing network perimeter boundaries.	Average	Low	High	High	Both	Possible	Possible	Possible
34	Gateway blacklisting to block access to known malicious domains and IP addresses, including dynamic and other domains provided free to anonymous Internet users.	Average	Low	Low	High	Both	Yes	No	Yes
35	Selected network traffic capture to perform post-incident analysis of successful intrusions, storing network traffic for at least the previous seven days.	Average	Low	High	Low	Detect	No	No	No

Defence Signals Directorate

Reveal Their Secrets – Protect Our Own