Story image

Exclusive: 'Bad guys aren't so bad' as cryptomining is a sign of conscience

22 May 18

Ransomware wreaked havoc on the world in 2016 and 2017, but recent studies show that it has been usurped as the cybercrime method of choice.

Cryptomining surged to popularity on the back of the meteoric rise of cryptocurrencies, with reports from Comodo and Sophos (among others) proving it has overtaken ransomware.

At the recent SolarWinds MSP Empower MSP event held in Amsterdam, I had the chance to sit down with SolarWinds MSP VP security architecture Tim Brown who spoke about the cybercrime landscape as a whole and what he thinks of cryptomining’s ascent.

“Cryptomining as an exploit when compared to other available methods isn’t so harmful. I think it's a sign that the bad guys aren’t so bad and don't want to cause harm unless necessary. The problem is that those machines that have been hacked for cryptomining could have easily been infected with ransomware or financial trojans, among many others,” says Brown.

“That machine is owned and therefore can take another role next time. Depending on what the miner did, the level on compromise on the device might be very benign and some of them are really good in only taking around 10 percent of your processor! They're designed not to disrupt, firstly to avoid detection but I believe also to cause less harm.”

Brown believes that with the imminent GDPR just around the corner, we will see a lot more breaches publicised – not necessarily because cybercriminals are becoming more prominent, but simply because they will be obliged to.

“Already businesses are disclosing a lot more than what they used in the past, as we’ve seen the negative impact of not disclosing in cases like Equifax and Uber. The original mindset for many was 'what can we get away with', but now businesses are realising that if they hide details then it's going to get a lot worse,” says Brown.

“Recently there have been some information disclosures where the system was just compromised, undoubtedly a result of the aggressive cryptomining that is going on. In the past the question that businesses would then ask was ‘if our system gets exposed to one of those, do we really have a breach as no data was stolen?’ This is why I see breach disclosures to increase.”

I then asked Brown about how businesses can protect themselves against internal threats, as they can spend infinite amounts of money on cybersecurity against external threats, but often the biggest breaches come from the inside.

“What you do is put controls in place so that very few single people can do full amounts of harm to your business. For example, a business that needs to provide updates to millions of end points can only do so with the permission of a number of people, not a single person. This effectively means the key to the 'crown jewels' are guarded by a team,” Brown says.

Brown also shared an interesting solution for the internal security conundrum that he is yet to implement with his team at SolarWinds MSP, but one that he would like to put in place in the near future.

“For people that have more access, you treat them specially. I'm a big fan of compensating and watching my 'crown' people more. I want to be able to take those people that need very high levels of access like my system admin and monitor their internal and external activities - and pay them 10 percent more for the hassle,” says Brown.

“To ensure the safety of our business, you have to give up some of your privacy but in return I will pay you more. That's the world we now live in.”

Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.