A modern hacker will rarely attack an updated strong firewall head on.  It is far easier to use the openings in the firewall to attack the systems and users in the Operational Zone (OZ, the part of your network where your users work and where your least sensitive information assets are held) behind the firewall.  The organizations targeted in Operation Aurora and Operation Shady RAT had strong firewalls in place.  The hackers who attacked those organizations, including two Government of Canada departments and one agency in the case of Operation Shady RAT, did so by using a Spear Phishing attack against the users in the OZ.   The targeted users inadvertently installed malware which made an outbound connection through the strong firewall to the hackers.  This outbound connection gave the hackers long term access to the OZ from which to launch the second stage of their attack against the servers in the OZ and the Security Zone (SZ, the part of your network where your more valuable information assets are held, where users normally don’t work directly, and which is separated from your other network zones by an internal firewall).

Most modern hacking attacks use this approach so it is essential to assume that you are no longer protecting your network from a hacker who is outside your firewall.  You must now concentrate on protecting your information assets from a hacker who is inside your network.  By far the most important aspect of this effort is to limit a hacker’s ability to move from their beach head within your network to the machines which house your sensitive or valuable information assets.  With the rise of hacktivism (politically or ideologically motivated hacking) and socialized hacktivism (which is coordinated using social media) it is also possible that one or more of your network users will be aware of and may even be sympathetic to or participate in the attack.

A strong border firewall is an essential element of any security posture and having a strong firewall is nearly infinitely better than not having one.  Once your border firewall is up, however, it does little more than to establish a border to your defendable network enclave.  A border firewall is simply a barrier that a hacker must get past to own your network and your information.  The border firewall, like everything else on your network, must be updated regularly and quickly to remain effective.

There are several things that you must do including deploying strong internal firewalls to separate your sensitive and valuable information assets from your network operational zone, patching network devices, workstations, and servers as quickly as possible, and testing continuously to ensure that your patched systems are in fact secure.

A good way to ensure that you understand the extent of your organizations vulnerability from both an external and an internal perspective is to employ an on-demand penetration testing tool. This is particularly important for companies which hold trade or national secrets, handle large amounts of money, or hold large amounts of personal information (defense contractors, financial institutions, law firms, etc.).   We have recommended and used  Core Security’s IMPACT Professional with great results.  Tools such as IMPACT Professional allow your risk management and operations teams to penetration test systems during Certification and Accreditation or following patches, installs, or restores and to test those systems again whenever necessary.

Impact’s big brother, CORE INSIGHT Enterprise, automates and schedules the penetration testing effort using the CORE IMPACT Pro engine.  Risk Management professionals provide basic network information, define what test are to be run, and define campaign parameters and INSIGHT Enterprise automatically tests your systems for open, exploitable vulnerabilities and reports when they are found.  Your Risk Managers can also define a goal, such as your most critical systems or those holding your most sensitive or valuable information assets and INSIGHT Enterprise will crawl your network looking for ways to reach and exploit those goals.   INSIGHT Enterprise will produce network maps showing attack vectors that it has found that give it access to those defined goals so that you can close those vectors.  INSIGHT Enterprise will then repeat those campaigns on the schedule that you define looking for new open exploitable vulnerabilities and vectors to reach its defined goals.

Both products take advantage of more than 2,500 exploits which can test more than 10,000 unique targets, with new exploits added automatically as they are discovered often at the rate of between 30 and 50 per month.  The highly sensitive results of these penetration tests stay within your organization, providing the highest level of confidentiality while providing insight to areas of increased risk.