Transcription
Sensitive Data at Risk:The SANS 2017 Data Protection SurveyA SANS SurveyWritten by Barbara FilkinsAdvisor: Benjamin WrightSeptember 2017Sponsored byInfoblox 2017 SANS Institute
Executive SummaryRansomware, insider threat and denial of service are considered the top threats tosensitive data by respondents to the 2017 SANS Data Protection Survey. While themajority of respondents indicate they escaped actual compromise of sensitive data,enough respondents did lose sensitive data to provide valuableKey Findings78lessons from these events.% report two or more threats occurring in past12 monthsUser credentials and privileged accounts represented the mostcommon data types involved in these breaches, spotlighting the factthat access data is prized by attackers. It is just as desirable to them as68%12%report the same threat occurringmultiple timesactually encountered a breach, with 43%of those breaches involving exfiltration ofsensitive data through encrypted channels“sensitive” data being targeted for financial gain or destruction, that is,the data at which popular ransomware and wipeware are directed.While attackers are able to penetrate organizational networks throughmassively automated attacks conducted from afar, protectors arestill using manual processes to identify sensitive assets and enableadministrative policies to enforce security and response functions.Results also show that respondents still are not using easily available,critical resources, such as network topology maps and organizational workflow, toestablish an information-centric, defense-in-depth environment. Organizations needto reduce risk by first understanding their sensitive data, how it flows and where itresides, as well as the threats to that data. With this knowledge, they can establish theappropriate controls that support the organization’s business operations and thenidentify technologies to reinforce data protection policies and procedures.Overall, results indicate thatorganizations need to betterunderstand their sensitivedata and how technology canhelp reinforce policies andprocedures to protect thatdata.SANS ANALYST PROGRAMMost Effective Technologies Used to Protect Data on theNetwork and the EndpointOn the Network:On the Endpoint: E ncryption . . . . . . . . . . . . . . . . . . 82.9%(SSH, SSL, HTTPS, VPN): Email security. . . . . . . . . . . . . . . . 74.3% Access controls. . . . . . . . . . . . . . . 79.3% Host-based encryption. . . . . . . . 51.4% Vulnerability management. . . . . 55.7% Firewall/UTM. . . . . . . . . . . . . . . . 72.4%1Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and BreachesThreats and concerns over data risks were common across a wide variety of industriesrepresented in this survey base of 257 IT and security administrators, engineers,managers, developers and privacy experts (with the largest portion [41%] beingsecurity administrators, analysts and architects). These front-line professionals considerransomware as the top overall threat to data availability, based on occurrences withinthe past 12 months.Threats to DataRespondents’ leading concern for multiple events remains insider threat, followed byransomware. This makes sense, as ransomware usually requires the action of a user toinstall itself; and denial of service is a byproduct of ransomware. See Figure 1.What do you consider to be the top threats to the security of your sensitive data?Please indicate whether these have occurred in your organization one or more times in the past 12 months.Multiple TimesOnceRansomwareInsider threatDenial of service (e.g., lack of availability)Spoofing of identity or access credentialsElevation of privilege into sensitive systemsQuestionable transactionsData tampering, such as unauthorized modificationor destructionIdentity theft (including payment card fraud or medicalidentity theft)Breaches in cloud-based, multitenant architecturesCorporate or foreign government espionageCompromise of DNS infrastructure enabling stealingand exfiltrating dataInformation disclosure, such as to gure 1. Top Threats to Sensitive DataSANS ANALYST PROGRAM2Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED)While fewer than 50% of respondents report experiencing these threat types in theirenterprises, they are experiencing multiple types of threats occurring multiple times.Overall, 78% have seen two or more different types of threats over the past 12 months,and 68% report having encountered some of the same threat types multiple times.Survey FactoidsADVICE:Consider insider threat anduser access compromise as twosides of the same risk coin.Leverage tools for manualclassification and enable realtime warnings not just to alertusers that they are engagingin potentially dangerousactivities, but to educate themas to why these activities aredangerous and how to preventsuch actions in the future.The top five industries represented in thissurvey tend to be either highly regulated orprovide support for such industries and arecommon targets of cyber attack:PercentIndustryRespondBanking and finance. . . . . . . . . . . . . . 16.3%Government. . . . . . . . . . . . . . . . . . . . . 14.0%Technology. . . . . . . . . . . . . . . . . . . . . . 12.0%Cyber security . . . . . . . . . . . . . . . . . . . . 8.9%Healthcare. . . . . . . . . . . . . . . . . . . . . . . 8.1%Respondents come from predominantly smalland medium organizations, with the majoritybeing headquartered and operating in theUnited States:PercentSizeRespondSmall ( 1,000) . . . . . . . . . . . . . . . . 38.8%Medium (1,000 to 10,000). . . . . . . . . 31.4%Large (over 10,000). . . . . . . . . . . . . . . 29.9%Threats experienced by respondents and their top concerns echo other contemporarysources. The 2017 SANS Threat Landscape Survey rates ransomware and DDoS amongthe top three most impactful events.1 In the July 2017 SANS Insider Threat Survey, 76%of respondents rated the combination of malicious insider and unintentional insidervectors as the vector that could cause the most damage, especially since detection (andsubsequent protection) is still not as effective as it should be.2Taken together, spoofing of identity or access credentials and elevation of privilege intosensitive systems also account for the most significant concern, echoing trends seen byother sources. For example, the 2017 Verizon Data Breach Investigations Report (VBIR)attributes 81% of hacking-related breaches to stolen and/or weak passwords.3 In the2017 SANS Insider Threat Survey, 49% cited concerns about compromise of privilegedaccount info, including credentials.4 This item was also cited as the leading asset that waspotentially or actually affected by an incident or attack.5SANS ANALYST PROGRAM1“ 2017 Threat Landscape Survey: Users on the Front Line,” August 102“ Defending Against the Wrong Enemy: 2017 SANS Insider Threat Survey,” July 378903 “2017 Verizon Data Breach Investigations s-lab/dbir/2017, Executive Summary, p. 2. [Registration required.]4“ Defending Against the Wrong Enemy: 2017 SANS Insider Threat Survey,” July 37890, Figure 5.5“ Defending Against the Wrong Enemy: 2017 SANS Insider Threat Survey,” July 37890, Figure 15.3Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED)The Data CompromisedDespite the fact that the majority of respondents have seen two or more of these threats,only 12% report that their organization experienced significant breaches to its sensitivedata during the past 12 months. Of those, identity and access credentials, along withprivileged account credentials (tied with customer identifiable personal information),ADVICE:Organizations should puta renewed emphasis onprotecting access credentials,with even greater carethan is used to protect thesensitive data the credentialsare intended to protect. Forexample, an organization cancreate a “honey” administratoraccount, which is intendedonly to send a secret alertif an attacker attempts tocompromise the account’scredentials.were the top forms of sensitive data affected, as illustrated in Figure 2.If you were breached in past 12 months, what types of data were involved?User login ids and passwordsPrivileged credentialsCustomer identifiable personal informationIntellectual propertyHuman resources/Employee dataFinancial data on customersCorporate financial dataOtherMedical informationIoT or sensor-related data and metadataICS command and control data0%10%20%30%40%50%Figure 2. Data Involved in BreachesCompromise of user names and passwords is a clear vector in preparing to acquire othersensitive data, including personally identifiable information, corporate records andintellectual property. In short, access data is equally as valuable to attackers as directaccess to customer, corporate and employee data.SANS ANALYST PROGRAM4Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED)Effect of Data Breaches ExperiencedThe major impacts of the breaches on respondents’ organizations were related tocustomer confidence, legal concerns and brand reputation, as opposed to financial lossfrom lost sales, regulatory fines or compromise of bank accounts. See Table 1.Table 1. Top Impacts from BreachResponsePercentageIndustryEnterprise customer confidence50.0%Legal46.2%Brand reputation42.3%New technology costs to improve protective controls23.1%Direct loss of sales19.2%Financial losses directly from our company accounts11.5%Regulatory fines because not in compliance11.5%Other11.5%Valuation loss due to impact on stock/investors7.7%Costs to acquire new technology and direct loss of sales were next in order of effect,while direct financial losses and fines were experienced by far fewer organizations.Impact on stocks was the least frequently experienced result. One write-in under the“Other” option cited delays in getting tax returns for employees, indicating a probableransomware attack on an HR system.SANS ANALYST PROGRAM5Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED)The Cause of CompromiseFor purposes of this survey, SANS used the data types cited by the Privacy RightsClearinghouse, an independent educational source for privacy-related matters thatmaintains an online chronological database of breaches, cataloged according tocommon types. We used these types to define the underlying cause for the breach orexfiltration reported by our survey respondents.6 In this survey, respondents reportedthe most frequent underlying causes for the breaches to sensitive data to be hacking ormalware-related attacks (41%), followed by insider compromise (37%). See Figure 3.What was the underlying cause, as defined by the Privacy Rights Clearinghouse,for the breach or exfiltration? Select all that apply.Hacking or Malware (HACK)Insider (INSD)UnknownUnintended Disclosure (DISC) not involving hacking,intentional breach or physical lossPortable Device (PORT)Physical Loss (PHYS), including paper (nonelectronic)documents that are lost, discarded or stolenPayment Card Fraud (CARD)Stationary Device (STAT), involving lost,inappropriately accessed, discarded or stolencomputer or server not designed for mobility0%10%20%30%40%Figure 3. Underlying Cause for Breach6SANS ANALYST PROGRAM www.privacyrights.org/data-breaches6Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED)Data ExfiltratedSlightly less than half (48%) of the 12% of organizations that sustained a breachreported the major incident had resulted in the exfiltration of sensitive data. The primarytransport used to exfiltrate the data was an encrypted channel established by malware,and a secondary factor was email. This is not surprising, because many of the mostprevalent attacks, for example phishing and ransomware, use email to successfullyintroduce malware into organizations. See Figure 4.What transport mechanisms were used to exfiltrate the sensitive data? Select all that apply.Encrypted channel established by malware(nonstandard port)Theft of company-owned assets(mobile devices, laptops)EmailOver DNS (DNS tunneling)HTTPS (encrypted traffic)USB or other removable mediaTheft of employee-owned deviceFile-based transfer (FTP, SFTP)HTTP traffic0%10%20%30%40%50%Figure 4. Transports Used to Exfiltrate Sensitive InformationEncrypting communication channels to exfiltrate data is not a new technique.Protection against transmission in this manner requires security at the egress point toboth detect unusual outbound activity of any type and open encrypted packets whentraffic is suspect.SANS ANALYST PROGRAM7Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED)Root-Cause AnalysisROOT CAUSEThe fundamental reason forthe occurrence of a problemFor root-cause analysis to be effective, it must rely on gathering the proper informationfrom available sources. Respondents that had suffered a breach depend mainly onSIEM and log data to determine root cause. Advanced techniques such as user activitymonitoring and network behavior modeling tools are used somewhat less frequently.See Figure 5.What data sources does your organization use to analyze root cause and determine thebest path for remediation? Select all that apply.Log data from SIEMUser activity monitoring toolsADVICE:Network maps, even ifdrawn manually, can bean important first step tohelp you spot and correctfundamental vulnerabilities.Consider adding automatedtools to your data protectionarsenal that can map yourcurrent network topology aswell as reveal how data andinformation flows in yourexisting network.Logs consolidated from individual security devices(Firewall, IDS, DNS)OtherNetwork behavioral analysis toolsInformation derived from analytics platforms used toanalyze dataNetwork topology mapsMaps of how information flows in the organization(source system to end user, source to destination system)Logs from endpoints (hosts, workstations)Logs consolidated from data management platforms(database, document repositories)Data discovery tools0%10%20%30%Figure 5. Data Sources for Root Cause AnalysisA SIEM focuses at the system level, not the user level, in logging events from devices andsystems on the network. Such data is designed to inform administrators that somethinghappened at a system or infrastructure level, but it offers limited insight into actual useractivity, behavior and intent. The more advanced process of user activity monitoring, onthe other hand, specifically records user activity involving applications, web pages, andinternal systems and databases. It provides analysis of the results based on expectedbehavior and offers real-time alerts and feedback.SANS ANALYST PROGRAM8Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED)Digging DeeperGiven that 48% of these respondents had their sensitive data exfiltrated, we decidedto dig deeper. In Table 2, we compare those that had data exfiltrated as a result of thebreach versus those that had not.Table 2. Comparison Between Breaches with Data Exfiltrated and Not ExfiltratedTopicData ExfiltratedNot Exfiltrated, but ImpactedTypes of DataInvolvedTargeted sensitive data (i.e.,customer identifiable personalinformation and intellectualproperty) were the top typesinvolved. User login IDs andpasswords and privilegedcredentials finished third and fourth.User login IDs and passwords wereinvolved in most impactful threats,followed by privileged credentialsand all other forms of sensitive data.UnderlyingCauseHacking or malware, insider threatand unintended disclosure wereequal as the top three underlyingcauses.Hacking or malware led, with insiderthreat second.Data SourcesUsed for RootCauseRespondents overwhelminglyuse log data from their SIEM todetermine root cause.Respondents rely on user-activitymonitoring tools and logsconsolidated from individualsecurity devices, notably perimeterdevices such as firewall, IDS andDNS, along with their SIEM.From this table, defenders can determine the types of controls needed. It is asimportant to protect access data—particularly privileged credentials—as the sensitivedata attackers are after. Insiders are nearly as risky for sensitive data as outsiders, andrespondents need better visibility into their threats.This analysis led us to a set of questions that security professionals should ask abouttheir organization’s data protection processes and the tools that support them: H ow well can you “connect the dots” using your current procedures andtools? Tools need to support data protection policies and filter out the majorityof incidents that are neither malicious nor urgent; they should also inform yourdetection and response efforts as new intelligence becomes available. A re your capabilities for detecting (e.g., correlating events) and protectingsufficient to address your organizational needs? The key is understandingthe context around the data to be protected, not just the correlation of networkand endpoint events. For the most robust data protection, you need to combinetraditional SIEM or log data with details such as type of user, assets involved,known threats and specific vulnerabilities. Visualization tools can help your securityand network teams identify potential gaps in protection by associating thesecontextual attributes with where, when and how your sensitive data is stored,transmitted and used. You may find you need to protect your DNS servers to thesame degree as you do your email servers.SANS ANALYST PROGRAM9Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Threats and Breaches(CONTINUED) S hould mitigation measures be “baked in”? Stopping data exfiltration beforeit happens can reduce the possibility of a breach, as well as alert your incidentresponse team to take immediate action.Take advantage of all available tools to combine reputation information (known bads),signature analysis (known patterns) and behavior analysis (changing patterns) to getbetter protection. As it applies to data and access credentials, this type of whitelistblacklist detection and prevention should focus on the behavior of data and usershandling the data.Achieving BalanceThe ability to identify assets and map data flow is important in creating a comprehensivepolicy that can be supported by people, processes and technology. Without thatfoundation, it is impossible to enforce policies, which happens to be the overall leadingchallenge to balancing data protection and availability. See Figure 6.What are your organization’s greatest challenges to achieving the ideal balance betweensensitive data protection and availability?Please choose the top three, with “1” being your greatest challenge.170%2360%50%40%30%20%10%OtherKnowing where and howto get startedRanking data and applyingvalue to the dataIdentifying all pathways tosensitive dataLack of staffing andresourcesEnforcing policy across thelifespan of sensitive data0%Figure 6. Challenges in Data ProtectionThe process begins by knowing what your sensitive data is and its potential value toattackers, then mapping its usage, flow and storage—all while looking for vantagepoints and vulnerabilities the attacker can use to reach that data. Results indicate thatthis is no easy task.SANS ANALYST PROGRAM10Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Know Your DataNot all data is created equal. We most commonly think of personally identifiable data,particularly financial- and healthcare-related data, as being of most value to attackers.Yet, as previously discussed, attackers are also after credentials used to manage theprivacy and security of the organization, its workforce and its customers. Still other datais directly related to process and operations (e.g., ICS command and control data).Types of DataThe types of sensitive data handled by respondent organizations parallel the typesof data involved in the breaches reported by respondents, as illustrated previously inFigure 2. The data types handled include: 1) user login IDs and passwords, 2) customeridentifiable personal information, 3) privileged credentials and 4) human resources andemployee data. See Figure 7.What types of sensitive data do you handle? Select only those that apply.User login ids and passwordsCustomer identifiable personal informationPrivileged credentialsHuman resources/Employee dataCorporate financial dataIntellectual propertyFinancial data on customersMedical informationIoT or sensor-related data and metadataICS command and control dataNational security informationOther0%20%40%60%80%Figure 7. Types of Sensitive DataFigure 7. Types of Sensitive DataProtections focused on user and privileged access credentials should be as important asprotecting customer identifiable information, because breached credentials usually lead todata breaches. Organizations should also keep an eye on seemingly benign control devices.SANS ANALYST PROGRAM11Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Know Your Data(CONTINUED)Know the RulesThe first step in determining how to protect sensitive data is understanding the rulesassociated with each type. These include: How the data is intended to be used Who may access the data Where and how the data should be stored How long the data should be retainedAll of these rules are influenced by industry standards, national and multinational lawsand regulations, organizational standard practices, and contracts with business andtrading partners.7 Contracts and internal practices reflect how an organization willcomply with legal and regulatory controls in light of its mission and needs.Based on survey responses, data protection practices are most influenced by contractswith business partners, organizational standard practices and internal policy compliance.They are also influenced by numerous regulations, as shown in Figure 8.Rank the top three requirements that most influence your data protection efforts,with “1” having the greatest influence.123Internal policy complianceContracts with business partnersOrganizational standard practicesPayment Card Industry Data Security Standard (PCIDSS)Health Insurance Portability and Accountability Act of 1996 (HIPAA)Individual jurisdictional lawsData protection laws outside the U.S. and EuropeSarbanes-Oxley ActEuropean data laws (e.g., GDPR)Gramm-Leach-Bliley Act (GLBA)OtherFamily Educational Rights and Privacy Act (FERPA)0%5%10%15%20%25%Figure 8. Factors that Influence Data ProtectionWhile compliance seems as if it is less of a priority based on these figures, the reality isthat compliance with multiple standards is strongly driving respondents’ internal policies.7SANS ANALYST PROGRAMA n example of multinational law is the European Union’s General Data Protection Regulation (GDPR), which becomes enforceableMay 25, 2018, after a two-year transition period.12Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Know Your Data(CONTINUED)Classify Your DataData classification is a key element in most compliance rules and data protectionpolicies. By classifying data, the resulting policy establishes the basis for the rules aroundaccess, actions and audits related to sensitive data.Value to AttackersData Classification Elements A ccess: Enable design, development and enforcementof user roles and permissions for each information/datacategory. A ctions: Establish appropriate control activities for eachcategory, including both administrative policies andprocedures, as well as technical security controls (e.g.,encryption) to achieve business objectives and mitigate risk. A udit: Be able to generate accurate reports aboutactivities related to information and data to demonstratecompliance, proactively identify anomalous events, andrespond rapidly to incidents.Attackers value access/credential data as well as the more traditionalsources of sensitive data: personal financial information, medicalrecords and intellectual property. Don’t neglect protection ofyour access management assets—user IDs and passwords, yourinternal directory structures and assigned access roles—as part ofyour sensitive data classification policy and subsequent protectionprocedures.Prioritize ControlsOrganizations, clearly, are trying to assign risk to their digital assets,but only 45% of our respondents have a data classification policy thatapplies to 50% or more of their sensitive data. Unfortunately, 21%either are uncertain of whether a data classification policy exists in their organization orhave no plans to develop one. See Figure 9.Do you have a formal data classification policy that ranks data according to sensitivity?If so, what percentage of your sensitive data is classified and ranked across the data lifespan?20%15%10%5%Don’t knowNone, but we plan toNone, with no plans to1–24%25–49%50–74%75–99%100%0%Figure 9. Data Classification Policy ImplementationSANS ANALYST PROGRAM13Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Know Your Data(CONTINUED)Own Your DataThe data owner, such as the CEO or business area manager, is responsible for developingdata-related policy, whereas the protection of that data against risks falls to the datacustodian or steward. As custodians, the chief information officer (28%) and the chiefsecurity officer (23%) have the greatest influence in overseeing the data risk assessmentin respondent organizations, as illustrated in Figure 10.Data Classification and Oversight of Risk Assessment40%Percentage of ResponseADVICE:Get security and ops on boardwith data protection, startingat the top. If you have acompliance officer, bring himor her in as well.Chief information officerChief privacy officerChief security officerCompliance officerDesignated management committeeFinancial or accounting officeRisk managerSecurity administratorThird-party risk assessment �24%Percentage of Data ClassifiedFigure 10. Influence on Risk Assessment vs. Data ClassificationBased on the this figure, the CSO is most actively involved in environments with thehighest percentage of data classification (50% or more of sensitive data classified),except for at the 100% data classification group, achieved by only 12% of our sampleaccording to Figure 9, where CIO and CSO oversight are tied.SANS ANALYST PROGRAM14Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Know Your Data(CONTINUED)Know Where Your Data IsMost respondents (88%) store sensitive data in databases and servers. Recall, however,that in today’s cloudy world, these assets may be highly virtualized and/or no longerbe on-premises, complicating compliance with the data classification policy and otherorganizational needs. See Figure 11.Where is your most critical or sensitive data used and stored? Select all that apply.Databases and serversStorage and backup systemsManaged organization-owned user endpointsApplications hosted in the public cloudStorage systems at third-party locationsManaged user-owned endpointsUSB and other removable mediaPrinters, scanners, multifunction devicesUnmanaged user-owned endpointsUnmanaged organization-owned endpointsOther0%20%40%60%80%100%Figure 11. Locations Where Sensitive Data Is StoredSANS ANALYST PROGRAM15Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Know Your Data(CONTINUED)The majority of respondents are either moderately (62%) or totally (26%) confident intheir ability to identify their organization’s sensitive data. Yet most respondents still relyon manual processes to locate those assets, as illustrated in Figure 12. That may be amistake, given that attackers can also locate sensitive assets from afar.How do you locate your sensitive data assets? Select those that most apply.60%40%20%OtherWe can’t locatethese assets.DNS scanningDLP searchEndpoint scanningAutomated datadiscovery toolsNetwork scanningVulnerabilityassessmentManual processes0%Figure 12. Manual Processes Rule in Locating Sensitive Data AssetsMap Data UsageTo protect sensitive data, you need to know first where it will be stored, and then how(and by whom) it will be used and flow across your network from various endpoints—the very same process an attacker would follow to steal sensitive data! It will help to useautomation to map your network and establish the standard path for data in responseto organizational workflows and business processes, but that will show only part of thepicture. Key areas to protect include: Enterprise backups. Backups often contain sensitive data and need to be subjectto the same rigorous protections afforded your active data. Keep your backupsseparate from your production data, use encryption and track access. Cloudstorage of backups, with the proper set of controls, may be a safer alternative thanthose backup tapes kept in the trunk of your sys admin’s car. Access and login credentials. Access credentials are valued by attackers. Thisdata, once compromised, can provide direct access to the sensitive data prizedby the intruder. User credentials should be protected as sensitive data, alongwith other sources that can lend valuable intelligence to an attacker, such as usertelephone and email directories.SANS ANALYST PROGRAM16Sensitive Data at Risk: The SANS 2017 Data Protection Survey
Know Your Data(CONTINUED) End user systems. End users capture data from line-of-business systems,downloading content into standalone files such as Exc
Threats experienced by respondents and their top concerns echo other contemporary sources. The 2017 SANS Threat Landscape Survey rates ransomware and DDoS among the top three most impactful events.1 In the July 2017 SANS Insider Threat Survey, 76% of respondents rated the combination of malicious insider and unintentional insider
