Going beyond Cyber Essentials

Learning from real cyber attacks

Analysing at a typical modern cyber security incident helps to demonstrate the defensive gaps in CE certification and benefits of specific additional cyber security controls. A typical attack will follow these key steps:

1. 1

   Initial compromise

   Scenario

   An attacker sends a phishing email with a malicious attachment to an unsuspecting employee. The employee opens the attachment, launching malware that exploits a known vulnerability and establishes a foothold on the employee's computer.

   Impact

   Cyber Essentials makes sure you have an anti-virus that can detect common malware types, but determined adversaries will easily overcome this with customised phishing campaigns and customised malware. Only security training can educate the user on what a malicious email looks like.

   A managed SOC/SIEM service can analyse email logs for suspicious patterns, such as unexpected senders, or attempts to bypass email filters and identify reconnaissance activities early in the attack. This can help identify potential phishing campaigns before an attacker is able to gain an initial foothold.

2. 2

   Privilege escalation

   Scenario

   The attacker exploits a known vulnerability to gain administrative privileges on the compromised device.

   Impact

   Cyber Essentials interacts with patch management and admin credential separation, but it’s a point-in-time assessment, and no provision is made for an on-going patch management programme nor enforcement of credential separation.

   This can be a case of ‘process to the rescue’, and something like ISO 27001 is great at putting in place things that make you both ‘do’ and ‘review’. ISO compliance needs evidence of things happening, so it helps make sure that your patching happens when it should happen, instead of 1 day before a re-certification audit. This is also another time a managed SOC/SIEM service ca help: tried-and-tested runbooks tell the SOC team to react if something out of the ordinary for a business and deny the escalation request or isolate a device so no others can be impacted.

3. 3

   Lateral movement

   Scenario

   The attacker uses these admin privileges to move laterally throughout the infrastructure, identifying sensitive data stores and other systems to compromise.

   Impact

   Network segmentation, where networks are divided into smaller segments, is a key defence against an attacker moving throughout your infrastructure. Network segmentation limits an attacker's ability to move laterally and access sensitive data. Cyber Essentials does not provide for network segmentation, instead focussing on the network boundary.

   A cleverly scoped penetration test will do a great job of testing your network segmentation. Bulletproof has lots of resources on getting the most out of penetration testing, which are included at the bottom of this article. Going further, once again a managed SIEM service can provide network traffic monitoring to analyse network traffic for suspicious activity, detecting lateral movement attempts.

4. 4

   Data exfiltration

   Scenario

   The attacker exfiltrates sensitive data to a remote server under their control, mines crypto currencies or causes disruption/denial of service.

   Impact

   If an attacker exfiltrates data that is properly encrypted, the stolen data can be effectively rendered useless to the attacker. Strong data protection practices are essential here. Encryption at-rest and in-transit is not mandated by Cyber Essentials, but will be in-scope of other certification standards. Not to motion that, if you’re being risk-based by following ISO 27001 or SOC 2, you’ll know what you need to encrypt and where.