From simulation to emulation, four ways email attack simulation tools fall short
As long as there has been war, there have been war games. In 1812, a Prussian officer named George Reisswitz invented what is believed to be the first wargame called Kriegsspiel, a board game designed to simulate and train military tactics for officers. While this approach to training was fairly new at the time, the use of simulations to simulate real-world battles has since become commonplace and, of course, considerably more advanced.
Two centuries later, attack simulations have also played an important role in helping organizations prepare for and defend themselves against cybersecurity adversaries. In 1999, a former army officer with a keen interest in military simulation tactics started the Honeynet project that deployed decoy honeypot network computers. Their sole purpose was to attract attackers to help security researchers deconstruct the specific techniques hackers used to infiltrate their networks.
As the company has strengthened its network perimeter and improved its ability to deploy patches for known vulnerabilities in a timely manner, attackers increasingly rely on email attacks as their grapple to gain a foothold in the network. As noted in the most recent Verizon Data Breach and Incident Response report, the vast majority (67%) of data breaches are caused by social attacks such as phishing.
About the author
Eval Benishti is the founder and CEO of IRONS
That’s one reason why relatively new categories like Breach Attack Simulation (BAS) and Automated Penetration Testing have emerged as a way to continuously ‘stress test’ the effectiveness of checkpoints and identify the possible gaps. While these tools are sure to improve an organization’s overall preparedness, they are limited by one critical fact: a simulation is only as good as the data entered into the system. Because most simulation-based systems rely on fictional and outdated campaign scenarios, organizations are often lulled to sleep and not prepared enough to face the challenges of tomorrow’s email threat landscape.
Therefore, the next generation of email security systems will rely on emulators.
Simulation vs Emulation: What’s the Difference?
In the context of software, the terms simulation and emulation are often combined and used interchangeably. Still, there is an important distinction between the two: a simulation refers to the idea of replicating the overall behavior of a system, while emulators work by duplicating the environment itself. A simulator mimics the basic behavior of a system and provides a model for analysis (like a flight simulator), while an emulator behaves exactly like something else and adheres to all the rules of the system being emulated.
There are four main ways that simulation falls short against today’s emerging email threats:
Email authentication standards catch a lot of phish, just not the most dangerous
Indeed, email security has come a long way in the past decade. In particular, the wide adoption of authentication protocols such as DMARC, DKIM and SPF provide an important first layer of defense by authenticating the domain and identity of the sender. While these methods are effective in blocking spam campaigns and other potential malicious messages, they are largely ineffective in identifying and blocking targeted spear phishing attacks, such as corporate email compromise threats, that use login and other social security. engineering techniques, making them reputation-based email security gateways. And unlike simulation techniques based on historical campaigns – most of which are no longer effective – emulation-based systems are designed to use current and popular campaign attacks.
Past threats are NOT always a good indication of future threats
Today, almost all investment literature offers the same caveat to potential investors: “Past performance is no guarantee of future success.” Unfortunately, many of the same BAS tools that security teams rely on don’t have a similar disclaimer. While these tools provide organizations with a useful framework for scenario planning and allow them to run a higher frequency of simulations overall, their overall effectiveness is hampered by relying on historical or fictional email campaigns that do not support the trending phishing attacks that are currently taking place. accurately display. is used by threat actors.
PenTesting rarely comes close to real life circumstances
While PenTesting is a valuable tool for proactively identifying a range of vulnerabilities, as well as high-risk vulnerabilities that often result from a combination of minor vulnerabilities, they also require experienced analysts who spend hours manually conducting tests and writing reports. Additionally, organizations that do embrace PenTesting usually only run it occasionally. Perhaps most critical though, if these tests do not use realistic test conditions, the results will be misleading and the organization will believe it is better prepared than it actually is. As we’ve all learned, real attacks come without warning and in creative ways that are difficult for us to prepare.
As the Verizon DBIR report points out in this year’s report, “Many vulnerabilities have been discovered and many vulnerabilities found by organizations scanning and patching, but a relatively small percentage of them are used in breaches.” Of course, that doesn’t mean hackers won’t try to take advantage of an unpatched vulnerability. Rather, threat actors, regardless of their level of sophistication, are likely to always follow a path of least resistance. While vulnerability scanning should be part of any security toolbox, it is not designed to identify or thwart social engineering attacks as there is no malware or malicious payload to detect – just a bad actor with malicious intent.
Whether you are a military strategist or a corporate CISO, emulation is a powerful way to understand how an opponent can plan their next attack and how to prepare and respond to potential unknown threats. In the ongoing game of fault lines between attacker and defender, it is more important than ever that we go beyond the first generation of simulations and instead want to emulate real and current data in our threat assessment models.
The post From simulation to emulation, four ways email attack simulation tools fall short appeared first on WhatsNew2Day.