Story image

Exclusive: 'Bad guys aren't so bad' as cryptomining is a sign of conscience

22 May 18

Ransomware wreaked havoc on the world in 2016 and 2017, but recent studies show that it has been usurped as the cybercrime method of choice.

Cryptomining surged to popularity on the back of the meteoric rise of cryptocurrencies, with reports from Comodo and Sophos (among others) proving it has overtaken ransomware.

At the recent SolarWinds MSP Empower MSP event held in Amsterdam, I had the chance to sit down with SolarWinds MSP VP security architecture Tim Brown who spoke about the cybercrime landscape as a whole and what he thinks of cryptomining’s ascent.

“Cryptomining as an exploit when compared to other available methods isn’t so harmful. I think it's a sign that the bad guys aren’t so bad and don't want to cause harm unless necessary. The problem is that those machines that have been hacked for cryptomining could have easily been infected with ransomware or financial trojans, among many others,” says Brown.

“That machine is owned and therefore can take another role next time. Depending on what the miner did, the level on compromise on the device might be very benign and some of them are really good in only taking around 10 percent of your processor! They're designed not to disrupt, firstly to avoid detection but I believe also to cause less harm.”

Brown believes that with the imminent GDPR just around the corner, we will see a lot more breaches publicised – not necessarily because cybercriminals are becoming more prominent, but simply because they will be obliged to.

“Already businesses are disclosing a lot more than what they used in the past, as we’ve seen the negative impact of not disclosing in cases like Equifax and Uber. The original mindset for many was 'what can we get away with', but now businesses are realising that if they hide details then it's going to get a lot worse,” says Brown.

“Recently there have been some information disclosures where the system was just compromised, undoubtedly a result of the aggressive cryptomining that is going on. In the past the question that businesses would then ask was ‘if our system gets exposed to one of those, do we really have a breach as no data was stolen?’ This is why I see breach disclosures to increase.”

I then asked Brown about how businesses can protect themselves against internal threats, as they can spend infinite amounts of money on cybersecurity against external threats, but often the biggest breaches come from the inside.

“What you do is put controls in place so that very few single people can do full amounts of harm to your business. For example, a business that needs to provide updates to millions of end points can only do so with the permission of a number of people, not a single person. This effectively means the key to the 'crown jewels' are guarded by a team,” Brown says.

Brown also shared an interesting solution for the internal security conundrum that he is yet to implement with his team at SolarWinds MSP, but one that he would like to put in place in the near future.

“For people that have more access, you treat them specially. I'm a big fan of compensating and watching my 'crown' people more. I want to be able to take those people that need very high levels of access like my system admin and monitor their internal and external activities - and pay them 10 percent more for the hassle,” says Brown.

“To ensure the safety of our business, you have to give up some of your privacy but in return I will pay you more. That's the world we now live in.”

ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
'DerpTrolling’ faces jail time for Sony DoS attacks
A United States federal court has charged a 23-year-old man for the hacks on Sony Online Entertainment and other major companies back in 2014.
Dropbox strengthens security with raft of new partnerships
Integrations will keep customer content protected and secure with tools for controlling identity access, governing data, and managing devices.
Companies swamped by critical vulnerabilities – Tenable
Research has found enterprises identify 870 unique vulnerabilities on internal systems every day, on average, with over 100 of them being critical.
Exclusive: Okta’s new GM shares its APAC strategy
“We believe that partnering with systems integrators, independent software vendors and consulting companies is a key factor of success for Okta.”
Three access management trends making waves in APAC
Consumer identity proofing, authentication, and authorisation will top the $37 billion value mark by 2023.
Combatting the rise of Cybercrime-as-a-Service
Amateur cybercriminals (or anyone with a grudge), can execute spam attacks, steal people’s identities, and more. 
ThreatQuotient partners with Visa for payments safety
“Cyber criminals are reusing tactics, techniques and procedures, leaving a recognisable trail of breadcrumbs and insights into the very attacks they are launching.”