Back in the 90’s and early 80’s, the System Administrator’s Handbook said:Filter incoming traffic.not everyone is a good person“(later coined by Gandalf)”you shall not passAs such, CIOs began tightening network fencing on every available appliance to protect against incoming (aka INGRESS) traffic.
After the first large-scale phishing campaigns in the early 2010s, it became increasingly clear that someone had to deal with employees, and more specifically, their astonishing ability to click on every link they received. I was. Outbound traffic filtering (aka EGRESS) has become an obsession. Browser security, proxies, and other popular antiviruses have become a must-have item that every consulting firm advises its clients to implement as soon as possible.
The risks were real, and the response was quite adaptive, but it also contributed to the famous “.super soldier“Stance. Am I going to face the army alone? Then I’ll dig trenches, bury my assets behind piles of software, and become a super soldier to defend my position.
But the “ground” was a moving target. SaaS, shadow IT, public cloud, temporary workloads, and telecommuting have broken down these barriers. Boundaries that were once so clear became more and more blurred. The concept of “inside” and “outside” has become ambiguous. Supersoldiers could not defend all areas simultaneously. He also faced a growing army of well-trained and heavily funded cybercriminals. Superman can no longer be everywhere at the same time.
Then came ransomware in the late 2010s and early 2020s. A very smart way to monetize your technical debt at the highest possible price. With the rise of cryptocurrencies, the same old hacking techniques are now worth platinum. Our Super Soldier suddenly became very lonely and… utterly useless.
Egress Filter Post Compromise, Ingress Filter Pre Compromise
Processing ingress traffic was not so trending at the time and should have been a closed deal. With a firewall and proper monitoring you should be fine. However, compromising a company or government agency can be done primarily using any of his three main strategies:
- Lure users and bet on weak egress filtering
- They use mass exploits like zero-days, logic vulnerabilities, weak passwords, etc. and think their ingress filtering wasn’t so smart (someone whitelisting access to ports 53, 80, 443, 465, etc.).
- It uses a targeted attack very similar to the above, but only targets one specific entity with its entire surface. 123456 expects “protected” RDP instead of phishing extensively with a Gatling gun. Again, it’s an Ingress handling issue.
IBM X-force reports that approximately 47% of initial breaches are related to exploitation of vulnerabilities, with phishing accounting for 40%. Add 3% for stolen credentials and 3% for brute force, and the weight of an Ingress attack is 53% in terms of the probability of an external-to-internal compromise. (I didn’t count the 7% of removable media because, let’s be honest, if your users are stupid enough to plug in unknown USBs and your policy allows it, that’s what I call digital Darwinism is another problem called
Once a user is infected with malware, the game is to avoid making the user’s workstation a hub for cybercriminals. Now, this is where exit filtering begins. OK, it’s too late, it’s compromised, but let’s mitigate the fallout to prevent the station from not only being further exploited within her 1/ walls, but also being reconnected to 2/ command and control. Criminal center.
Ingress traffic needs to be protected now. This is not only the cause of initial breaches, but also because the perimeter is bigger and more diverse than ever before. Today, the corporate “perimeter” is the HQ LAN and DMZ, a few host machines in a data center, and eventually multiple offices with VPNs, remote workers, cloud workloads, supply chain providers, and SaaS It is often composed of tools. Monitoring everything is a tall order, especially when SIEM vendors want to monetize every log they store. It’s unrealistic to think that the Egress CTI or tools alone will protect you.
From reactive to proactive
Ingress traffic processing is something that should have been handled in the 90’s, so it’s not as fashionable today. But crowdsourcing information about Ingress attacks and making her CTI data curated enough to be leveraged into appliances is the ultimate win for the overall security posture. And who do you think is running crowdsourced security based on his DevSecops tools that are open source?
That is correct! Crowdsec! Learn how to secure your Ingress traffic here.
Note: This article has been written with expertise and care by Philippe Humeau, CEO of CrowdSec.
