The Education Sector has always been highly targeted by cyber criminals and an increasing number of schools and colleges are now being seriously impacted by security incidents. Senior leaders and governors need to be aware that cyber security is an important management and governance issue. Poor cyber hygiene can affect a school’s ability to function, its reputation and its legal obligations to keep its pupils, staff, and parents’ personal data safe. With 47% of UK schools feeling underprepared for a cyber-attack we look at some of the challenges faced by schools.

The primary focus of schools & colleges is education and care, not cyber security. Security often goes under the radar and falls to under resourced IT departments, becoming easy targets for attackers. The information that can be obtained can be valuable and the reputational damage irreparable.

The key reasons for schools and colleges being targeted:

 - Schools collect and store a lot of personal information about staff, parents, and students including sensitive information such as grades, medical records, and contact information. This data can be valuable to cyber criminals, who may use it for identity theft, financial fraud, or other forms of exploitation.

Schools often have limited resources to invest in cyber security and will not have the same in-house expertise as enterprises. This can make schools an easy target for cyber criminals who look to exploit vulnerabilities in school IT systems.

Many schools use outdated technology, such as unsupported software and hardware which can often be much more vulnerable to attack. Schools may not have the resource or budgets to upgrade their technology regularly which can leave them exposed.

Research data and Intellectual Property held within Higher Education establishments can be of great interest to nation-state actors. Maintaining the integrity of research data held can be critical for the future and ensuring that data is properly protected against theft, alterations or deletion is extremely important.

Cyber security should be high on the agenda for any school with a reliance on IT and online systems. 

Both the school leaders and the governing body should want to ensure they are fully aware of cyber risks and have adequate precautions in place to protect against a cyber attack and be prepared should the worst happen.

Schools will already be following similar approaches when it comes to managing risks and responsibilities around GDPR and safeguarding pupils more generally, so the same needs to be applied to Cyber Security.

Schools often have limited budgets and staff, which makes it difficult to implement and maintain effective cyber security measures. This can leave schools vulnerable to cyber-attacks and data breaches.

Many teachers and school staff may not have the knowledge or training necessary to recognise and respond to cyber security threats. This can make it difficult for schools to identify and address security risks, leaving them vulnerable to attack.

With the increase of online and remote learning, especially prevalent during the COVID pandemic, schools must provide access to their systems and resources from outside the school network which can increase the attack surface for cyber criminals.

Remote learning has brought about the widespread use of cloud services to enable learning remotely. Unless configured securely and regularly reviewed, these platforms can allow for attackers to gain access to sensitive data via an alternative means.

A recent report released by NCSC and LGfL highlighted that many schools are not implementing basic security controls such as  Multi Factor Authentication (MFA) and Device Level Control. These are commonplace in enterprises, but a similar approach is needed in schools.

 - Some pupils may deliberately engage in malicious activities such as hacking into school systems.

Managed Threat Detection and Response for Schools

 service provides complete network visibility across On-Premise IT and Cloud Hosted applications with 24/7 human-led threat hunting, compromise assessment, rapid alerting, and threat containment.

Our Managed Detection and Response (MDR) services help by providing active monitoring and response to cyber threats, by detecting, investigating, and mitigating malicious activity before it causes significant harm. 

24/7 Human-Led Threat Hunting & Compromise Assessment

Rapid Alerting, Threat Containment & Remediation

Experienced, Vetted Cyber Analysts acting as an extension of your team

Enhanced protection against Phishing/Fraudulent Emails, Ransomware and Malware, Service Affecting Attacks (DDoS), Suspicious Activity, Data Exfiltration, Information Leaks and more.

Access to our Cyber Analysts during the year for talks, presentations and hands-on workshops using our cutting-edge technology to enhance learning and provide security awareness.

Get in touch with our team today for more information - 

The education sector has always been highly targeted by cyber criminals, we take a look at some of the challenges faced by schools.

Cyber Security Challenges in Education

In today's world, network security needs can be complex; something is always changing, and cybersecurity concerns often prove to be a daily nuisance for businesses.

Combining the two major strategies outlined in this post; vulnerability assessments and pro-active threat hunting will help you identify weaknesses and successfully deep dive into your network to identify if any systems have been compromised and take steps to remove malicious actors who may have slipped past your existing endpoint security.

A "vulnerability assessment" (also known as a "vulnerability analysis" or "VA") is a procedure for identifying, quantifying, and analysing security flaws in IT infrastructure.

The primary purpose of the VA is to identify any vulnerabilities that might harm the organisation's overall security and operations. Because of this, running VAs can assist you in efficiently reducing the likelihood of threats.

VAs, often used interchangeably with vulnerability analysis, are not the same as penetration tests; with a VA, we are not working towards the goal of compromising a system or exploiting a flaw; rather, the VA finds and measures the severity of a system's weakness, and decisions for effective changes can be made based on this information. When this procedure is established and performed on a regular basis and improvements are deployed swiftly and successfully, a VA can be a highly powerful tool, especially when combined with pro-active threat hunting.

A "threat hunt" is the pro-active search for cyber threats that could be hiding undetected in a network.

Cyber threat hunting delves deep into your network to uncover stealthy attackers who may have been there for months collecting data or obtaining credentials, allowing them to move laterally through your network and wreak havoc on your organisation.

In most security configurations, once an attacker has penetrated beyond the organisation's primary protections, they are free to do anything they want.

Actively conducting threat hunts is a method of shining a searchlight on your own internal network and catching them in the act.

Aside from allowing you to fully understand and have an effective idea of what your network looks like to an attacker, the two techniques complement each other very well.

If a VA identifies a newly disclosed vulnerability present on a system, in addition to patching/mitigating the problem, it is extremely important to know whether that system has already been compromised. Back-in-time threat hunts should be carried out across a variety of data sources to identify IoA (Indicators of Attack) and IoC (Indicators of Compromise), network traffic & log data patterns relating to the vulnerability can be used to determine whether those systems have already been compromised.

Telesoft takes this to the next level by merging the previously mentioned techniques and efficiencies into a well-formed and agile package.

Our SOC and Cyber Security Services are built on 30+ years of industry expertise and supported by our own state of the art cyber products, utilised by Governments and Telecommunications providers worldwide.

Our fully managed Continuous Vulnerability Assessment Service assists you identify, classify,  and address security risks and weaknesses. We  provide ongoing support and guidance  to effectively mitigate identified vulnerabilities across both internal and external, public facing systems.

To establish whether a host has already been compromised, we will conduct back-in-time threat hunts on your behalf based on the strategies, techniques, and procedures involved with exploiting the vulnerability.

Our skilled cyber analysts understand the complexities of safeguarding an organisation's infrastructure against both internal and external threats. They have extensive expertise in conducting vulnerability assessments and collaborating with customers to lower their attack surface and thereby improve their overall security posture.

Combining vulnerability assessments and pro-active threat hunting can help to identify weaknesses and deep dive into your network to identify if any systems have already been compromised

Vulnerability Assessments & Threat Hunting – Why you should be combining the two

 as a consequence of one of the most expensive ransomware attacks of all time. Businesses are changing as the world becomes ever more digital, and this change has created new challenging threats for enterprises across the globe. The CWT incident is just part of a much wider problem; cyber attacks cost the global economy an estimated 

. Businesses, often with inadequately protected networks, find themselves common targets of cyber attacks. 


A data breach is an incident whereby sensitive or confidential files are accessed or stolen by unauthorised individuals. This malicious activity can leave enterprises with significant challenges such as:

Losses of crucial data, especially if a proper backup system is not in place

Financial loss - through lost assets or ransomware

Clientele or employee information compromised 

Reputational damage; affecting stocks, customer trust and new business opportunities 

Average cost of a cyber attack for businesses

Enterprise cybersecurity is fundamental to prevent incidents that can cost millions; precisely $3.86 million per business on average. Reducing this cost requires prevention, and prevention requires a more encompassing protection strategy beyond conventional network monitoring and endpoint security. As modern networks continue to grow increasingly complex, we recommend complete visibility and proactive threat hunting to effectively minimise the risk to enterprises.

What Does Network Visibility Offer Beyond Endpoint Security?

Network visibility is a complete view over your entire network. It’s the ability to see all the data traffic flow, access records and so forth. Seeing everything that goes on within your own network is crucial to protecting it. 

Maximise your network visibility to detect threats

As an enterprise, you want to understand the ongoing operations within every level of your organisation. This same principle should apply to your cybersecurity strategy. Conventional enterprise network monitoring is no longer adequate in protecting your systems from modern, more intelligent threats. We recommend a thorough network visibility strategy, and the following tips to help you get started:

Introduce a network monitoring capability to identify and monitor devices and users that access your network

Look for patterns of traffic activity, highlighting anomalies

Utilise network visibility technologies which include Machine Learning (ML) and Artificial Intelligence (AI) that can thoroughly analyse your network and detect issues in real time, reducing the burden on analysts.

Visibility within your network provides your security teams with the opportunity to effectively discover risks, however, this is not possible without a thorough risk assessment. 

Risk assessments are appropriate at many levels of business - from enterprise down to individual projects. The common denominator is an analysis of key weak points or potential hazards. Monitoring for and preventing live threats should therefore not be the only practice as part of your network visibility. Understanding what’s on your network and the prioritization of assets will allow your security team to respond more effectively to a breach.

Network Threat Hunting to Identify Threats

Relying solely on endpoint protection to prevent data breaches is not enough when considering that the current dwell time for threat actors is roughly 100+ days. Proactively hunting for threats allows enterprises to find those threats that are going undetected and evading endpoint security solutions. This is beneficial as it provides an extra layer of defence for threats and another opportunity to detect them. It’s easy to confuse threat hunting with network monitoring or 

. Threat hunting is often supported by threat intelligence, while findings from active prevention can be added to your intelligence. While network monitoring is a passive form of defence, threat hunting is active and designed to find threats that have evaded other defence systems.

Whilst the skills, tools and personnel required to carry out effective threat hunting can become expensive for the average organisation, it is possible to benefit from outsourcing this capability to

The cost of network visibility; is it worth it?

Maximising the visibility of your own business network is crucial to ensuring the security of your work, your employees and your data. With a thorough protection strategy you can significantly reduce the risk of serious breaches and ensure your business continues to operate and thrive in the ever more digital world. Network visibility not only contributes to security but to the business as a whole. By reducing the risk of a data breach, you instill trust in customers, improving reputation and protecting the data you retain.

In July 2020, CWT global paid out $4.5 million as a consequence of one of the most expensive ransomware attacks of all time. Businesses are changing as the world becomes ever more digital, and this change has created new challenging threats for enterprises across the globe. 

Insecure Enterprise Networks: The cost of data breaches vs the cost of network security for businesses

The 2020 IoT (Internet of Things) security government report revealed that 49% of UK residents purchased at least one smart device since the start of the Covid-19 pandemic, while an average of nine smart devices are present in every UK household. As the IoT market continues to grow, it is important to set legislations that cover IoT cybersecurity and protect consumers from hackers. 

Privacy breaches, monetary fraud, and network resilience are amongst a few of the frequently-discussed topics when it comes to regulating IoT devices. In 2021, The European Commission introduced a new IoT regulation, expected to enter into effect mid-2024.

New Product Security and Telecommunications Infrastructure (PSTI) bill focuses on all smart devices. These include phones, tablets, fitness trackers, TVs, light bulbs, thermostats, and many more. The products exempt from this legislation include vehicles, smart meters, and medical devices as they follow a separate regulation. Furthermore, desktop PCs and laptops are not included as they already have antivirus software installed at the point of purchase. 

Failure to comply with the regulations outlined below could result in heavy fines of up to £10m of 4% of the global turnover along with up to £20,000 a day for ongoing cases. 

These are the new standards every IoT device manufacturer will need to adhere to: 

Many IoT devices come with weak, factory-set passwords that often remain unchanged by new device owners. This imposes a major cybersecurity threat as it makes the password easily guessable by hackers, who can gain access to the whole home network. As a result, this puts at risk private consumer devices, along with business laptops and other company devices a person might use while working from home.  

As the new IoT regulation comes into effect, manufacturers and users will be unable to set up easy to guess default passwords such as “12345” to ensure greater security. 

* Set a clearly outlined security updates period at the point of purchase

When consumers equip their homes with smart devices and appliances, they expect them to work without fail for years to come. However, the support for any security failures of such devices ranges from continuous to non-existent. If security problems aren’t promptly taken care of, the device poses a risk of exposing personal data and compromising its functionality. 

The PSTI bill states that each IoT device must present clear information on security updates available for the product at the point of purchase. The information must also state how long the device will be eligible to receive security updates. If the device has no updates, this must also be declared before the consumer purchases the product. 

* Manufacturers must employ a public point of contact who will be responsible for managing security-related product vulnerabilities

If a product is not compliant with set standards, manufacturers must ensure they have a public point of contact who will proactively respond to reports about flaws and bugs in products. 

The new legislation is an important step to improve network resilience, protect consumers’ privacy, and reduce the risk of monetary fraud. 

Manufacturers will need to make sure they adhere to every standard before putting their product on the market. Consumers will be able to rely on connected products without having concern over safety and personal data theft. 

As cyber threats evolve fast, it is important to stay proactive and ensure each IoT device remains fully functional, with safety measures in place to prevent a potential attack. 

“This is a significant step in establishing a comprehensive set of common European Cybersecurity standards for the products (including connected objects) and services brought to our market,” said Thierry Breton, Commissioner for the Internal Market.

International Data Corporation (IDC) estimates that by 2025, there will be 41.6 billion connected IoT devices. However, IoT regulations vary and the EU standards do not apply to the products purchased in the US. And while the European IoT standards are clearly set, the US is yet to follow the same lead. 

In December 2020, the US signed the IoT Cybersecurity Improvement Act which signalled a change in the IoT security sector. The bill states that the mandatory minimum security standards need to be updated at least once every five years. However, it only applies to IoT devices purchased with government money, there has been no clarity on whether this also applies to older, already-purchased IoT devices. 

California and Oregon’s IoT legislations

When it comes to IoT laws in different parts of the US, California and Oregon appear to be the only states that are closer to the UK and EU standards. 

The California IoT Act was introduced in 2020. It states that all IoT manufacturers should ensure reasonable security features that are appropriate to the function of the device. Oregon’s IoT law is fairly similar. Both acts also hold a ban on default passwords.

As of 2021, California and Oregon are the only two states with individual IoT regulations.

How to protect your network from IoT cyberattacks

While IoT regulations set a cybersecurity standard for all device manufacturers, it’s important to take extra precautions to protect your infrastructure’s network. 

To enable incident response and forensics in real-time, Telesoft developed highly scalable threat detection and visibility tools. These include: 

* FlowProbe – 400Gbps full network visibility and traffic monitoring

* CERNE – 100Gbps signature matching and “back-in-time buffer” 

* TDAC Platform – ultra-scale event orchestration, multi-layered threat detection and mitigation, Petabyte scale distributed storage

Find out more about how a managed threat hunting service can protect you from IoT cyberattacks by reading more about our TDAC threat solution and book a demo with our team today.

International Data Corporation (IDC) estimates that by 2025, there will be 41.6 billion connected IoT devices. However, IoT regulations vary and the EU standards do not apply to the products purchased in the US. And while the European IoT standards are clearly set, the US is yet to follow the same lead. 

IoT New Regulations

The Internet of Things (IoT) has surged in popularity in recent years, with consumers embracing interconnected technology to the point where there are now 35.82 billion IoT devices globally. IoT devices can streamline domestic life, control appliances remotely, communicate with one another and myriad other things. But with so many gadgets, appliances and accessories now having the capability to connect to the internet – and each other – these pieces of tech could leave individuals and companies vulnerable to attack from hackers.

Many IoT devices are designed to connect to one another for convenience and ease of use, they often have little to no security to protect them from malicious actors. And many IoT devices contain large amounts of personally identifiable information (PII). It’s clear to see why they might become a target for hackers.

IoT devices often come with a default password which consumers are unlikely to change after setting up the device, making it very easy for hackers to “mass takeover” multiple identical devices if they know the password.   

Lack of regular patches and updates and weak update mechanism

IoT software updates often fix bugs or security issues to prevent hackers. But many people overlook installing updates, and if these updates are not set to be done automatically, they risk leaving devices more vulnerable.  

IoT devices process and communicate using apps, services and protocols. This is where many IoT vulnerabilities originate from. From weak or no encryption, to poor device authentication and authorization, insecure interfaces put IoT devices at risk of attack.

One of the main problems with IoT security is that devices often contain highly confidential data – from video footage of rooms in a house to private health information. If this data is not sufficiently well protected it can become an easy target for hackers.  

IoT devices are often interconnected, meaning that once one device is compromised, hackers can use it to gain access to other connected devices. One such example took place in 2017 when hackers 

 through an IoT fish tank thermostat and were able to exfiltrate 10gb of data.

IoT devices like smart watches, smart speakers, and smart CCTV hold large amounts of private personal data, which makes them very attractive targets for hackers. The information they gather can be sold on the dark web.

Little to no security legislation for IoT devices

So far very few governments have set legal requirements for inbuilt security in IoT devices. California became the

 to specifically regulate the security of connected devices, but currently in the UK the government is still working on a

When an IoT network of devices is infected by botnet malware, they can be controlled by malicious actors. 

 have been known to be involved in Distributed Denial-of-Service (DDoS) attacks in the past. IoT attacks are on the rise, with

 reporting a 500% increase in overall IoT attacks year over year. The most common IoT botnets identified are:

Mirai – takes advantage of insecure IoT devices by scanning the internet for open Telnet ports, then attempting to log in using default passwords. In this way, it has been able to amass a botnet army.

Mozi – targeting routers and cameras. The malware builds a peer-to-peer network that it can use in DDoS attacks, remote command execution, and payload execution.

Gafgyt – targeting vulnerable IoT devices like Huawei routers, Realtek routers, and ASUS devices, which it uses to launch large-scale DDoS attacks.

Echobot – based upon the source code of Mirai, Echobot primarily targets IoT devices but can target other platforms including web servers and private data centres.

With 5G becoming increasingly accessible, IoT devices are also becoming more accessible to individuals and companies. Many organisations are planning to use 5G networks to support IoT devices. 5G enables IoT devices to run faster, with reduced latency and minimal cost. But using 5G without a private network or adequate security measures could put the privacy of organisations and individuals at risk.

If hackers can infiltrate the 5G network, they could gain instant connectivity to every IoT device running on that network, accessing private data and using the devices as an out-of-the-box attack tool for a 

. This could lead to higher density attacks using IoT due to increased connectivity, accessibility, and coverage. There is also limited 5G IoT visibility, which would make it difficult for cybersecurity teams to identify and remove malware before it has infiltrated the network of connected devices.

WHAT CAN ORGANISATIONS DO TO PREVENT A 5G IOT ATTACK?

For organisations that are planning to utilise 5G on their IoT network, operators need full visibility. Devices will inherently operate more at the edge of the network, and it’s not feasible to monitor all the endpoints at device level. This will lead to a larger attack surface, with attacks more likely to target IoT devices for the following reasons:

To gain access to PII on IoT devices such as smart watches for financial gain.

As an easier means of initial access into a private network. This may enable lateral movement onto a work device, such as a connected laptop, which in turn could provide access to the corporate LAN.

To amass a larger network of botnets, enabling greater DDoS attacks against victims.

The perimeter of enterprise networks has become ever more blurred, while the use of IoT devices becomes more intertwined with our personal and professional lives. PII will always be an appetising target for threat actors for financial gain, and at the same time so too will weak security within IoT devices. With these two factors coupled together (in addition to the potential new threat vectors for gaining access into corporate networks from private networks), there is a growing opportunity for threat actors to gain easier access to our networks and consequently more data.

Understandably there are a number of difficulties that surround implementing endpoint detection systems on devices, particularly where employees use personal devices to remote access their corporate networks. However, 

 can provide the additional visibility required to monitor malicious activity within a network, enabling identification of malicious command and control activity or growing botnets. This in turn enables a response to be effected at a higher level, maintaining network security.

What does the lack of IoT security mean for 5G? 

Any business of any size is reliant on their ability to protect and secure their technology, data and networks from the many threats that they face. Intrusion Detection Systems (IDS) are and have been an integral part of this defense system. The aim of deploying an IDS into a network is to be able to identify if something untoward is happening and hopefully to be able to trap and remediate a problem sooner rather than later.

Standard IDS systems are loaded with rules, and programmed to send alerts when they see something a Systems Administrator might not like to be happening, providing a first line of defence at the perimeter of the network. The alert, however, is a singular event and doesn’t really tell us anything about the bigger picture of the threat.

So, let’s say a system becomes infected with a bit of malware, such as Spyware that masquerades as potentially unwanted applications (PUAs) which is a form of malware—and a risk that many organisations underestimate or dismiss completely. However, spyware can steal user and company information, weaken the security posture of devices, and increase malware infections. A box standard IDS will only flag up seeing the malware chattering on the network, which is great, but we’re missing something: how did it get there, and where else is it?

 from Telesoft uses a specially designed feature called ‘intelligent record’ that answers this question – the alert will trigger a recording of everything going to/from that user’s PC for the last n seconds, filling in the vital missing information.  For example showing where they accessed the dodgy site, then where it was downloaded from, and so on, with this information we know how it got there, and we know where it may have been. This allows SOC teams to respond to the threat in a much more assertive fashion as they have a much better idea and clearer picture of what they are dealing with.

Updating Core Cyber Security Infrastructure: Intrusion Detection Systems (IDS)

A network security team can only fight what they can see, an organisation’s network security depends on their ability to rapidly detect and respond to emerging threats across their infrastructure, whether that is Tier 1 Operator, Enterprise or Cloud Provider. However, attack methods and strategies are constantly evolving, making threat detection an always-moving target. A good base to start from is understanding what type of threats may lurking in your network, these threats look very different depending on throughput of network traffic.

Effective cyber threat visibility, starts with real-time network security monitoring and behavioural analysis which gives system analysts a single pane of glass to look through to determine which threats pose the most amount of risk and which do not. For instance, an SME’s cyber security strategy is very different to that of a Tier 1 Operator, an SME’s strategy will look to detect threats such as Keyloggers, phishing e-mails and spam. Whereas for a Tier 1 Operator their biggest concerns may be a high volume DDoS attack or Cryptojacking.

 The scale of the challenge facing defenders is observable in the ever-increasing number of breaches and security incidents. It’s there in the amount of spending on cyber security tools and annual budgetary increases to protect vital assets. It’s there when names like WannaCry and Wypr become part of the popular culture and Stuxnet gets the documentary treatment from an Oscar-winning director. Those hit with an attack face many losses such as financial hits from the attack itself or in fines, plus they can quickly lose the trust of the market, forfeit a good proportion of their reputation for poor management, and will see the overall value of their brand drop.

As part of this project we wanted to include the perspective of those with expert knowledge, so asked a couple of top cyber security experts their thoughts on evolution of the threat detection and what that means for IT Security Professionals.

“More than anything, the overall maturity of large organization’s InfoSec program dictates how proactive they are, or can be, in stopping identified threats. This has a lot to do with their level of visibility into their own IT environment and their ability to react quickly to incoming attacks — specifically comprehensively deploying patches against newly published vulnerabilities. From my experience, it seems on the average most everyone is being pushed to steadily improve year after year. What’s been most interesting is that in my experience, a year or more after a large organization is breached, they tend to become far more secure than the average”. Jeremiah Grossman, 

CEO Bit Discovery and Professional Hacker  (

“Companies are investing in strategies to stop attacks at various points before an attacker can obtain his or her objective. Phishing, malware, and other attacks are prevented as best as possible with filtering, endpoint protection, and training, but even the best defense will still result in some attackers getting in. That is why companies deploy other technologies and services to monitor systems and networks and detect anomalies.

Furthermore, watching the pulse of today’s enterprise requires monitoring systems to extend across the enterprise’s myriad platforms, from corporate networks to the cloud. Alerts from monitoring systems are often combined with automated and manual incident response activities designed to stop attackers from leveraging system access or stolen credentials in a data breach or other cybersecurity threat. Today’s CIO’s, CISO’s and CSO’s know that it takes a 360-degree approach to detect today’s threats and robust incident response to stop cybercriminals from achieving their goals”. 

Eric Vanderburg, Cybersecurity, Privacy, and Tech Leader, Author, Consultant, and Speaker, VP  (

Cyber Threat Visibility: Which threats should defenders be looking for?

ENISA produced its first EU-report on Maritime Cyber Security back in 2011, warning of the low cyber security awareness and intelligence within the sector, the complexity of the ICT and the lack of cyber security policies. Further difficulty is added to this situation due to the fragmented nature of the maritime governance between different levels.

However, fast forward 8 years to 2019 and the first Transport Cyber security Conference was held in January highlighting the progress and awareness that is being made throughout the transportation industry, not just maritime.

Within the maritime industry over the last quarter alone there have been 2 separate incidents in which the US Coast Guard has sent out security alerts, highlighting the ongoing problem with cybersecurity policies and practices on board commercial vessels.

In May, a wave of spear-phishing emails were being sent out intending to spread malware across commercial vessels, posing to come from official US Port State Control authorities. The malspam campaign intended to spread malicious software that was designed to disrupt shipboard computer systems.

On July 9th the US Coast Guard published another alert indicating that a cyber security incident had impacted a vessel bound for the Port of New York. Whilst the malware on this occasion had not impacted the essential vessel control systems, there was ‘significantly degraded functionality of the onboard computer system.’

These are just the latest in a series of cybersecurity incidents on shipping vessels, however, and is not something that is considered a surprise to industry experts. A report published in 2018 by a conglomerate of 21 international shipping associations identified a ‘plethora of cyber security problems aboard ships, where investigations found ransomware, USB malware and worms on numerous occasions.’

The report also indicated interference with onboard automatic identification systems and electronic chart display and information systems, the jamming of global positioning systems and the manipulation of cargo and other ship and port systems, allowing access to ship manifests enabling the identification of crews and cargo.

The combination of such information has been linked to a hybrid of cyberattacks and physical piracy, whereby pirates have reportedly identified ships containing valuable cargo and minimal onboard security, providing a perfect target.

Whilst all of these incidents have happened through the introduction of malware/ ransomware etc within ports, the effects clearly may only be identified at sea. In either case, the malware would likely have already completed its task and caused unnecessary damage.

This highlights a growing trend with the ever more connected world whereby industries of all types need to ensure they are protecting their assets at every level. Networks such as those used within the maritime industry are already connected to the outside world, therefore it is essential that they are provided adequate levels of network security to protect their cyber threat intelligence.

Cyber Intelligence for Shipping assets

A UDP flood is a type of volume-based DDoS (Distributed Denial of Service) attack, where large numbers of UDP (User Datagram Protocol) packets are sent to a target server, limiting its ability to carry out its functions. UDP traffic doesn’t require a three-way handshake to make a connection like TCP (Transmission Control Protocol), it runs with lower overhead and is ideal to carry data that doesn’t need to be checked and rechecked, such as VoIP. This means it is easier for attackers to generate large traffic volumes with tools like 

When using this type of DDoS attack the primary aim is to overwhelm the target network with packets to random UDP ports with a forged source IP address. These requests force the target host to look for the application that is running on those random ports (which may or may not exist) and flood the network with Internet Control Message Protocol (ICMP) destination unreachable packets (Blackhole routing), thereby blocking legitimate requests. Blackhole routing is a commonly used technique used as a last resort against DDoS attacks by routing all traffic to a null route/address which inadvertently drops any packets.

This attack can be managed by deploying perimeter defences such as Intrusion Detection Systems and Anti-DDoS techniques in networks to filter out unwanted network traffic. The target network would then never receive nor respond to malicious UDP packets, however this does risk preventing legitimate traffic from accessing services.

A more granular approach is available in the form of BGP Network Layer Reachability Information (NLRI/FlowSpec). This encoding format allows for more specific attributes of traffic to be defined and propagated between routers. FlowSpec uses BGP to carry 12 attributes of information from Layer 3-4 to provide services similar to that of a Firewall Access Control List, BGP would be able to filter out traffic based on more specific criteria combinations made from the 12 attributes, resulting in more efficient DDoS mitigation.

Port number (matches source OR destination TCP/UDP ports)

It is thought that over 56% of DDoS attacks are UDP floods, which is why DDoS attack visibility is so important. Security analysts need the right tools to enable them to quickly determine the origins of an attack, trace its footprint within the network, identify the type of attack vector and if it is masking something more sinister such as data exfiltration.

In a carrier scale network DDoS attacks are an on-going challenge facing operators today, as resources for initiating a DDoS attack are becoming more readily available, so do the scale and frequency of the attacks.  Telesoft utilises unsampled flow monitoring to provide complete network visibility, allowing for comprehensive digital forensics and analysis to assist threat investigation teams. As well as attack detection and mitigation using the latest threat signatures, cyber intelligence and encryption standards available.

 with us to learn more about our cyber products or contact our sales team here.

A UDP flood is a type of volume-based DDoS (Distributed Denial of Service) attack, where large numbers of UDP (User Datagram Protocol) packets are sent to a target server, limiting its ability to carry out its functions. UDP traffic doesn’t require a three-way handshake to make a connection like TCP (Transmission Control Protocol), it runs with lower overhead and is ideal to carry data that doesn’t need to be checked and rechecked, such as VoIP. This means it is easier for attackers to generate large traffic volumes with tools like Low Orbit Ion Cannon (LOIC) and UDP Unicorn.

Breaking Down DDoS UDP Flood Attacks

What is a Content Delivery Network (CDN)?

A Content Delivery Network or CDN is a system of distributed servers and nodes that delivers web content to a user, based on the geographical location of the user, the origin of the webpage and the content delivery service. The purpose of the CDN is to avoid bottlenecks that would occur if every user tried to access content from one central location, the CDN replicates and redirects content so it is available to many users all at once. Ultimately improving user experience across multiple geographical locations (i.e. not just to those users who are physically closest to the server with the original content) and easing pressure on network infrastructure resources.

CDN servers and nodes are usually deployed in multiple locations, often over multiple backbones, generating huge amounts of network traffic. The network topology of a CDN is set up this way to reduce bandwidth costs, improve page load times and increase global availability of content. The number of nodes and servers making up a CDN varies, depending on the architecture, large deployments could be made up of thousands of nodes with ten thousands of servers on many remote points of presence (PoPs).

As with any network in today’s world of always on, available anywhere streaming services and IoT, CDNs are susceptible to cyber-attacks. A CDN providers reputation lives and dies on maintaining user experience; slow load times and diminished application performance is the absolute worst case scenario in terms of brand reputation, especially in an age of social media where network problems can go viral within minutes of an issue occurring.

The dominant type of attack facing a CDN is the Distributed Denial of Service (DDoS) attack, which could range from Dynamic Content, SSL- based to Direct IP Attacks. A Dynamic Content attack for instance occurs when hackers take advantage of the dynamic content requests process. Requests for dynamic content are sent to the origin server, attackers hijack this function and generate attack traffic that contains random parameters in the HTTP GET requests because CDN servers immediately redirect this attack traffic to the origin, expecting the origin’s server to handle the requests. But, in many cases, the origin’s servers do not have the capacity to handle all those attack requests, blocking the request pathway to legitimate users, creating a DoS.

SSL-based DDoS attacks seek to target secured online services of a potential victim. This type of attack is easy to launch and difficult to mitigate, meaning a SOC team will see them often in their networks. In order to detect and mitigate DDoS SSL attacks, CDN servers must first decrypt the traffic using their customer’s SSL keys. If the customer is not willing to provide the SSL keys to its CDN provider, then the SSL attack traffic is redirected to the customer’s origin, leaving the customer vulnerable to SSL attacks. SSL attacks that hit the customer’s origin server can easily take down the secured online service.

A Direct IP attack targets applications that are serviced by a CDN, by launching an attack on the IP address of the web servers at the customer's origin. This is often a network-based flood attack such as an 

 or ICMP flood that will not be routed through CDN services, directly hitting the servers of it’s customer at the origin. Volumetric network attacks can saturate the internet pipe, resulting in taking down all of the applications and the online services of the origin, including the ones that are served by the CDN. Often misconfiguration of “shielding” in the data centre can leave applications directly vulnerable to attack.

CDN Monitoring, Mitigation and Prevention

Large scale CDN operators offer DDoS mitigation and prevention as a service, thus ensuring the delivery of their customer’s content. So, how are they able to detect this type of attack and others? When researching a cyber security strategy in this space, 

 for total network visibility is once again key to understanding traffic patterns, spotting anomalies and blocking threats in your network. Another factor to consider is alert fatigue, system analysts can become overwhelmed by irrelevant alerts, however you can only determine relevancy if you have the right analysis tools that can calculate the severity of the attack and then group in to silos to either be kept for further analysis or dropped i.e. video traffic for example (lots of it but generally safe).

A flow record, whether analysing the header information or the amount of packets arriving at a server or node can provide a treasure trove of information for System Analysts. However, analysing this detail in real-time and at carrier scale is difficult but companies like Telesoft have made it their business to do this by providing scalable security monitoring and network behavioural analysis. 

 to find out how our solutions can build in to your cyber security strategy.

Protecting a Content Delivery Network (CDN) from cyber attacks

Legacy telecommunications protocols have stood the test of time, underpinning the foundations of our day-to-day communications. Many of the early 2G and 3G protocols still exist within our network having been utilised for many decades, although security for these protocols has long been overlooked.

Network operators have supported communications across the globe for many years, resulting in them being considered a part of our Critical National Infrastructure (CNI). Whilst network communications protocols have evolved over the years, the likes of SS7, GTP-C, BGP and Diameter remain commonly used. However, as some of these are considered to be legacy protocols (as in they have been used for many decades) they have not previously had to face the security concerns that our networks are facing today.

With threat actors and cyber criminals becoming ever more sophisticated, constantly evolving their techniques and tools which they utilise to compromise networks, many are now looking towards mobile networks as a ‘low hanging fruit’ for exploitation. That is to say that these protocols can be readily exploited and there is much less security focus placed on them today then there are within the cyber domain. Exploitation of such protocols can enable threat actors to gain information which can facilitate location tracking, digital identify theft, financial fraud and theft, data/call intercept, and many more.

This has resulted in an increase in targeted attacks against mobile networks and whilst existing solutions such as firewalls exist, which can be and are currently implemented widely across telecoms networks utilising comprehensive rulesets such as those provided by the GSMA, attacks are still capable of evading detection. This raises questions around the security of these networks and whether utilising firewalls alone is sufficient.

Monitoring Beyond Network Firewall Security

For many years within the cyber domain there has been a drive for enhancing the security of a network, from firewalls and antivirus solutions to Endpoint and Network Detection and Response (EDR and NDR) solutions. One of the key conversations in the industry today is around ‘how can we improve?’  These solutions are constantly looking to develop their capabilities, be it through utilising more rulesets to detect malicious activity, monitoring more endpoints, monitoring logs from multiple devices and pulling them to a single solution where the information is stitched together to highlight potentially malicious activity through anomalous behaviours, supported by technologies such as machine learning and artificial intelligence. In addition to this, there is also a drive towards the concept of ‘proactive defence’.  With this mind set, we no longer purely rely on technology to alert us to incidents/events, but we can now leverage this technology to actively investigate the masses of data generated by our systems and networks in order to hunt for threats within the network, identifying threat actor’s operations before they are able to carry out actions on their objectives.

This proactive defence not only helps to reduce Mean Time to Detection (MTTD), but also reduces Mean Time to Response (MTTR) and puts the advantage in the corner of the blue team, enabling informed and considered decisions to be made prior to an attack, instead of in response to one. So, if this technology is being utilised within the cyber domain, why shouldn’t it be used within the mobile domain?

Telesoft Technologies Ltd have developed the Mobile Signalling Probe to complement our existing network monitoring platform, the Telesoft Data Analytics Capability (TDAC), enabling extended visibility beyond the cyber domain and into the mobile environment. The Mobile Signalling Probe has been designed to be integrated seamlessly into existing network infrastructure at convenient monitoring locations and is capable of unsampled traffic monitoring across the 2G, 3G and 4G and 5G networks, and enhancing the existing firewalls and security solutions in place. As firewalls have been designed to detect and stop malicious traffic through dropping of bad packets, they do not store any data related to the traffic passing through. The Mobile Signalling Probe is not only capable of monitoring all of the network traffic, but also provides the storage required and the threat hunting capability to autonomously search for known and unknown malicious signalling messages.

Through extraction and storage of metadata and signalling control plane messages from the network, including common protocols such as SS7, GTP-C, BGP and Diameter, records are generated and egressed to a secure, scalable data lake. This enables analysts and threat hunting teams to investigate the masses of data collected and to understand if there are malicious activities existing within the network beyond those identified and stopped by the existing firewalls.

This capability is not only able to enhance existing security postures across the mobile environment but aims to support the Telecommunications industry in achieving the goals laid out by the National Cyber Security Centre (NCSC). In the summary of the ‘

Security Analysis for the UK Telecoms Sector’

“Operators must today consider that any inbound signalling may be malicious and treat it appropriately. Without the implementation of appropriate mitigations by operators, malicious inbound signalling could impact the availability of core network nodes, extract network or user metadata, or reroute user calls or data.”

The document goes on to discuss that network operators must take a ‘proactive approach to monitoring for threats, including the use of threat hunting where appropriate.’ It is likely that over the coming months or years network operators will be faced with additional requirements surrounding monitoring, analysis, and data retention of communications on their network. The potential impact and requirements to be placed on network operators has been considered throughout the design and development of the Mobile Signalling Probe, including long term data retention for data protection requirements.

If you are looking for solutions that can provide deep network visibility and can help secure your mobile and cyber environments, then 

get in touch with our experts today to discuss…

Securing Mobile Networks

NETWORK VISIBILITY IS KEY TO DEFENDING AGAINST ADVANCED PERSISTENT THREATS

APT groups are constantly seeking new targets and evaluating opportunities for data espionage, sabotage, and theft. One of the keys to mounting a robust defence is cyber security visibility.

RESOURCES

Cyber Security

Cyber Security

Cyber Security Challenges in Education

Cyber Security

Vulnerability Assessments & Threat Hunting – Why you should be combining the two

Cyber Security

Insecure Enterprise Networks: The cost of data breaches vs the cost of network security for businesses

Cyber Security

IoT New Regulations

Cyber Security

What does the lack of IoT security mean for 5G?

Cyber Security

Updating Core Cyber Security Infrastructure: Intrusion Detection Systems (IDS)

Cyber Security

Cyber Threat Visibility: Which threats should defenders be looking for?

Cyber Security

Cyber Intelligence for Shipping assets

Cyber Security

Breaking Down DDoS UDP Flood Attacks

Cyber Security

Protecting a Content Delivery Network (CDN) from cyber attacks

Cyber Security

Securing Mobile Networks

Cyber Security

Infographic: The cyber security visibility puzzle

Cyber Security

FaceApp – a big data security threat or just smoke?

Cyber Security

Data generation is increasing, so too should data storage

Cyber Security

The Evolution of NFV Network Visibility and Security at Scale

Cyber Security

What do you mean we are flying blind?

Cyber Security

Part 2 : What is driving the growth of Edge technology and where is it heading?

Cyber Security

The APT Series Part 2 ‘APT33’

Resources Hub