CISA Issues Mitigation Tips for Common Attack Tactics

The Cybersecurity and Infrastructure Security Agency released details for mitigating six stages of a sample attack pathway based on weaknesses identified following an annual vulnerability assessment. 

“Threat actors, with capability and intent, may be successful at compromising many agencies across multiple sectors,” analysis CISA released Thursday concluded. “Conversely, the benefit of this trend is that the high-level mitigation recommendations made by CISA may apply to many organizations.”

The six steps CISA identified along its attack pathway were initial access, command and control, lateral movement, privilege escalation, collection, and exfiltration. And the agency used scenario-based network penetration testing, web application testing, social engineering testing,  wireless testing, configuration reviews of servers and databases and detection and response capability evaluations to show how successful an adversary could be at each stage.

For example, CISA’s assessment team found that 68.2% of their successful exfiltration attempts used command and control centers adversaries establish earlier on, versus automatic exfiltration or archived data collection.

This “allowed the teams to download information without the need for establishing additional pathways and potentially alerting network defenders,” CISA said, noting “stolen information may lead to the recreation of blueprinted technologies, targeting of supply chain components, or public release of information to achieve other socio political objectives.”

Throughout the analysis, CISA specifically highlighted tactics, techniques and procedures used by Assistant Persistent Threat 39, or APT 39—the moniker used for a group associated with the Iranian government. But a CISA official told Nextgov, “there was no special reason why we used APT 39, other than that they fit the profile of a lot of the techniques we used. There are many other APTs that use similar techniques, so you could really plug and play a lot of the major APTs into the analysis.”

CISA’s analysis went into how adversaries go about setting up command and control mechanisms and ways to foil them.

“APT39 has used tools that masquerade as legitimate applications to evade detection of control communication. For example, applications posing as Mozilla Firefox or McAfee components often go undetected,” CISA said. “This use of well-known ports and protocols comprised 42% of successful attempts at establishing [command and control].” 

Mitigation measures for avoiding adversarial system takeovers the agency highlighted include, among other things: deploying signature-based intrusion detection/prevention (IDS/IPS), configuring systems to prevent the installation and execution of unauthorized applications, and using web proxies to limit reliance on external web services.  

CISA also provided lots of tips, such as the use of Domain-based Message Authentication, Reporting and Conformance—known as DMARC—with cloud providers for preventing adversaries’ initial access, noting this should be a primary goal for organizations.