Guest OpEd by Tony Cole, Chief Technology Officer, Attivo Networks

With attackers increasingly targeting government agencies and contractors, a background in homeland security is a handy thing to have—and my homeland security career has more or less run the gamut.

For starters, I spent considerable time as an army cyber operator, building operations in several different areas for the military—including a stop at the Pentagon, where I initially started working with cyber honeypots. In some ways, this was my introduction to the idea of “deception technology,” though deception has come a significant way from its honeypot days.

When I retired from the military, I leveraged that experience to join and help the first commercial honeypot company, Recourse Technologies, where I stayed for a number of years after Symantec acquired it.

For a number of years at Symantec, and then at McAfee, I built up the global government consulting team, where I ran global government and critical infrastructure consulting.

I then moved on to FireEye, as their Global Government CTO which involved consulting with the United States government, its allies, and their critical infrastructure companies worldwide to help them understand the digital threats they faced more thoroughly.

This also helped me better grasp the perspectives of CISOs and security teams around the globe worried about being attacked by nation-state-backed adversaries and financially motivated attackers.

This experience ultimately led me to where I am today: Chief Technology Officer of Attivo Networks, the industry expert in preventing identity privilege escalation and detecting lateral movement attacks. I was eager to return to the deception space, as well as to expand beyond it.

I hoped I could leverage my 38 years of experience to help Attivo and its customers look at things a little bit differently. Too often, defenders don’t have the requisite toolsets to identify and counter today’s most sophisticated attacks—and our goal is to change that.

Critical Homeland Security Threats Loom

Recent incidents like the Colonial Pipeline hack highlight the need for those toolsets.

These incidents have underscored the degree to which government and government-adjacent organizations remain particularly vulnerable to cyberattacks sponsored by hostile nation-states.

Countless defense contractors, energy companies, and providers of other critical services do not have the capabilities (or, often, the expertise) needed to defend themselves against sophisticated attacks.

Unfortunately, simply asking Russia, China, North Korea, and other potential aggressors to leave those organizations alone is not a viable option. Espionage has been around for centuries, and it isn’t going to stop now.

But like any large bureaucracy, change comes slowly within the government—and making even minor, security architecture changes will take even longer.

To further complicate matters, for many years, there was no viable career path for cybersecurity within government, which has led to a lack of both the resources and expertise needed to solve today’s problems.

Worse still, it can be difficult for the government to hold onto expertise, as top talent tends to make its way to more profitable commercial ventures. More effective resourcing is needed, but those shifts can also take time.

Technological pitfalls are also essential to consider. Investments in operational technology (OT) are expected to be long-term investments. After all, replacing an industrial control system or air traffic management system is not as simple as swapping out laptops every two or three years.

These systems are expected to be in place for decades, which means the developer or manufacturer may never address vulnerabilities, especially since some of them may not even have a system to provide updates.

Unfortunately, adversaries will always be looking for potential openings, and the longer a device or system is in service, the greater the likelihood that an attacker will find one of these vulnerabilities.

Nation-states will not stop attacking one another—especially since the internet has made espionage both cheaper and more asymmetric. North Korea might not be able to take on the US directly, but they can level the playing field through cyber warfare.

With that in mind, the need for tools like cyber deception and identity detection and response (IDR) technology has never been greater.

Defenders, particularly those in the orbit of government and homeland security agencies, need solid in-network defenses that can identify and derail attackers as they attempt to move throughout the network—even if those attacks are using valid credentials.

The evolution of both attack tactics and the strategies needed to combat them has brought about significant changes in the cybersecurity industry.

The Evolution of Deception Technology

Even though my introduction to deception technology was via honeypots, it is essential to emphasize that deception has come a long way since then.

The misconception persists that deception technology and honeypots are interchangeable, but today’s technology cloaks the network in an entire deceptive fabric.

Attivo jumped into the space as the leader in deceiving and detecting adversaries from the network side, focused on identifying lateral movement and privileges escalation while leading adversaries into a decoy environment.

And because the attackers don’t know that the environment they find themselves in isn’t real, defenders can study their tactics as they attempt to continue their attacks. It’s safe to say that this goes much, much further than a traditional honeypot.

Over the past several years, it has been advantageous to see deception technology take a more prominent place within cybersecurity discourse.

The National Security Agency (NSA) recently released a new issue of The Next Wave, its review of emerging technologies, that focused heavily on deception.

One section, titled ‘Building the Science of Defensive Cyber Deception,’ touched on network deception and host-based deception, two of Attivo’s most critical areas of focus.

Initially focused primarily on the network side, Attivo has steadily expanded to incorporate most host-based offerings, engaging and explicitly interacting with adversaries through tools like ADSecure.

The NSA’s decision to foreground research into deception technology is incredibly validating.

(Attacking Active Directory and obtaining domain admin-level access is one of the attackers’ primary objectives. Active Directory and Domain controllers are prime reconnaissance targets to hunt for privileged credentials and privileged access. See how Attivo Networks provides innovative solutions for assessing Active Directory cyber hygiene, identifying specific domain, computer, and user-level risks, and detecting live attacks. Courtesy of Attivo Networks and YouTube.)

And the NSA is not alone. MITRE recently released MITRE Shield, a new framework focused on active defense.

Deceptive techniques featured heavily in MITRE Shield, and we were pleased to discover that Attivo’s offerings cover 27 of the 33 defensive techniques identified by MITRE, providing an active defense for 123 of the 190 MITRE Shield use cases.

The National Institute of Standards in Technology (NIST) has issued similar praise, through a release of controls via NIST Special Publication 800-160 Vol. 2 focusing on resilient cyber systems.

The publication provides guidance for organizations seeking to detect attackers more accurately early in the attack cycle, identifying a wide range of potential security gaps that Attivo’s deception technology offerings are well-positioned to plug.

Identity Detection and Active Directory Protection

The recent ransomware wave allowed Attivo to broaden the scope of our product offerings to further empower defenders on the endpoint side of the equation.

Active Directory (AD) is a frequent target for attackers looking for ways to escalate their attacks—after all, the technology is used by over 90% of global Fortune 1,000 companies. Despite this—and despite AD’s high level of vulnerability—AD protection remains a dangerously underserved area of defense.

To combat this, Attivo developed ADSecure. When an adversary compromises an endpoint, they will look for high-value assets.

Ultimately, they want to find the most valuable data before starting to steal or encrypt anything so that they can blackmail the target more effectively. A significant percentage of attackers will query AD, and, when they do, ADSecure will provide misleading information back to them.

Because the attacker cannot be sure what is real and what isn’t, this slows their attack and gives defenders more time to detect them.

The ability to lock down attack paths has also helped defenders take a step forward.

Attivo’s ADAssessor technology does just that, enabling defenders to identify things like configuration errors and potential attack paths through AD, while also helping them clean up exposed credentials across the network environment so adversaries can’t make use of them.

Before this technology allowed defenders to automate some elements of AD protection, cleaning up AD was a time-consuming manual process.

(Seeing as over 90% of all Global Fortune 1000 organizations use AD to control access and deliver services. Ray Kafity, VP of Attivo Networks, shares the ‘why’ and ‘how’ on the importance of protecting Active Directory. Courtesy of Attivo Networks and YouTube.)

Given AD’s relative vulnerability and the high percentage of attacks that attempt to exploit it, ADSecure and ADAssessor have significantly boosted defenders’ ability to remain secure against today’s most advanced threats.

But it isn’t enough. Attivo has steadily grown its portfolio of products, expanding beyond the deception space and into areas like identity protection.

Gartner has estimated that “75% of security failures will result from inadequate management of identities, access, and privileges” by 2023, and helping customers avoid the dangers associated with ineffective identity management has been an essential part of Attivo’s evolution.

Our most recent offering, IDEntitleX, is designed to deliver greater visibility and reduce the attack surface for identities and entitlements in the cloud.

Today’s organizations are adopting cloud infrastructure at an incredible rate, and both human and non-human identities continue to expand rapidly. And with so many opting for a multi-cloud approach, the ability to have a unified view of identities and exposures across all environments is more critical than ever.

The 2021 Verizon DBIR reported that 61% of all breaches involve credential data, further underscoring the threat.

Advanced Detection Tools Have Become Essential

Today’s threats have grown increasingly advanced, and both government agencies and their partners find themselves in the crosshairs of dangerous and well-funded adversaries.

Today’s cybercriminals are both willing and able to move laterally throughout networks, taking their time to identify the most valuable data to steal, or the most vulnerable systems to damage.

Sometimes these attacks come in the form of ransomware, but incidents like the recent Oldsmar, FL water system hack demonstrate that they can have even more dangerous results.

The NSA, MITRE, and NIST have all recognized the value of deception, which is highly encouraging.

And as a growing number of organizations recognize the need for more effective Active Directory and identity protections, products like ADSecure, ADAssessor, and IDEntitleX are helping them detect and prevent attackers from escalating their attacks into serious breaches.

With nation-state attacks increasing and vulnerable organizations looking to shore up their networks with reliable and easy-to-use security tools, deploying in-network defenses designed to detect and derail attackers early in the attack cycle is increasingly essential.

About the Author

Tony Cole has more than 35 years’ experience in cybersecurity and today is the Chief Technology Officer at Attivo Networks responsible for strategy and vision.

Prior to joining Attivo Networks, he served in executive roles at FireEye, McAfee, Symantec, and is a retired cyber operator from the U.S. Army.

Mr. Cole previously served on the NASA Advisory Council and the (ISC)² Board of Directors as Treasurer and Chair of Audit and Risk.

Today he serves on the Gula Tech Foundation Grant Advisory Board helping the Foundation give back to the community to drive a more diverse cyber workforce. 

In 2014, he received the Government Computer News Industry IT Executive of the Year award, and in 2015 he was inducted into the Wash 100 by Executive Mosaic as one of the most influential executives impacting Government.

In 2018 he was awarded the Reboot Leadership Influencer Award in by SC Media.

(Sophisticated attackers are targeting credentials to escalate privileges. See how Attivo Networks provides an innovative solution that finds, cleans and monitors exposed credentials to reduce attack surfaces. Courtesy of Attivo Networks and YouTube.)

To Learn about Attivo Networks Federal solutions, please visit http://www.attivonetworks.com/government.

Attivo Networks®, the leader in identity detection and response, and Multiple 2020 ‘ASTORS’ Homeland Security Award Winner, delivers a superior defense for preventing privilege escalation and lateral movement threat activity, with customers worldwide relying on their ThreatDefend® Platform for unprecedented visibility to risks, attack surface reduction, and attack detection.

The company’s portfolio provides patented innovative defenses at critical points of attack, including at endpoints, in Active Directory, and cloud environments. Data concealment technology hides critical AD objects, data, and credentials, eliminating attacker theft and misuse, particularly useful in a Zero Trust architecture.

Bait and misdirection efficiently steer attackers away from production assets, and deception decoys obfuscate the attack surface to derail attacks.

Forensic data, automated attack analysis, and automation with third-party integrations serve to speed threat detection and streamline incident response.

To Learn More about Attivo Networks full portfolio of superior defense solutions for preventing privilege escalation and lateral movement threat activity, please visit attivonetworks.com.

American Security Today’s ‘ASTORS’ Homeland Security Awards program is today in its Sixth Year and continues to recognize the Outstanding Innovations of top firms and agencies in the Homeland Security and Public Safety fields.

The 2021 ‘ASTORS’ Awards Program is Proudly Sponsored by AMAROK, Fortior Solutions  and SIMS Software, along with Returning Premier Sponsors ATI Systems, Attivo Networks, Automatic Systems, and Reed Exhibitions.

Nominations are currently being accepted for the 2021 ‘ASTORS’ Homeland Security Awards at https://americansecuritytoday.com/ast-awards/.

Comprehensive List of Categories Include:

Access Control/ Identification	Personal/Protective Equipment	Law Enforcement Counter Terrorism
Perimeter Barrier/ Deterrent System	Interagency Interdiction Operation	Cloud Computing/Storage Solution
Facial/IRIS Recognition	Body Worn Video Product	Cyber Security
Video Surveillance/VMS	Mobile Technology	Anti-Malware
Audio Analytics	Disaster Preparedness	ID Management
Thermal/Infrared Camera	Mass Notification System	Fire & Safety
Metal/Weapon Detection	Rescue Operations	Critical Infrastructure
License Plate Recognition	Detection Products	And Many Others!

COVID Innovations

And Many Others!

 

Don’t see a Direct Hit for your Product, Agency or Organization?

With the unprecedented occurrence of the COVID-19 pandemic, the focus of the safety and security industries has realized the need to increase innovations to address the daily growing challenges.

As such AST aims to make sure these firms and professionals are reflected in the 2021 ‘ASTORS’ Awards Program, so we’d like to encourage you to submit appropriate categories recommendations and include COVID-19 Frontline Professionals in your Nominations to see that these Professionals, Facilities, and Vendors receive the Recognition they Deserve!

Submit your category recommendation for consideration to Michael Madsen, AST Publisher at: mmadsen@americansecuritytoday.com.

Register for the 2021 ‘ASTORS’ Luncheon Today

At ISC East 2021 you with the opportunity to interact with a broad array of security industry professionals.

ISC East works closely with other businesses in the security and public safety space to help bring together the Northeast’s largest security trade show each year.

In collaboration with premier sponsor SIA (Security Industry Association) and in partnership with ASIS NYC, ISC East is proud to work with and be supported by various associations, trade publications, charities, and more.

Therefore, the ISC audience of security dealers, installers, integrators, consultants, corporate, government and law enforcement/first responder practitioners will be joined by the ASIS NYC audience of major corporate managerial-through-director-level national and global security executives.

The combination of one-on-one conversations with the industry’s top innovators,  integrators and security executives, special events, high-quality education and training, and strong support from industry associations, will allow attendees to learn and evaluate solutions from leading security exhibitors and brands. 

Your ‘ASTORS’ Awards Luncheon registration includes complimentary attendee access to ISC East – Thank take advantage of this exclusive luncheon opportunity to take a break from the show – Invite your team, guests, clients and show visitors to a lovely and affordable plated meal event in the heart of New York City, for  a fabulous networking opportunity!

Go to https://americansecuritytoday.com/product/awards-luncheon/ to secure your seat or reserve a table.

***Limited space available so Register Today. There will be no on-site registrations.

AST strives to meet a 3 STAR trustworthiness rating, based on the following criteria:

• Provides named sources
• Reported by more than one notable outlet
• Includes supporting video, direct statements, or photos

Subscribe to the AST Daily News Alert Here.