IT Security Risks Associated with Web Servers and Frameworks For Mitigation

The purpose of risk management is to understand risk an organization faces. This is well understood by senior officers in a corporation when it is about threats to revenue; however, this knowledge falls short when it comes to operational risk (Grobler, 2018). Then, when it comes to cyber risks it is seldom understood, if at all by senior executives and board members (Grobler, 2018). This is due to the complexity of cyber threats and the plethora of threat actors, each with varying tactics, techniques and procedures (Grobler, 2018). This is even further exacerbated by the fact there is blurring of lines between nation state actors and criminal enterprises (Grobler, 2018). Combine this with growing sophistication of malware, there is no wonder understanding risks is hard for non-technical organizational leadership (Grobler, 2018).

            Managing risk is today’s world is even more complex than ever before (Serafin, 2013). Besides the traditional risks of operations, financial and compliance, it also includes strategic risks (Serafin, 2013). Strategic risk has now become a focus. In today’s always on and fast news cycle environment, organizations do not have the traditional news cycle to determine what to do and respond (Serafin, 2013). In the current environment, organizations need an immediate response (Serafin, 2013). This forces greater preparation and understanding of the risks facing an organization (Serafin, 2013). This has shifted the focus on strategic risks (Serafin, 2013). Most of organizations are looking at strategic risks through the lens of any major risks that could affect the organization’s long-range positioning and performance (Serafin, 2013). This isn’t about if a strategy fails but will the overall strategy of the organization fail (Serafin, 2013). Operational risks are those that would keep an organization from carrying out their strategic plan (Serafin, 2013). The financial risks are about liquidity, credit risks, valuation, market share and financial reporting (Serafin, 2013). Compliance risks are about regulatory and legal risks and ensuring the organization adheres to them (Serafin, 2013).

            Reputational risks have risen to the biggest risk concern for most of organizations (Serafin, 2013). This is largely to the prevalence of social media (Serafin, 2013). Social media is one of the factors driving the need to have response to problems that arise (Serafin, 2013). Organizations have a harder time controlling perceptions due to the speed of social media (Serafin, 2013). New technologies are not leveling off or slowing, they are growing in speed and reach (Serafin, 2013). Therefore, it will continue to get harder for organizations to keep much less control their perception (Serafin, 2013).

            Most organizations have a need to collect data from customers and business partners. This is usually accomplished through the help of web servers. Web servers serve as the interface. They also house collected data and are networked with some of the most sensitive data within an organization. This makes them targets of malicious actors (Mohammad, 2016). Web servers can be hardware, software or both working together (Mohammad, 2016). For hardware, web servers are computers that store web server software and associated web files such as HTML documents, Cascading Style Sheets and JavaScript files (Mohammad, 2016). The software includes several components that control how users access the web files (Mohammad, 2016). The files on a server are read through the use of a web browser such as Microsoft Edge, Chrome, Firefox, and Opera (Mohammad, 2016). If the web server is using a database of some kind to take in data from customers or business partners, it then becomes a highly sought-after target by malicious actors. These databases are usually networked into the organization and become one of the many ways in which a malicious actor can gain a foothold inside an organization in preparation for lateral movement to further compromise of an organization (Mohammad, 2016).

            There are numerous methods for attacking web servers (Mohammad, 2016). These include URL interpretation attacks, input validation attacks, SQL injection attacks, impersonation attacks and buffer overflow attacks (Mohammad, 2016). These methods allow the malicious actor numerous attack vectors to gain the foothold required to compromise and breach a network (Mohammad, 2016).

            The URL interpretation attack, sometimes called a URL poisoning attack, on a web server is conducted by manipulating the URL so information beyond the URL can be discovered (Mohammad, 2016). These attacks are often successful against CGI-based websites (Mohammad, 2016). An example of this kind of attack would be when an attacker goes to a website that requires a login and selects the forgot password button (Mohammad, 2016). After answering the security question, the server will verify the information in the database (Mohammad, 2016). The URL once read can be used to try and gain access to information from another user (Mohammad, 2016). This type of attack can be prevented by implementing a vendor supplied patch or fix and an in-depth verification of web server configurations (Mohammad, 2016).

            Input validation is another type of attack on a web server (Mohammad, 2016). This is type of attack is when an attacker executes injected code on a web or database server (Mohammad, 2016). When an attacker injects JavaScript code to bypass the client-side checking (Mohammad, 2016). Data sent to a web server can be in a variety formats which include URL, HTTP headers, POST requests and cookies (Mohammad, 2016). If the code used on the webserver was negligent then it may lead to input validation attacks (Mohammad, 2016). The only way to counter these types of attacks is coding best practices for validating inputs such as data types, data ranges and buffer sizes to just name a few (Mohammad, 2016).

            Another input type of attack is the SQL injection attack (Mohammad, 2016). This method tries to modify or extract information from a database (Mohammad, 2016). The database can be manipulated by SQL scripts either by authorized users or threat actors who intend to use these same techniques with malicious intent (Mohammad, 2016). The primary target for this kind of attack are e-commerce websites that have large databases of customer data that includes credit card information (Mohammad, 2016). These kinds of attacks can have disastrous consequences for a company (Mohammad, 2016). An SQL injection attack has no easy mitigation (Mohammad, 2016). It requires a thorough source code review (Mohammad, 2016). Other principles such as least privilege should also be considered (Mohammad, 2016). Deleting redundant and unnecessary database users and any procedures should be well-thought-out (Mohammad, 2016). These are just some of the review suggestions.

            Impersonation attack is carried out by an attacker who is spoofing an IP address that has access to the web server (Mohammad, 2016). Therefore, this kind of attack is also known as an IP spoofing attack (Mohammad, 2016). This attack requires special software that allows the attacker to create an IP packet that appears to be from another IP that is reserved for authorized users (Mohammad, 2016). This exploits vulnerabilities in authentication protocols to gain access. Countering these attacks are done by restricting web configurations (Mohammad, 2016). The use of a firewall to track source IP from where the request is being conducted is also a best practice (Mohammad, 2016). Cookies should also be obfuscated so it isn’t possible to manipulate them (Mohammad, 2016).

            Another attack vector is the buffer overflow attack (Mohammad, 2016). This happens when an attacker deliberately overflows memory that is reserved for user inputs (Mohammad, 2016). These attacks are conducted for a denial of service (DoS) or to inject executable code into the memory in hopes it will be executed, thereby, giving the attacker access (Mohammad, 2016). The outcome is dependent on the return address specified by the attacker (Mohammad, 2016). After the buffer overflow causes a system crash and upon recovery may see the injected code as within parameters, thus executing the attackers code (Mohammad, 2016). The best countermeasure for this attack is a vendor supplied corrective action or patch (Mohammad, 2016). Like many of the previous attack vectors, a thorough review of the code is also a good first countermeasure (Mohammad, 2016).

            The last attack vector that’ll be discussed, but not the last one available to attackers, is the denial of service attack (Mohammad, 2016). This is where an attacker tries to keep legitimate users from using the web server (Mohammad, 2016). This is accomplished by multiple methods. One previously presented is the buffer overflow (Mohammad, 2016). As previously stated, a buffer overflow causes a web server to crash, thus becoming unusable (Mohammad, 2016). Other methods for causing a DoS against a web server include sending invalid input data that causes application termination, flooding the web server with automated request which causes it to crash (Mohammad, 2016). Mitigating DoS attacks is possible by using a server firewall that inspects the entire HTTL traffic and stops any data packet that appears malicious or generating from an unauthorized source (Mohammad, 2016). There are also vendors that can assist with DoS mitigation (Mohammad, 2016).

            Attack vectors on web servers are mitigated with the appropriate configuration and procedures applied. How does an organization ensure they are following best practices and not missing something in their configurations (Mohammad, 2016)? This is accomplished using standards. Some of these standards are ISO 27001/27002 and COBIT 5.

            The ISO 27001/27002 standard is built for cyber security. It was based on the U.K.’s BS7799-2 standards with additional enhanced content (An Introduction To ISO 27001 (ISO27001), 2013). This standard provides requirements for an Information Security Management System. ISO 27001 (An Introduction To ISO 27001 (ISO27001), 2013). The first standard in 2005 was set against the “Plan-Do-Check-Act” model (An Introduction To ISO 27001 (ISO27001), 2013). The subsequent version from 2013 has more emphasis on measuring and evaluating how well an organization’s ISMS performance (An Introduction To ISO 27001 (ISO27001), 2013). ISO 27002 outlines hundreds of potential controls and control mechanisms within ISO 27001 (Introduction To ISO 27002 (ISO27002), 2013). ISO 27002 is details the controls of the overall guidance of ISO 27001 (Introduction To ISO 27002 (ISO27002), 2013). It gives the organization the guidance to ensure the corrective actions are taken to mitigate threats such as the web server threats described above. This gives the organization the knowledge to know where to ensure everything is considered to mitigate threats (Introduction To ISO 27002 (ISO27002), 2013).  

            COBIT 5 is another framework to use in cyber security (Garsoux). It was developed by ISACA to assist organizations in bringing order to a multitude of complex frameworks and be able to get value from them. It also helps in supporting all stakeholders in an organization to protect assists, so value can be derived from them (Garsoux). COBIT 5 is a comprehensive approach to IT management (Garsoux). This assist in the overall management of IT security to mitigate risks (Grobler, 2018).

            These frameworks are not exclusive but inclusive. They are often used together. Some organizations have used COBIT frameworks as the overall guidance, the ‘wrapper’ for the other frameworks (Frisken, 2015). Then the ISO 27001 can be used to get deeper into the how an organization will use the security policies and then use the ISO 27002 to further define the exact procedures to follow (Frisken, 2015). This way, the standards form an all-encompassing methodology of security so attack such as those on web servers are mitigated (Frisken, 2015).

References

An Introduction To ISO 27001 (ISO27001). (2013). Retrieved from The ISO 27000 Directory: http://www.27000.org/iso-27001.htm

Frisken, J. (2015). Leveraging COBIT to Implement Infromation Security. ISACA.

Garsoux, M. (n.d.). COBIT 5 ISACA's new Framework for IT Governance, Risk, Security and Auditing. Retrieved from Qualified Audit Partners: http://www.qualified-audit-partners.be/user_files/QECB_GLC_COBIT_5_ISACA_s_new_framework_201303.pdf

Grobler, J. (2018). Cyber risk form a chief risk officer perspective. Journal of Risk Management in Financial Institutions, 125-131.

Introduction To ISO 27002 (ISO27002). (2013). Retrieved from The ISO 27000 Directory: http://www.27000.org/iso-27002.htm

Mohammad, A. (2016, February 19). Top 10 Web Server Attacks: Impact And Prevention. Retrieved from Theem'on: https://theemon.com/top-10-web-server-attacks-impact-and-prevention/

Serafin, T. (2013). Exploring Strategic Risk. Forbes Insight.

Phishing Attacks

Phishing Attacks

Phishing is a prevalent means of initial attack for most malware campaigns. Phishing consists of technical and social engineering techniques to get a victim to infect themselves by interacting with a phishing e-mail to initiate processes for the malware to work.  Often this is enabling macros in Microsoft Office documents (Aleroud & Zhou, 2017). These documents often invoke code (JavaScript, VBA, PowerShell, etc.) to further infect the system and gain a foothold (Aleroud & Zhou, 2017).

Before looking at phishing messages a brief analysis of the server and client sides involved in email communication is necessary. E-mails start off being created on a computer’s mail program (Outlook, Mail, G-mail, Hotmail, etc.) and is sent to the sender’s mail server (sender) (Chiew, Yong, & Tan, 2018). The server then sends the message through the network (internet) to the recipient’s mail server (receiver). The receiver’s e-mail server pushes the message to the client’s endpoint for viewing in its e-mail program (see Figure 1) (James, 2005).

 Figure 1: E-mail pathway

Phishing e-mails are come in different types for similar but different purposes. The table below defines the most common types of crimes committed by sending phishing e-mails (James, 2005).

Some Types of Phishing:

	Phishing/Spam Traditional malicious e-mail for a campaign that uses the “spray and pray” methodology, which is to send the phish to as many people as possible.		Spear Phishing Unlike the traditional phishing e-mail, spear phishing is targeting specific individuals. While this requires more research on the attacker’s part, it comes across more believable and increases the chance or success.
	Vishing (Voice Phishing) The attacker in vishing needs to conduct social engineering attacks to get the victim to dial a number where the attacker tries to gather credit card information. This technique uses spoofed caller ID.		Smishing (SMS Phishing) The smishing attack is conducted by sending a link through SMS to a spoofed website.

Phishing can be used to commit crimes against unaware victims these crimes usually involve some type of credential stealing to take over accounts or identities. Some examples of crimes committed by these malicious actors using e-mails are (James, 2005):

	Identity Theft All phishing attacks are a type of identity theft. However, some are specific like the ones listed in this table while other criminals use the identity theft for other types of crimes. These attacks try to get the victim to hand over their personal identifiable information.		Credit Card Scams These scams try to get the victim to input or give away their credit card account information. These attacks are similar to bank fraud.
	Bank Fraud Malicious actors use phishing to infect the victim with banking a Banking Trojan to steal account credentials which allows them full access to the victims account.		Account Takeover Its not just financial institutions being affected.  Other industries and types of accounts are also under attack. These include

Not all crimes are just what happens when phishing is sent to a victim. Some crimes use phishing to assist in conducting the crime. Some examples of crimes committed by these malicious actors using e-mails are (Chiew, Yong, & Tan, 2018):

	Espionage Espionage is often conducted by getting a foothold into a network and then using other hacking techniques to move laterally gaining more access. This is usually conducted by nation states against another nation state but could be corporate espionage where one corporation is spying on another for competitive advantage.		Stealing Intellectual Property Like espionage, stealing intellectual property is also conducted through numerous attack vectors, one of which is phishing. While espionage is to gain information, stealing of intellectual property can also be straight stealing. This can be from criminal organizations, corporations or nation state actors
	Use of phishing for a pivot point Using phishing to gain a foothold or build trust with a victim as a jumping off point to gain further access either in the virtual or physical world. Usually, this is to steal anything to sell for profit.		Cryptomining Using phishing to gain foothold into network to gain access to servers or other computer resources to mine cryptocurrencies.

Brief analysis of an email spoofing

Most phishing incorporates spoofing e-mail addresses, websites or both (Chiew, Yong, & Tan, 2018). A recent campaign assessed as being perpetrated from Russia first sends the victim spoofed e-mails with a malicious PDF attachment (see Attempt 1 below). When that didn’t work the malicious actor sent a spoofed Microsoft Office 365 message (see Attempt 2 below) to try and get the victim to click on a malicious link. Since these were back to back this campaign is assessed as targeted. Especially since the indicators of compromise are associated with Russian state actors and were targeting U.S. defense contractors. 

Below are common tools that are used to investigate a cybercrime involved in email communication or committed by sending emails and determine the e-mail is malicious  (Aleroud & Zhou, 2017).
  

	User Training Users are the first line of defense and sometimes the last. The best way to defend against phishing is educated users.		Honeypots Security devices that trap information regarding attacker tactics, techniques and procedures. This allows researchers to analyze current attack methodologies.
	Profile Matching Countermeasures using profile matching use information such as URLs and domain names, their credentials and characteristics to create a feature-based profile. This is then matched against known bad profiles.		Ontology Ontology is a model of concepts and semantic association among those concepts. New terms, phrases or expression can be modeled as concepts found in phishing can be modeled as concepts. This allows for better detection of sophisticated phishing that bypasses the traditional anti-phishing techniques.

As previously stated, the best way to defend against phishing is user training (Jensen, Dinger, Wright, & Thatcher, 2017). Users are the weakest link and the first line of defense against phishing attacks. Training users to understand e-mail spoofing which includes how to look up header information and decipher it is a good first start (Jensen, Dinger, Wright, & Thatcher, 2017). There are plenty of resources to accomplish this.

Knowing how to read a header of an e-mail is also useful (see table below for parts and definition of a header) (Jensen, Dinger, Wright, & Thatcher, 2017). Knowing where to look for information may provide the receiver with information to confirm the e-mail is malicious.

Derived from:  https://mediatemple.net/community/products/dv/204643950/understanding-an-email-header 

Training users to hover over links to see what the link is, is also a good practice and an easy way to pick up on the deception (see example below). 

There are numerous laws that outlaw this phishing activity. Two of these laws are the Anti-phishing Act of 2005 and 18 U.S.C. Section 1028 are used in the U.S. to deter this activity and fight cybercrime.

Anti-phishing Act of 2005 (congress.gov) 

On February 28, 2005, introduced the Anti-Phishing Act of 2005. As reported on the Congress.Gov website the act amends the federal criminal code to criminalize internet scams involving fraudulently obtaining personal identifiable information (PII). The summary on the congress.gov websites states:

This act Imposes a fine or imprisonment for up to five years, or both, for anyone who knowingly engages in any fraud activity or identity theft under Federal or State law. This is defined by:

1. Creates or procures the creation of a spoofed website or domain name. 
2. Uses that website or domain name to steal credentials from any person

This Act also imposes a fine or imprisonment for up to five years, or both, for anyone who knowingly engages in fraud or identity theft under Federal or State law sends a phishing message that:

1. Falsely represents itself as a legitimate business 
2. Includes an Internet location or linking users to an online that falsely purports to be associated with a legitimate business 
3. Solicits means of identification from victims

18 U.S.C. Section 1028 (Link to definition)

Passed as part of the Identity Theft and Assumption Deterrent Act in 1998, it made identity theft a federal crime. However, this requires a predicate offense. This means there as to be another crime and in committing that crime also commits identity theft. Under this Act, a person is guilty if he/she knowingly transfers, possess or uses without authority (permission) any identification of another person with intent to commit unlawful actions, crimes.

Academic References

leroud, A., & Zhou, L. (2017). Phishing environments, techniques, and countermeasures: A survey. Computer and Security, 160-196.

Chiew, K. L., Yong, K. S., & Tan, C. L. (2018). A survey of phishing attacks: Their types, vectors and technical approaches. Expert Systems With Applications, 1-20.

James, L. (2005). Phishing Exposed. Rockland, MA: Syngress Publishing, Inc.

Jensen, M. L., Dinger, M., Wright, R. T., & Thatcher, J. B. (2017). Training to Mitigate Phishing Attacks Using Mindfulness Techniques. Journal of Management Information Systems, 597-626.