WyzGuys Tech Talk

Is the U.S. energy sector under attack? The ambitious and sophisticated exploits like this one are usually the work of a nation-state.  Who wants to turn off the lights?  Last Wednesday we took a look at the US-CERT alert warning about the ongoing cyber-attack against the U.S. electric grid, and on Friday we took a look at many of the tactics, techniques and procedures that the threat actors are using to gain access to computer networks that are some of the best secured in the world.

This alert covers the threat in great detail, and is worth a read.  There is also an extensive list of prescriptive actions that cybersecurity professionals can use to tighten network security under the section entitled “General Best Practices Applicable to this Campaign.”  As it turns  out, these best practices are applicable to any computer network, and would be effect against many attacks beyond this one.  Many of the items on this list we have recommended previously.  The following list is straight from the US-CERT report, with little editing.

• Prevent external communication of all versions of SMB and related protocols at the network boundary by blocking TCP ports 139 and 445 with related UDP port 137. See the NCCIC/US-CERT publication on SMB Security Best Practices for more information.
• Block the Web-based Distributed Authoring and Versioning (WebDAV) protocol on border gateway devices on the network.
• Monitor VPN logs for abnormal activity (e.g., off-hour logins, unauthorized IP address logins, and multiple concurrent logins).
• Deploy web and email filters on the network. Configure these devices to scan for known bad domain names, sources, and addresses; block these before receiving and downloading messages. This action will help to reduce the attack surface at the network’s first level of defense. Scan all emails, attachments, and downloads (both on the host and at the mail gateway) with a reputable anti-virus solution that includes cloud reputation services.
• Segment any critical networks or control systems from business systems and networks according to industry best practices.
• Ensure adequate logging and visibility on ingress and egress points.
• Ensure the use of PowerShell version 5, with enhanced logging enabled. Older versions of PowerShell do not provide adequate logging of the PowerShell commands an attacker may have executed. Enable PowerShell module logging, script block logging, and transcription. Send the associated logs to a centralized log repository for monitoring and analysis. See the FireEye blog post Greater Visibility through PowerShell Logging (link is external)for more information.
• Implement the prevention, detection, and mitigation strategies outlined in the NCCIC/US-CERT Alert TA15-314A – Compromised Web Servers and Web Shells – Threat Awareness and Guidance.
• Establish a training mechanism to inform end users on proper email and web usage, highlighting current information and analysis, and including common indicators of phishing. End users should have clear instructions on how to report unusual or suspicious emails.
• Implement application directory whitelisting. System administrators may implement application or application directory whitelisting through Microsoft Software Restriction Policy, AppLocker, or similar software. Safe defaults allow applications to run from PROGRAMFILES, PROGRAMFILES(X86), SYSTEM32, and any ICS software folders. All other locations should be disallowed unless an exception is granted.
• Block RDP connections originating from untrusted external addresses unless an exception exists; routinely review exceptions on a regular basis for validity.
• Store system logs of mission critical systems for at least one year within a security information event management tool.
• Ensure applications are configured to log the proper level of detail for an incident response investigation.
• Consider implementing HIPS or other controls to prevent unauthorized code execution.
• Establish least-privilege controls.
• Reduce the number of Active Directory domain and enterprise administrator accounts.
• Reset all user, administrator, and service account credentials across all local and domain systems, based on the suspected level of compromise.
• Establish a password policy to require complex passwords for all users.
• Ensure that accounts for network administration do not have external connectivity.
• Ensure that network administrators use non-privileged accounts for email and Internet access.
• Use two-factor authentication for all authentication, with special emphasis on any external-facing interfaces and high-risk environments (e.g., remote access, privileged access, and access to sensitive data).
• Implement a process for logging and auditing activities conducted by privileged accounts.
• Enable logging and alerting on privilege escalations and role changes.
• Periodically conduct searches of publicly available information to ensure no sensitive information has been disclosed. Review photographs and documents for sensitive data that may have inadvertently been included.
• Assign sufficient personnel to review logs, including records of alerts.
• Complete independent security (as opposed to compliance) risk review.
• Create and participate in information sharing programs.
• Create and maintain network and system documentation to aid in timely incident response. Documentation should include network diagrams, asset owners, type of asset, and an incident response plan.

This is a great list of best practices, even if you are not working in the targeted energy sector.  If you are attempting to strengthen your security defenses, this list is a great template to work from.  unfortunately all of these improvements cost money, and may require an increase in headcount that is not in the budget.  Often, these services, especially log analysis and incident response can be automated or handed to a third party organization that specializes in cybersecurity support.  A good place to start would be engaging a security group to run a vulnerability assessment of your network operations to reveal which of these practices are still missing on your network.

More Information:

• What Happens If the Lights Go Out?
• US-CERT Alert TA17-293A
• Symantec – Dragonfly Exploit Report