There has been a significant shift recently in the sophistication of network attacks as these morph from unstructured to structured threats. Users not only face a broader variety of security challenges but also have a tougher time in dealing with them in a cost effective manner. Those organisations which found that they were unprepared to deal with unstructured threats will have no hope now that the ante has been raised.

An example of the transition is the difference between Phishing and Spear-Phishing. Phishing plays on the law of numbers, randomly blasting out the scheme to a wide variety of potential victims. Spear-Phishing, however, is intelligence-based and targeted towards a particular establishment or victim profile. Yes, times are changing. The big question is how can we beat these adversaries?

Let's start by putting ourselves in the position of the adversary for a second. What resources do you need and what is your end-goal? As the attacker your goal is to exploit as many machines as you can (without getting caught) and you start by acquiring knowledge about the weaknesses on the victim's network. The advantage goes to who knows this information first, the victim or the adversary? I am grossly oversimplifying but the longer story is a whitepaper.

So the answer is simple, right? Just find all the weaknesses and fix them. Reality Check: no one can be effective working on a never-ending list of action items. The good news is that software tools can now analyse all relevant information for the potential victim before they are in the crosshairs of an active threat. By understanding what the potential threats are and how they relate to an individual network, the potential victim can protect their most valuable assets before an attack is launched.


In this game, intelligence is key.

The victim has no offence, so it is all about developing a proactive defence and reducing the target surface. As we know 'mytob' is noted as having 97 different variants. If you take away the line-of-site to the vulnerability, you have an advantage to the adversary even if they keep producing variations on the same theme.

The nature of the vulnerabilities and exploits is not new; it is what the adversaries do after they compromise the target that is the new and frightening challenge. The real problem is that the primary 'point of entry' remains a weakness in the target, allowing the attackers to fine tune their assault and hit a victim again and again. Why have the adversaries changed their behaviour? Because there is money to be made!