In the third installment of the Detection Engine blog series, we examine the Application Control Engine, one of five detection engines which work together as part of our cloud workload protection platform (CWPP) to detect and block runtime threats impacting cloud workloads. (The first and second blog posts discuss the Static AI Engine and Behavioral AI Engine, respectively.)

• Static AI Engine
• Behavioral AI Engine
• App Control Engine
• Cloud Intelligence Engine
• STAR Rules Engine

Application Control Engine 101

SentinelOne’s Application Control Engine is a highly specialized drift prevention engine within our real-time CWPP agent that is focused on preserving immutability of containers and virtual machines (VMs). It accomplishes this by detecting any binaries or scripts created and executed after the VM or container starts. Stated another way, the Application Control Engine ensures that only executables from the original container image run in the workload instance.

Originally, the engine was designed to protect immutability of containerized workloads running within Kubernetes and other container orchestration systems such as Hashicorp Nomad and AWS ECS. However, the cloud security innovators at SentinelOne expanded the scope to include Linux VMs. In short, the Application Control Engine reduces the attack surface of your immutable container architecture.

Gain Immutable Protection

Most often, the set of executables and scripts found within a running container do not deviate from those of the original container image from which the container was instantiated. This fact offers a big advantage to security teams in that if rogue executables or scripts suddenly appear within a container that is supposed to be immutable, it’s a telltale sign that the container may have been compromised.

Attackers often use custom scripts or executables to automate the work of finding vulnerabilities that allow for privilege escalation or lateral movement. With SentinelOne’s Application Control Engine enabled, these types of attack tools are trivial to identify and prevent.

The functionality is largely based on timestamps, and so requires very little operational overhead. It is easily enabled or disabled in policy. When a new container is instantiated, Singularity Cloud Workload Security (CWS), SentinelOne’s real-time CWPP solution, denotes its timestamp.

From that point forward, CWS compares the timestamp of any file from which a process is spawned against the container’s instantiation timestamp. If the timestamp of the file is more recent than that of the container, we can infer that the file was not in the original container image. In this case, the Application Control Engine will log an incident to the management console and, if configured in policy which the customer controls, prevent the process from running.

On the other hand, if the timestamp of a file precedes the container’s instantiation timestamp, the Application Control check is satisfied and the process is allowed to start. Moreover, any activities from this process are still monitored by the other Static and Behavioral Engines within the autonomous, real-time CWPP agent. As previously mentioned, our five CWPP detection engines each work to complement the other.

Monitoring and preserving immutability with the Application Control Engine is a big win for cloud security practitioners and DevOps alike. It greatly simplifies the identification of anomalous activity, and there is very little operational overhead to maintain it.

Benefit from Maximum Agility

Compared to cumbersome application allowlisting methods of legacy security products, with the Application Control Engine there is:

• No pre-deployment scanning
• No ML training periods, waiting on an algorithm to “learn” what’s in a given image
• No list of paths/executables to maintain.

Pre-deployment scans for legacy solutions create an allowlist of expected processes. While this approach ensures that a container will always run with a predefined set of processes, it adds the overhead of allowlist management.

Training periods for machine-learning algorithms means the ML learns the expected behavior of a container over time, usually in a sandbox and before pushing to production. This approach automatically creates an allowlist, but its effectiveness depends upon the training period duration. Set the training period too low and risk a large number of false positives. Conversely, setting it too high causes long delays when trying to release code to production. This is the very opposite of agility.

The Application Control Engine circumvents the shortcomings of legacy solutions: no allowlists to create and maintain, and no ML training periods to slow you down.

The Advantages of Operational Flexibility

Should you have containers that do change (in controlled and predictable ways) within your environment, exclusions can be applied to accommodate these variances. The classic example of a container that is mutable by nature is a build system like Jenkins, used to build software from source code. Build systems often have pipeline steps that pull code from remote repositories and build executables from that code.

These build steps can cause “false positives” for Application Control because new executables and scripts are being executed in containers whose images did not originally contain them. However, it is both desired and expected that these files be allowed to run.

To allow for this scenario, SentinelOne’s Exclusion feature can be used to exclude files and directories (and optionally their subdirectories) from inspection. This allows for the “known-mutable” areas of a container to function as desired while the rest of the container’s immutability is enforced.

Extending to VMs

As previously mentioned, although originally designed for containerized workloads, the Application Control Engine has been extended to Linux VMs. An example use case is for Amazon Auto Scaling Groups, in which Amazon EC2 instances are created from Amazon Machine Images (AMIs) in response to increased workload demand.

Once an EC2 is instantiated, it is extremely uncommon that one would run yum/apt to install and update packages or load scripts on these live production hosts. Rather, should an update be necessary, the AMI itself would be modified to include the desired packages, scripts, etc. When the new AMI is ready for deployment, DevOps engineers update the machine image version (tag) to point to the newly updated machine image.

From then on, any new VMs (EC2) within the Auto Scaling Group will be created from the updated AMI, and VMs on the outdated AMI decommissioned. This DevOps process promotes uniformity, repeatability, and scalability.

Example: Cryptomining Malware

Let’s extend the explanation of the VM use case to a common threat vector – cryptominers. While the use of cryptomining malware ebbs and flows with the price of Bitcoin, it pays to be prepared to protect your infrastructure from being used by unwelcome guests. After all, they keep the Bitcoin, and you keep the cloud compute bill.

Assume for this example that a threat actor has obtained access credentials to an EC2 compute cluster. The threat actor then simply remote shells to the VM, downloads a crypto miner, makes the file executable, and executes. These steps are easily scripted and launched with a single command line.

Here is what the detection looks like in the SentinelOne management console.

As shown in the image above, the Application Control Engine was not the only engine to trigger a detection. Even so, it’s all consolidated in a single alert. The AI within the agent has assessed a confidence level of MALICIOUS to this detection. The path to the cryptominer – in this case, xmrig – is shown, along with command line arguments, Storyline identifier and more. On the right hand side under THREAT INDICATORS, the detection has automatically been mapped to a MITRE TTP. Together, these details help streamline investigation of the detection.

Note that the incident is shown as NOT MITIGATED. This is because the agent policy is set to Detect Mode (as shown). Had the policy been set to Protect Mode, the incident would have automatically triggered a response action. In this example, however, the information is laid out intuitively, and the cloud security engineer can easily initiate remediation with a single click, while also notifying the DevOps owner of the incident so that root cause (credential compromise) can be addressed.

Conclusion

The Application Control Engine is yet another of the detection engines integral to SentinelOne’s real-time CWPP. Originally designed to preserve immutability of containerized workloads, it also protects Linux VMs.

To learn more about the value of real-time CWPP in your cloud security stack, head over to the solution homepage, or see how Singularity Cloud Workload Security works with a 2-minute guided walk-through here. And of course, whenever you are ready, you may connect with one of our cloud security experts for a personalized demo.

For CISOs and other experienced security leaders, understanding past incidents is crucial for preparing against future cyber threats. Delving into some of the most impactful cyberattacks in recent history can serve as a potent reminder of the diverse nature of cyber threats and the need for robust security measures.

In this post, we explore seven pivotal cybersecurity incidents, their impacts, and the invaluable lessons they offer to security leaders and organizations in fortifying their cyber defenses.

1 – Colonial Pipeline Ransomware Attack (2021)

The Colonial Pipeline ransomware attack in May 2021 stands as a stark moment that shows the very tangible impacts that cyber threats have on critical infrastructure. This incident not only disrupted digital operations but also had far-reaching consequences on fuel supply, affecting a substantial portion of the U.S. East Coast and causing wide-spread panic buying in various affected cities.

What Happened?

The Colonial Pipeline, responsible for transporting nearly half of the East Coast’s fuel supply, fell victim to a ransomware assault that halted its operational capabilities. The ransomware locked the company out from its own systems, encrypting data and demanding payment for its release.

The immediate aftermath of the attack saw widespread fuel shortages and a spike in fuel prices. This scenario underscored the vulnerability of critical infrastructure to cyber threats and the domino effect such an attack can have on societal functioning.

In a move driven by urgency, the company conceded to the cybercriminals’ demands, paying a ransom of $4.4 million.

Impact on Cybersecurity Practices

The ransomware attack highlighted the pressing need for robust cybersecurity measures in sectors serving national infrastructure, emphasizing the importance of proactive defense strategies against ransomware.

As nations grapple with the escalating sophistication of cyber adversaries, the Colonial Pipeline incident reminds us of the need to collaborate on threat intelligence and invest in cyber resilience strategies to mitigate the potentially devastating fallout from attacks on critical infrastructure.

Industry Response & Learnings

Post-attack, there was a heightened awareness across industries regarding the susceptibility of critical infrastructure to cyber threats. The incident catalyzed initiatives to strengthen cybersecurity protocols, emphasizing the importance of proactive defense measures and contingency planning in the face of ransomware threats.

2 – SolarWinds Supply Chain Attack (2020)

The SolarWinds breach highlighted an attack vector that many organizations had overlooked: compromise through trusted software vendors. It was a sophisticated attack that impacted the global software supply chain, infiltrating organizations globally, including several U.S. government agencies.

What Happened?

State-sponsored hackers infiltrated SolarWinds’ Orion IT monitoring and management software’s build environment. This allowed them to embed a malicious code, “SUNBURST”, into legitimate software updates, enabling a stealthy spread to a vast network of users.

The SUNBURST malware exhibited an operational cunning by remaining dormant for 12 days post-deployment. This delay tactic, vital for evading immediate detection, underscores the necessity of extended data retention to identify latent threats. Once activated, SUNBURST employed a meticulous scanning process for specific processes, services, and drivers. It was programmed to terminate its operation if it detected monitoring tools or security processes, a self-preservation mechanism ensuring its longevity in targeted environments.

The malware’s design was remarkably sophisticated, blending its network communications seamlessly with normal SolarWinds traffic. The attackers, post-infiltration, focused on reconnaissance rather than immediate data exfiltration or disruption. They moved laterally across networks, identifying and collecting information on high-value targets, potentially escalating privileges for broader access.

Impact on Cybersecurity Practices

The SolarWinds attack increased awareness of the need to defend the digital supply chain. Its significance lies in the fact that threat actors, by compromising a trusted vendor, could gain unprecedented access to a multitude of organizations. The consequences of supply chain attacks are rippling and trigger a reassessment of third-party relationships, an emphasis on supply chain security, and a recognition that defending against such attacks requires a collective and coordinated effort.

Industry Response & Learnings

The breach necessitated a reassessment of cybersecurity practices, especially in software development and supply chain security. It highlighted the need for better monitoring of network behavior and the importance of rigorous code auditing and validation processes.

In response to the attack, the cybersecurity industry heightened its focus on advanced threat detection mechanisms. It highlighted the need for behavioral detection that can recognize malicious behavior regardless of whether a process is nominally ‘trusted’ or carries a known digital certificate. The collective industry effort aimed not only at technical solutions but also at a reimagined approach to supply chain security and intelligence sharing.

3 – NotPetya Malware (2017)

In 2017, organizations across the world were impacted by NotPetya, a malware initially masquerading as ransomware. However, its true design was far more sinister. It aimed at inflicting widespread damage rather than financial gain. NotPetya’s global impact was profound, affecting a diverse array of organizations from banks to shipping firms, and even disrupting the Chernobyl nuclear power plant’s radiation monitoring system.

What Happened?

NotPetya’s deceptive appearance as ransomware belied its actual purpose – to cause disruption on an unprecedented scale. Unlike typical ransomware, which locks up data for ransom, NotPetya was programmed for destruction. It quickly propagated globally, exploiting vulnerabilities in commonly used software.

The attack’s global footprint was vast, indiscriminately hitting organizations across different sectors. The financial ramifications were staggering, with the total cost of the attack estimated to exceed $10 billion. This figure reflects not just the immediate disruption caused but also the long-term operational and reputational damages incurred by affected entities.

NotPetya utilized sophisticated methods to infiltrate and spread across networks. It exploited known vulnerabilities, particularly in Microsoft Windows, and used techniques similar to ransomware to lock systems. However, its payload was primarily destructive, rendering affected systems inoperable and data irretrievable.

Impact on Cybersecurity Practices

This incident prompted a reevaluation of cybersecurity practices and highlighted the urgent need for improved global cooperation to prevent and respond to such similar activities in the future.

Industry Response & Learnings

The NotPetya malware outbreak showed the destructive potential of state-sponsored cyber attacks. Attributed to Russian military hackers, NotPetya targeted Ukrainian infrastructure but later morphed into a global menace. Its significance lies in the realization that cyber weapons can have unintentional consequences. NotPetya demonstrated the potential for cyber tools to transcend borders and impact organizations irrespective of geographical boundaries.

The attack alerted cybersecurity and infosec professionals of the potential for cyber weapons to cause real-world havoc. In response, there was a significant shift in the cybersecurity paradigm, with an increased emphasis on protecting against such destructive malware. This incident underscored the need for rigorous vulnerability management and the implementation of robust, multi-layered cybersecurity defenses.

4 – WannaCry Ransomware Attack (2017)

For those working in infosec in 2017, the WannaCry ransomware attack was likely a day that they will never forget. The attack caused a global crisis that exposed the vulnerability of unpatched systems and the potential for rapid, widespread disruption. Infecting over 200,000 computers across 150 countries, the ransomware exploited a critical vulnerability in Microsoft Windows. What set WannaCry apart was its indiscriminate nature, affecting organizations ranging from healthcare institutions to government agencies and businesses.

What Happened?

WannaCry’s modus operandi was both aggressive and effective. It leveraged a vulnerability in Microsoft’s implementation of the Server Message Block (SMB) protocol. This bug, CVE-2017-0144, allowed the attacker to execute arbitrary code on the target system. This capability made it possible for WannaCry to propagate rapidly across networks, infecting computers and encrypting files.

Microsoft had in fact released a patch for the vulnerability in March 2017, approximately two months before WannaCry began spreading in May of that year. However, the rapid spread of WannaCry was largely attributed to the fact that many organizations had not applied the patch, leaving a significant number of systems vulnerable.

The attack indiscriminately targeted a range of sectors, causing severe disruptions in healthcare systems and manufacturing plants. Hospitals found their digital systems locked, impeding access to patient records and essential services. In the manufacturing sector, production lines were halted, leading to operational delays and financial losses.

Impact on Cybersecurity Practices

The WannaCry attack prompted an immediate and concerted response from cybersecurity professionals and organizations worldwide. Efforts to contain the spread included deploying security patches, isolating infected systems, and enhancing network defenses. This incident also accelerated the development and adoption of advanced threat detection and response capabilities, emphasizing the importance of timely patch management and proactive cybersecurity measures.

Industry Response & Learnings

The WannaCry attack was a wake-up call for organizations to prioritize cybersecurity hygiene and timely software updates. Its impact extended beyond financial losses, raising awareness of the importance of securing digital infrastructures. The attack also spurred increased collaboration between governments and the private sector to enhance cybersecurity measures.

WannaCry highlighted the interconnectedness of global cyber threats, emphasizing the need for a collective, proactive approach to cybersecurity. As a cautionary tale, WannaCry serves as a reminder that cybersecurity is a shared responsibility, urging organizations and individuals alike to fortify their defenses against evolving ransomware threats.

5 – Equifax Data Breach (2017)

The world witnessed one of the largest breaches of personal data when Equifax, a major consumer credit reporting agency, reported a data breach. To this day, the Equifax breach is an example of the staggering scale and potential consequences of lax data security practices.

What Happened?

Attackers exploited a vulnerability, CVE-2017-5638, in the Apache Struts web application framework, which allowed unauthorized access to Equifax’s systems. The attackers were able to navigate the network and gain access to files containing personal information of over 147 million individuals, making it one of the most consequential breaches in history. The breach was not just extensive in terms of the number of affected individuals but also in the sensitivity of the data compromised, which included Social Security numbers, names, addresses, and birth dates. Additionally, credit card numbers for approximately 209,000 consumers were also accessed.

The leak of highly sensitive personal data opened the floodgates to potential identity theft and financial fraud, impacting millions of individuals not just momentarily but potentially for years to come. The breach raised alarm bells about the security measures employed by large corporations handling sensitive personal data.

It also brought to light the risks associated with centralized data collection and storage practices. The aftermath of the breach saw widespread public concern, a loss of trust in Equifax, and led to questions about the adequacy of existing data protection laws and regulations.

Impact on Cybersecurity Practices

Beyond the immediate financial losses and identity theft risks faced by the affected individuals, the breach prompted a reevaluation of data protection standards. It highlighted the need for organizations to prioritize robust cybersecurity measures, secure sensitive information, and promptly disclose breaches to affected parties. The Equifax breach catalyzed discussions around consumer privacy, spurring legislative efforts to enhance data security regulations.

Industry Response & Learnings

The Equifax breach highlighted the need to safeguard personal data not just as a corporate responsibility but as a societal imperative, pushing both businesses and policymakers to elevate their commitment to cybersecurity in an era of escalating digital threats.

The breach precipitated a significant shift in how personal data is managed and protected. It led to an increased emphasis on robust identity cybersecurity, data protection policies, and regulatory compliance.

In the wake of the breach, there was a concerted effort across industries to strengthen defenses against such vulnerabilities, including implementing advanced encryption, regular security audits, and comprehensive data privacy frameworks.

6 – Sony Pictures Hack (2014)

The cyberattack on Sony Pictures Entertainment intertwines digital vulnerability with international politics. The attack led to a massive leak of sensitive company data, including unreleased films, confidential employee information, and private executive emails. This breach not only had major implications for Sony’s operations and reputation but also brought to the fore the intersection between cybersecurity and ongoing geopolitical tensions.

What Happened?

Attributed to North Korean hackers, the attack was widely seen as a retaliatory act against Sony’s release of “The Interview,” a film that satirically depicted the fictional assassination of North Korea’s leader. The hackers managed to infiltrate Sony’s network, exfiltrating large volumes of proprietary data and subsequently releasing it to the public.

The leak resulted in financial losses due to the exposure of unreleased content, damage to Sony’s reputation owing to the disclosure of sensitive internal communications, and the personal impact on employees whose private data was exposed.

Impact on Cybersecurity Practices

The Sony Pictures hack prompted a swift and comprehensive response from the company, involving extensive forensic investigations and bolstered cybersecurity measures. It also led to a broader industry-wide discussion on the importance of protecting sensitive data against nation-state cyberattacks and the need for enhanced cyber defense strategies.

Industry Response & Learnings

The incident highlighted the potential weaponization of cyber attacks for political motives, signaling a paradigm shift in the landscape of cyber threats. Beyond financial losses and reputational damage, the hack underscored the vulnerability of major entertainment and media entities to state-sponsored cyber aggression.

Sony’s ordeal spurred a reassessment of cybersecurity strategies across industries, emphasizing the need for robust defenses against advanced persistent threats. It also prompted a reevaluation of the relationship between cybersecurity and freedom of expression in the face of state-sponsored cyber threats.

7 – Yahoo’s Data Breaches (2013 & 2014)

Yahoo fell victim to two massive cyber incidents in 2013 and 2014. The scale of these breaches was unprecedented, encompassing almost half the world’s population at the time. The breaches compromised the personal information of a staggering 3 billion Yahoo users, including email addresses, passwords, and security questions.

What Happened?

In 2013, attackers used forged cookies to access users’ Yahoo accounts without a password. By forging the web cookies, attackers could authenticate themselves as any Yahoo user without credentials.

In what was considered a separate breach in 2014, attackers gained access to Yahoo’s network via a spear-phishing campaign, targeting specific individuals within the company and tricking them into handing over credentials or installing malware, thereby giving access to Yahoo’s internal network.

Importantly, disclosure of the breaches did not occur until late 2016 and the full impact took until October 2017 to be fully understood. The delay not only compounded the risks associated with the breach but also raised serious questions about corporate responsibility and transparency in the face of cybersecurity threats.

The revelation of these breaches caused severe harm to Yahoo’s reputation, eroding user trust and raising doubts about the company’s commitment to data security, landing the company with severe penalties from the SEC. Additionally, these incidents significantly influenced Yahoo’s valuation and terms of its acquisition by Verizon, underscoring the substantial business risks associated with cybersecurity lapses.

Impact on Cybersecurity Practices

These breaches underscored the vital importance of securing user data and the potential long-term consequences of compromised information. Beyond the immediate fallout, such as legal consequences and financial losses, the incidents prompted a change in how organizations approach data protection. They accelerated the adoption of more robust encryption practices and heightened awareness about the vulnerability of user accounts to increasingly sophisticated cyber attacks.

Industry Response & Learnings

The Yahoo data breaches served as a pivotal moment for the tech industry, emphasizing the importance of cybersecurity vigilance and prompt incident disclosure. In response, there was a marked shift towards strengthening data protection measures, enhancing breach notification protocols, and reinforcing user data encryption. These incidents also played a role in shaping data privacy regulations and highlighted the necessity for ongoing investment in cybersecurity defenses.

Conclusion

The cyberattacks we’ve explored – from the Colonial Pipeline to Yahoo’s massive data breaches – serve as harbingers of the complex and evolving nature of cyber threats. Each incident, unique in its execution and impact, underscores a common theme: the paramount importance of proactive and comprehensive cybersecurity strategies.

These events have brought about significant shifts in how we perceive and approach digital security, reinforcing the need for vigilance, collaboration, and continuous adaptation in the face of cyber adversaries.

These historical lessons serve as valuable guides, reminding us not only to continue to apply the lessons learned from previous breaches but also that as we respond and adapt, so too do cybercriminals. Security is an endlessly shifting target and threat actors are incentivized to never sit still. We must not, either.

Enterprises worldwide have turned to SentinelOne’s Singularity Platform to proactively resolve modern risks at machine speed. Learn how SentinelOne works to more effectively manage risk across user identities, endpoints, cloud workloads, IoT, and more. Contact us or book a demo today.

As 2024 begins to unfold, the role of Chief Information Security Officers (CISO) is set to evolve as modern enterprises face new challenges in the ever-changing cybersecurity landscape. Once primarily focused on implementing security protocols and conducting periodic risk assessments, CISOs are now expected to be key decision makers, influencing corporate strategy and guiding their organization through the complexities of the current age.

The evolution of the CISO is not only a response to the growing sophistication of cyber threats but also a proactive measure to stay ahead of potential risks. This blog post delves into the evolving role of the modern CISO, from figures of security technical know-how to pivotal visionaries in strategic cybersecurity and business growth.

Changing With the Times | From Technical Gurus to Strategic & Front-Line Leaders

When the role of “chief information security officer” first came into being – recall the role didn’t exist before 1995 – the responsibilities of the CISO were centered around establishing and maintaining security protocols. Those in the role needed deep technical know-how in both networking and operating systems, including experience in implementing firewalls, conducting periodic risk assessments, and ensuring compliance with relevant regulations. The CISO served as a technical gatekeeper, responding to emerging threats as they surfaced.

Over time, as the cyber threat landscape continued to evolve, the CISO’s responsibilities expanded, with increasing involvement in policy development, risk management, and collaborating with other C-level executives to align cybersecurity strategies with broader business objectives.

The Changing Role of the CISO | Establishing Cybersecurity at the Executive Level and Beyond

Although the role of the CISO now can vary widely across organizations depending on their size and nature, it tends to lean much further into executive leadership and risk management, with a prime responsibility to keep C-suites in touch with security risks relating to organizational objectives, strategy and business outcomes.

Depending on the organization, the modern CISO will be involved in most of the following key areas of responsibility to some degree or another.

• Cyber risk management
• Compliance and regulatory adoption
• Strategic business integration
• Crisis management & Incident Response
• Establishing & cultivating a ‘Security First’ business culture

Let’s take a look at each of these in turn.

Cyber Risk Management

Central to the role of many CISOs is the responsibility for adopting a proactive and strategic approach to identify, assess, and mitigate cyber risks. This often includes developing comprehensive risk management frameworks that align with organizational goals.

Engaging actively with executive leadership, CISOs work to articulate the potential impact of cyber threats on business operations, financial stability, and company branding, collaborating where needed with department leads across the organization to foster a culture of cybersecurity awareness and compliance.

Compliance and Regulatory Adoption

CISOs play a central role in ensuring regulatory compliance, which involves both ensuring adherence and understanding the implications of regulations on day-to-day processes and overarching strategies.

Staying knowledgeable of regulatory changes and translating them into actionable policies is a shared responsibility that CISOs undertake to safeguard data privacy and integrity.

In collaboration with legal and compliance experts, CISOs navigate the intricate frameworks of requirements and controls set by GDPR, HIPAA, or PCI DSS, for example, and then tailor security measures to meet these standards. In addition, CISOs are counted on to cultivate a culture of continuous compliance through measures such as conducting regular audits and mechanisms to address and identify gaps.

In doing so, they help to not only mitigate legal and financial risks but also fortify the organization’s reputation and stakeholder trust.

Strategic Business Integration

The evolving nature of the role can be seen in the way that many CISOs are now increasingly viewed as critical enablers in the business ecosystem. In some organizations, their insights and expertise have become invaluable in shaping product development and influencing business strategies by driving technical innovation.

In this regard, they can be key to enhancing relationships with vendors and partners, fostering a security-centric approach in all business interactions and collaborations.

Crisis Management and Incident Response

With cyber threats becoming more sophisticated and pervasive, the modern CISO is not only tasked with preventing security breaches but also with orchestrating a robust incident response (IR) strategy.

They will play a central role in the development and implementation of incident response plans (IRPs), ensuring leaders from all functions are well-prepared in the event of a cyber incident. In many organizations, CISOs collaborate with cross-functional teams, including legal, communications, and IT, to streamline response efforts during a crisis.

In some cases, the role may extend to leading post-incident analyses to understand the root causes and improve response protocols. This typically involves actively engaging with external stakeholders, regulatory bodies, and law enforcement agencies to navigate the legal and reputational ramifications of a security incident.

As crisis managers, CISOs may be expected to steer the organization away from negative fallout after cybersecurity incidents with a strategic and agile approach, minimizing the impact of breaches and maintaining business continuity.

Establishing & Cultivating a ‘Security First’ Business Culture

The modern CISO recognizes the significance of cultivating a robust security culture within the organization. They champion awareness programs, training initiatives, and communication strategies to instill a collective responsibility for cybersecurity among employees.

At the same time, CISOs may be at the forefront of advocating for advanced technologies and innovative solutions to counter evolving cyber threats, leading the evaluation and implementation of cutting-edge tools, artificial intelligence (AI), and machine learning (ML) to fortify their organization’s defenses.

Emerging Trends Impacting CISOs in 2024

The cybersecurity landscape in 2024 brings forth a spectrum of new challenges and technological advancements, necessitating a dynamic and strategic approach from CISOs.

Regulatory Compliance and Transparency: The era of mandatory information sharing is ushered in with stringent cyber laws like the SEC cyber disclosure rule. This shift to obligatory reporting amplifies the need for enhanced cyber transparency, bolstering trust in an organization’s cybersecurity measures.

Security Management Amid Digital Transformation: As businesses rapidly evolve digitally, effective management of security postures is key. CISOs are tasked with maintaining control over digital assets while aligning security strategies with the swift pace of business demands, emphasizing the need for continuous adaptation and learning.

Upgraded Cloud Security: With the rise in data breaches within cloud environments, there’s an increased focus on developing sophisticated cloud security strategies. This trend underscores the importance of comprehensive identity and access management, data encryption, and continuous monitoring to safeguard cloud-based assets.

Enhanced API Security: Following the urgency for cloud security, CISOs are also turning their attention to API security. This involves a meticulous process of identifying all APIs within the organization and assessing whether existing tools suffice in terms of visibility, control, and compliance.

AI-Driven Security Tools: The advancement of AI technology has led to a surge in AI-driven security tools. These tools not only enhance defensive capabilities but also provide strategic advantages in optimizing the deployment of existing talent and resources.

Cyber Resilience: Facing an array of evolving threats, there’s a concerted effort to build a strong security culture and improve detection, prevention, and response capabilities. This includes comprehensive updates to business continuity plans, disaster recovery strategies, and incident response protocols, ensuring an all-encompassing approach to cyber resilience.

These emerging trends underline the need for CISOs to be proactive, adaptable, and strategic. The role of the CISO is progressively evolving, requiring a blend of technical expertise, strategic planning, and leadership skills to navigate the new challenges in the cybersecurity domain effectively.

What Lies Ahead for CISOs?

As paradigms shift in tandem with rapid changes in the cyber threat landscape, proactive CISOs can work to understand these changes and revamp security within their organizations.

We enter 2024 recognizing the importance of addressing not only traditional cybersecurity concerns but also much else that has only recently come over the horizon: the need to secure physical infrastructure, IoT devices, SCADA systems, and ensure the safety of remote personnel. Add to this the new focus on cloud security, AI and stricter regulatory and compliance rules and we face an expansion that reflects the growing complexity of cybersecurity, where the digital and physical realms intersect, demanding a comprehensive approach to secure diverse assets.

Further, the widened scope of responsibilities is extending beyond digital asset management to encompass holistic organizational risk. This approach involves identifying, assessing, and mitigating risks across all facets of the organization, ensuring resilience and continuity in an ever-changing threat landscape. CISOs are now integral to not just securing data but safeguarding the entire organizational ecosystem.

In providing resources, CISOs are equipping themselves with technical tools that aid core functions and support their expanded responsibilities. The arsenal includes technologies for threat intelligence, real-time monitoring, and adaptive defenses. As technology becomes more intertwined with business operations, CISOs will increasingly leverage advanced tools to stay ahead of cyber threats.

Conclusion

The landscape for CISOs in this new year continues to unfold, with emerging trends and innovative technologies impacting their strategies and responsibilities.

The role of CISOs in today’s world is multifaceted and dynamic, going beyond traditional IT security to encompass a wide spectrum of strategic, operational, and leadership responsibilities. As part of the cybersecurity community, CISOs are collectively striving to not only protect their organizations from cyber threats, but also to drive forward-thinking strategies that align with and support business objectives.

SentinelOne’s AI-driven Singularity platform is designed to support CISOs as they safeguard their organizations from current and future threats on all attack surfaces. SentinelOne offers two free eBooks, 90 Days | A CISO’s Journey to Impact – Define Your Role and 90 Days | A CISO’s Journey to Impact – How to Drive Success, as resources for CISOs working to implement best practices in their business. For in-depth expertise and guidance, contact us for more information or book a demo.

Welcome to 2024! It may be a new year for us all, but it’s very much business as usual for cybersecurity professionals. Last year saw an increase in the number and variety of new threats targeting the macOS platform, and as the influence of the Mac continues to expand in enterprise environments, there is little doubt that 2024 will continue that trend.

In this post, we reflect on the lessons we can learn from the last 12 months of threat activity against Apple’s desktop operating system, and offer 7 strategies for defenders to help bolster their threat hunting, detection and mitigation efforts.

1. Don’t Rely on Persistence for Detection

Perhaps the most important lesson that defenders learned from 2023’s crop of macOS malware was that monitoring for persistence methods became a much less reliable way of detecting and hunting threat activity.

2023 saw Mac malware make a significant shift away from OS persistence mechanisms, in part due to Apple introducing notifications for background login items. Instead, infostealers grabbed “all the good stuff” – online credentials, session cookies, keychains – and exfiltrated it in a single hit. Other threat actors made clever use of trojanizing regularly launched software, effectively using the victim’s own behavior as a method of persistence.

Atomic Stealer – (aka “Amos” / “Soma”) provided one of the most widespread examples of a number of different infostealers that emerged during 2023 that eschewed LaunchAgents, LaunchDaemons and other background login mechanisms. Instead, the malware makes use of an AppleScript password spoof to grab the user’s login password in clear text, and uses this to decrypt the keychain and access other stored credentials.

Having stolen everything – including those all important session cookies and internet account credentials – in one fell swoop, the threat actors had no need to ensure the malware ran again. Importantly, avoiding persistence meant evading detection via Apple’s recently introduced Login Items notifications, giving the thieves plenty of time to make use of the stolen credentials.

In a different approach, the SmoothOperator (aka 3CX Supply Chain Attack) campaign similarly avoided using OS persistence mechanisms, instead relying on trojanizing an application that the user would launch frequently.

A more elaborate version of the same idea was employed in the KandyKorn campaign, which trojanized the Discord application. A Mach-O payload was written to /Applications/Discord.app/Contents/MacOS/Discord by a previous malware stage, temporarily renaming the genuine Discord executable to .lock. When the user subsequently launches Discord, the payload renames itself to MacOS.tmp, renames the .lock file back to Discord, and executes both the genuine Discord binary and the previous stage malware, causing the entire renaming/reloading process to repeat.

2. Assume Users Can and Will Override Apple Security

Apple has done much work to improve macOS security in recent iterations of the operating system, focusing heavily on privacy and data protections (more on that below) as well as making improvements to its malware remediation tools (formerly MRT, now known as XProtectRemediator). Other changes are in development – in 2023, we saw the first signs of XProtect’s prototype “bastion rules”, which at present silently log access to various data files.

However, unlike iOS,  it is part of the DNA of macOS that users can, if they choose, perform actions that contradict the standing OS security policy. Users can execute unsigned code if they choose, or even override XProtect’s warning that a file is known malware.

The ability of users to override Apple’s built-in security is a boon for threat actors and a headache for Mac admins. Without deploying an enterprise-level security solution that prevents users from executing suspicious or malicious code, Mac admins are powerless to prevent social engineering attacks from compromising their networks.

In 2023, unsigned or ad-hoc signed malware were by far the most common threats seen across the macOS platform. Such malware was used by all levels of actors, from DPRK-aligned campaigns like RustBucket to infostealers like MetaStealer and Realst Stealer. Such social engineering ranges from sophisticated campaigns involving impersonation and engagement via social media to simply offering users cracked versions of software they do not wish to pay for.

In either case, the route to compromise involves only convincing the user to take a few extra steps to launch the malware. This works regardless of whether the user is admin or not.

3. Don’t Let iOS Exploits Come Back to Haunt Unpatched Macs

2023 saw a record number of zero days impact Apple’s mobile iOS platform, with multiple reports throughout the year of vulnerabilities said to have been exploited in the wild. Although these primarily targeted iPhone users, many of these bugs have a potential exploitation path on macOS.

As enterprise Mac users are under less pressure to update than iOS users, there is undoubtedly a large attack surface waiting to be exploited by attackers: It is not uncommon for threat actors (or, indeed, red teams) to await write ups from security researchers describing patched bugs and then develop exploits for them.

Seems someone has published an exploit for CVE-2023-32434, XNU kernel int overflow, one of CVEs in Operation Triangulation, presented in CCC. https://t.co/rDeMLkFHyf

— Meysam (@R00tkitSMM) January 2, 2024

The 19 zero days Apple patched in 2023 were less than 4% of the 515 patched throughout the year. For security teams defending macOS endpoints, keeping the OS up-to-date is a straightforward policy that should be implemented with as little delay as possible.

4. macOS Ransomware Makes Headlines, But Focus on Data Theft

With ransomware a leading cause of compromise of enterprise Windows systems and increasingly targeting Linux, Cloud and ESXi servers, any new ransomware threats targeting macOS are always headline news. Macs have remained stubbornly immune to major ransomware campaigns largely because locking individual endpoints (as opposed to servers) with no obvious wormable propagation method to spread from Mac to Mac means ransomware developers have had little motive to invest in developing Mac-specific ransomware payloads.

2023 saw the first signs that might change after researchers discovered a prototype LockBit payload for Macs. The macOS samples are compiled solely for the Apple ARM M1/M2 (aka Apple silicon) architecture. No macOS Intel sample is known at this time.

Importantly for concerned users, no occurrences of LockBit for Mac have been reported in the wild, no victims claimed, and no distribution method is known to be associated with the malware. The Mac variant appears to be a direct descendant of the LockBit for Linux variant first spotted in Jan 2022, and contains much the same code.

Another ransomware payload dubbed ‘Turtle’ also came to light in November. Unlike the LockBit sample, Turtle is written in Go and targets the Intel x86_64 architecture.

However, Turtle ransomware – while technically capable of locking files – has also yet to be seen in the wild or associated with any means of distribution. Given that the sample uses symmetric encryption with a hardcoded key, this also seems like a proof of concept, as victims could decrypt any locked files using the same key.

While it’s reasonably likely that threat actors will continue to experiment with macOS ransomware payloads, we maintain that file locking remains a low-priority threat for Mac defenders. As we have seen elsewhere in the ransomware ecosystem, extortion via data theft has become far more profitable for threat actors.

Given the continued increase in use of Mac computers by C-suite level executives and by developers with access to highly valuable proprietary code, we suggest that the most likely avenue for existing ransomware gangs to pursue regarding macOS targets is the same as the infostealers mentioned above: stealing data, login credentials, and keychains is by far the most lucrative way to extort money from enterprises with Macs in their fleets.

5. Monitor Where Apple’s Data Privacy Protections Fail to Tread

Much of Apple’s focus in hardening macOS over the last few years has revolved around extending a series of data privacy protections known as “TCC”: transparency, consent and control. Any Mac user of recent versions of the OS will have encountered TCC in some form or another: usually via prompts asking for permission to access folders such as the Desktop, Document or Downloads, or hardware such as the microphone or camera.

We have discussed TCC at length in the past, and much of what we said then remains true as we head into 2024. Threat actors (and researchers) continue to find multiple, creative ways around these controls, and patches for many known TCC bypasses figure prominently in 2023’s macOS updates. Others remain unpatched.

In addition to bypassing or hijacking TCC permissions of other applications, malware authors have also taken to simply avoiding writing or accessing folders that might require TCC consent. Two destinations that are always accessible to read and write that malware commonly makes use of are /Users/Shared/ and /private/etc/tmp (aka “tmp”). We’ve also seen some use of the separate /private/var/tmp and the Darwin users’ $TEMP directory for staging malware and downloading payloads.

Typically, these locations are used to create malicious application bundles or binaries, launch them, and then ask for permissions to access data of interest, an execution chain that can sidestep TCC controls just so long as the victim willingly offers up a password.

Defenders are advised to pay increasing attention to these locations particularly in light of the rise of infostealers that eschew persistence and other common behavioral patterns noted earlier.

6. Have Runtime, Will Travel | Treat Larger Downloads With Suspicion

Python 2.6 was an ever-present staple in the macOS environment, even long after the widespread adoption of Python 3 elsewhere, and macOS malware authors have a long history of abusing it. However, after Apple removed Python as a system binary, many threat actors responded by switching to cross-platform languages like Go.

In 2023, we saw a great deal of Go-based malware, from infostealers like Atomic to Cobalt Strike implementations like Geacon. In the wild, Geacon payloads were observed in what appeared to be targeted campaigns using phishing document lures and masquerading as fake enterprise-level software.

Along with Go, Rust payloads have also started to become more common. In some cases, malware authors that preferred to continue using python responded by packaging the python runtime with their malware.

Whether its Go, Rust or Python, all these approaches result in larger payloads as they carry their own runtime environment with them, a fact that macOS defenders can and should factor into their detection and threat hunting routines.

7. Secure the Software Supply Chain

Some of the severest attacks on organizations occur through the supply chain. The previously mentioned 3CX/SmoothOperator campaign is notable among these. A trend in evidence extending beyond last year involves compromise of open source software projects including libraries distributed via package managers and public repositories like PyPI, Crate.io and of course GitHub.

As threat actors continue to increase their focus on Macs in the enterprise, we expect to see further attention paid to vulnerabilities in widely used software, as well as the creation and spoofing of code repos for common tasks, particularly with the availability of LLMs like ChatGPT that can easily reproduce such code.

Last year, for example, JokerSpy malware appeared to be using a trojanized QR code generator to achieve initial compromise. The threat actors used an existing project for a commonly required task and inserted a small malicious file among the many legitimate files included.

This puts the onus on security teams to fully vet code introduced from external sources, to ensure that the code – once vetted – is versioned and maintained by the organization and that updates are also properly scrutinized. That’s not a simple task and it means thinking about a full dev/sec ops environment, or ensuring that macOS-related code is included in any dev/sec ops processes that currently exist.

Conclusion

Enterprise security has, for good reason, been focused on securing Windows systems for so long that it is easy to overlook the Macs in the organization’s fleet. Apple has worked hard to market Macs as ‘secure by design’, but the reality has always been that Macs flew under the radar because the incentive to target them was not nearly so great.

That’s a situation that’s been slowly but steadily changing for some years now, and a look back at 2023 should be enough to convince anyone that Mac threats are becoming both more numerous and more serious for enterprises. Just like other endpoints, Mac devices need to be protected with first-class security software to prevent threats and provide visibility.

If you would like to learn more about how SentinelOne can help defend the macOS devices in your fleet, contact us or request a free demo.