{"id":8710,"date":"2015-04-06T05:00:56","date_gmt":"2015-04-06T12:00:56","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=8710"},"modified":"2016-12-09T11:12:23","modified_gmt":"2016-12-09T19:12:23","slug":"applications-the-threat-starts-and-stops-here","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2015\/04\/applications-the-threat-starts-and-stops-here\/","title":{"rendered":"Applications: The Threat Starts (And Stops?) Here"},"content":{"rendered":"

It\u2019s no secret that attackers use trusted applications to stealthily launch threats into organizations.<\/p>\n

A recent example is the November 2014 attack on Forbes.com where the attacker used two chained zero-day Adobe Flash and Internet Explorer (IE) vulnerabilities hosted on the Forbes.com website to create a watering hole targeting users in financial services industries. Visitors to the exploited page using IE 9+ browsers with the Flash plugin enabled inadvertently downloaded a malicious .SWF file, which allowed attackers to gain control over the victim\u2019s machine. The attack was discovered by Invincea\u2019s<\/a> threat research team.<\/p>\n

Another example, discovered by Alien Vault Labs<\/a>, occurred in August 2014. Attackers used what was likely a cross-site scripting (XSS) vulnerability on an industrial company\u2019s web site to load Scanbox on to victims\u2019 machines to collect information about what software the machines were running and sent that information back to the attacker.<\/p>\n

In the examples above, three different applications were leveraged: Adobe Flash, Internet Explorer, and a web application (web page). These aren\u2019t just occasional occurrences, either. Sujata Ramamoorthy, Cisco\u2019s Director of Information Security<\/a>, estimated that more than 70 percent of attacks leverage application vulnerabilities.<\/p>\n

Thought Experiment: An App-Perfect World<\/h3>\n

For a second let\u2019s imagine a world where all applications were 100 percent secure all of the time. What would this mean for the world of cybercrime? For starters, it would mean that cybercriminals would be much more hard-pressed in finding ways to attack users and organizations, drastically decreasing not only the ways in which a profit could be earned through cyber crime, but also the amount of profit gained from a successful attack. The extra work involved to find a way to compromise the application would have a negative impact on the criminal organization\u2019s bottom line, which could lead to cuts in funding for attack research and staff.<\/p>\n

Making it more difficult (and thus more expensive) to launch a successful attack means fewer attackers and fewer attacks. At the end of the day, hackers have to pay the bills, too. Sure, there would still be armies of nation-state hackers and guys who won\u2019t accept defeat and opt to spend their free time hammering out new attack methods, but the threat landscape would change \u2014 drastically, and for the better.<\/p>\n

Back to Reality<\/h3>\n

Of course, I know a world with totally secure applications is just a fantasy. However, that doesn\u2019t mean we are helpless to better protect ourselves against application-borne threats. So, how do you make the applications you\u2019re using or creating more secure and resilient?<\/p>\n

    \n
  1. Use secure coding practices and stringent security testing procedures throughout the software development lifecycle to ensure that your application cannot be used maliciously<\/em>\u2026<\/li>\n<\/ol>\n

    This means making sure applications are architected with security as a priority, right next to functionality, and testing every version or iteration of the software during development, QA, staging, and production. It sounds exhausting, but it\u2019s less exhausting than having to scramble after hemorrhaging customers due to an unpatched production vulnerability that led to a security incident or data breach.<\/p>\n

    \u2026and taking additional precautions even after the code goes live through patching and tools like web application firewalls and intrusion prevention systems.<\/em><\/p>\n

    Even after thorough testing procedures, a web application firewall or intrusion prevention system can help to block potential evil-doers from combing through applications for attack vectors by alerting on or blocking host sweeps and port scans. In addition to ensuring that your applications aren\u2019t serving up easily-exploited vulnerabilities, these tools also help identify and thwart internal and external users who attempt to access restricted resources or search for potential vulnerabilities.<\/p>\n

      \n
    1. Architect your network so that all traffic and applications on all ports and protocols \u2014 including those that use SSL encryption \u2014 are visible and void of threats, and data remains secure.<\/em><\/li>\n<\/ol>\n

      This has to do more with the Zero Trust<\/a> methodology. Make it incredibly time-consuming and expensive for cybercriminals to target you. Know which applications are being used and what kinds of risks they introduce, and then try to reduce the impact of those risks by limiting the use of unsecured features within those applications, controlling which of your users has access to those application features, and segmenting and securing data to which those applications have access.<\/p>\n

      Gaining complete visibility into the applications traversing your network and controlling the way users are able to interact with them is paramount to preventing threats that leverage them to access the network. This is a large part of the premise behind the multitude of \u201cnext-generation\u201d security products currently on the market: that they can identify traffic and classify it within the context of applications. If you can tie traffic to applications and allow only certain applications onto the network, then you\u2019ve reduced your security risk. If you can then focus on securing potential attack vectors within those applications, real prevention becomes possible.<\/p>\n","protected":false},"excerpt":{"rendered":"

      It\u2019s no secret that attackers use trusted applications to stealthily launch threats into organizations. A recent example is the November 2014 attack on Forbes.com where the attacker used two chained zero-day Adobe …<\/p>\n","protected":false},"author":40,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[155,108],"tags":[644,73],"coauthors":[716],"class_list":["post-8710","post","type-post","status-publish","format-standard","hentry","category-cybersecurity-2","category-threat-prevention-2","tag-application-security","tag-zero-trust"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/8710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=8710"}],"version-history":[{"count":2,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/8710\/revisions"}],"predecessor-version":[{"id":8712,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/8710\/revisions\/8712"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=8710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=8710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=8710"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=8710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}