Netskope named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge. Get the report

close
close
  • Why Netskope chevron

    Changing the way networking and security work together.

  • Our Customers chevron

    Netskope serves more than 3,000 customers worldwide including more than 25 of the Fortune 100

  • Our Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

Still Highest in Execution.
Still Furthest in Vision.

Learn why 2024 Gartner® Magic Quadrant™ named Netskope a Leader for Security Service Edge the third consecutive year.

Get the report
Netskope Named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge graphic for menu
We help our customers to be Ready for Anything

See our customers
Woman smiling with glasses looking out window
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

Learn about Netskope One
Abstract with blue lighting
Embrace a Secure Access Service Edge (SASE) architecture

Netskope NewEdge is the world’s largest, highest-performing security private cloud and provides customers with unparalleled service coverage, performance and resilience.

Learn about NewEdge
NewEdge
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Netskope video
The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
Designing a SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through security service edge (SSE)

  • Events and Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

On Patents, Trolls, and Innovation
In this episode host Emily Wearmouth chats with Suzanne Oliver, an intellectual property expert, and Krishna Narayanaswamy, co-founder and CTO of Netskope, about the world of patents.

Play the podcast
On Patents, Trolls, and Innovation
Latest Blogs

Read how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Replay sessions from the fourth annual SASE Week.

Explore sessions
SASE Week 2023
What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn about Security Service Edge
Four-way roundabout
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Leadership chevron

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Customer Solutions chevron

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification chevron

    Netskope training will help you become a cloud security expert.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working

The Cyber Kill Chain in the Age of Cloud

May 13 2019
Tags
security governance

The cyber kill chain is used to model a cyber intrusion, identifying the different stages involved in a cyber-attack. The model is well established, but recently I have been asked multiple times to help information security teams understand the ways in which the kill chain has changed with the advent of cloud applications. In this blog post, I will summarize how I normally answer this question, showing some examples of malicious campaigns that have made use of the cloud to evade traditional security technologies.

There are multiple ways to represent the cyber kill chain but its simplest form involves seven stages.

A close up of a logo  Description automatically generated
  1. Recon: typically used in targeted attacks, in this phase the attackers gather intelligence about their victims.
  2. Weaponize: in this phase, malicious actors prepare their attack vectors (for example develop the payloads used for the attack or setup the infrastructure).
  3. Delivery: this phase is where the malicious payload is delivered to the designated victim (for example via a spear-phishing email or a drive-by campaign).
  4. Exploit: if a vulnerability is exploited to execute code on the victim’s system, it will occur in this phase.
  5. Install: the malware is installed in the compromised system
  6. Callback: once the malware is successfully installed, it will check-in to the attacker’s command and control infrastructure (from where the attackers can control the asset).
  7. Persist: in this phase, the attackers can move laterally or dig deeper into the compromised organization.

It is important to note that not all steps of the kill chain are used in every attack. The first and last stages ‘Recon’ and ‘Persist’ typically feature in targeted attacks.  Gathering intelligence about the victim’s habits and vulnerabilities is needed to tailor the attack and increase the possibilities of success, while persistence is needed to establish a deeper, consolidated relationship with the victim, enabling the malicious actor to benefit from the compromised organization for months or even years.

The duration of an attack can differ wildly depending on its nature. Opportunistic attacks must be executed quickly, and the end value to the malicious actor often hinges on the number of the victims rather than their “quality”.  However, even opportunistic attacks have been known to feature ‘Persist’, lasting for months beyond the initial incursion, for example, when a generic endpoint is enslaved by a botnet.

Exploiting Cloud Services Inside the Cyber Kill Chain

The fears of cautious security professionals are undoubtedly correct; if not correctly secured, cloud services can increase the attack surface for an organization, and at multiple phases of the kill chain.

Recon

The Recon phase can use multiple methods to gather intelligence from a victim, including research into vulnerable elements in the infrastructure or humans. The growing adoption of cloud services simply gives attackers additional entry points: malicious actors can research which cloud services are in use by their victims (for example to create fake login pages delivered via spear phishing), or scan for misconfigured or publicly accessible cloud resources that can be exploited to break into the targeted organization. They can also take advantage of sensitive information inadvertently shared in apparently innocuous cloud services.  In March it was reported that searching just 13% of all GitHub public repositories over a period of six months revealed more than 100,000 repos leaking API tokens and cryptographic keys.

Weaponize and Exploit

The Weaponize phase sees the malicious actor setting up the necessary infrastructure for their work (phishing pages, malware distribution points, exploit kit landing pages, or command and control domains). Today, these resources can easily be hosted on cloud services. It is increasingly common to see malicious campaigns distributing their payload from cloud services, and even using cloud services as a safe haven for their command and control. The reasons for this are both straightforward and familiar to the enterprise IT team; cloud services offer unmatched resiliency and availability, scalability at a manageable cost, allow the creation of resources with a single click.  

Perhaps even more importantly, cloud services are all too often not inspected or are completely allow listed by traditional technologies which cannot effectively recognize and analyze context.  Here we see the role of cloud in the Exploit phase of the Cyber Kill Chain. A context-aware system would notice data that is being dropped into an AWS or Azure instance external to the organization, but traditional security technologies cannot do this. So cybercriminals use cloud services to evade detection and remain under the radar of traditional security solutions.

Delivery

Once the malicious infrastructure has been constructed, the next logical step is the Delivery of the attack vector from the cloud. Phishing pages can now be served from the cloud, as can any other potentially malicious payloads. It is worth notice that serving phishing pages from the cloud is in fact particularly effective since the fake login page presents a legitimate certificate and a URL that sounds familiar to the user, and ultimately breaches the ‘human firewall’. A malicious payload delivered from a known cloud service has a higher probability of being executed as the user implicitly trusts the source, despite any possible pop-up warning. We have also identified campaigns abusing cloud services as redirectors to malware distribution sites used for targeted attacks.

Another way to exploit cloud services in the delivery phase is to create fake cloud application login pages (mimicking the ones used by the victims) with the purpose of luring the victims and “phishing” for their credentials, or even worse, steal their OAUTH token (something successfully engineered in both opportunistic and targeted attacks in the past).

Callback

Once the malware is installed, it needs to connect to its command and control infrastructure (Callback). Attackers can use this connection to leak information, enslave the compromised endpoint in a botnet to launch DDoS attacks or spam campaigns, or establish a foothold to move laterally and dig deeper into the victim organization. And guess what? Again, the cloud plays an important role in this phase, as the attackers can use trusted cloud services like AWS and Google Drive, as well as popular applications like Twitter or Slack, to hide the communication channel. The reason is always the same: evasion. As explained in the ‘Exploit’ phase, if an organization has already sanctioned the use of AWS or Google Drive, this traffic will usually be allowed as legacy technologies don’t have instance-awareness and therefore cannot recognize whether the connection is directed to the organization’s own instance of AWS/Drive or an instance of AWS/Drive employed by a malicious third party. In many cases, the traffic to sanctioned cloud services will not even be inspected for malware or anomalous patterns since SSL inspection is a resource-intensive task for legacy on-premise technologies, and introduces latency at levels that unacceptably impact the user experience.

Persist

The characteristics of cloud play an important role in the Persist phase too. Once they access the cloud service, directly or via a compromised endpoint, attackers can move laterally and hop across cloud services. They can not only change the configuration of critical services hosted in the cloud, escalate privileges to gain increased access, steal data and clear up their traces, but also spin up new instances for malicious purposes like cryptojacking. Stolen credentials, leaked accounts, or misconfiguration of cloud services are typical ways used by attackers to break into cloud services and move laterally.

It is of course incredibly important that we do not ring fence or separate cloud attack vectors and surfaces in our consideration of – and response to – the kill chain. An attack can use a combination of “traditional” attack vectors, such as web and email, as well as cloud services.  We use the term “Hybrid Threats” to define attacks that leverage this mixed approach to remain under the radar of traditional security solutions.

Recommendations

Only a cloud-native technology can detect and mitigate cloud-native threats. Netskope recommends the following to combat cloud-native malware and threats:

  • Perform a regular continuous security assessment of all IaaS resources to prevent misconfigurations that can be exploited by malicious actors.
  • Perform a regular DLP scan of externally shared content in sanctioned cloud applications to prevent inadvertent leakage of information that can be exploited by malicious actors.
  • Deploy a threat-aware, instance-aware, unified platform like Netskope that can assemble a more complete picture of your position, find hybrid threats and enforce usage policy for both unsanctioned services and unsanctioned instances of sanctioned cloud services.
  • Warn users to avoid executing unsigned macros and macros from an untrusted source, even if the source seems to be a legitimate cloud service.
  • Warn users to avoid executing any file unless they are very sure that they are benign.
  • Warn users against opening untrusted attachments, regardless of their extensions or filenames.
  • Keep systems and antivirus updated with the latest releases and patches.

Sample policies to enforce:

  • Scan all uploads from unmanaged devices to sanctioned cloud applications, looking for malware
  • Scan all uploads from remote devices to sanctioned cloud applications, looking for malware
  • Scan all downloads from unsanctioned cloud applications, looking for malware
  • Scan all downloads from unsanctioned instances of sanctioned cloud applications, looking for malware
  • Enforce quarantine/block actions on malware detection to reduce user impact
  • Block unsanctioned instances of sanctioned/well-known cloud apps, to prevent attackers from exploiting user trust in cloud. While this seems a little restrictive, it significantly reduces the risk of malware infiltration attempts via cloud.
author image
Paolo Passeri
Paolo supports Netskope’s customers in protecting their journey to the cloud and is a security professional, with 20+ years experience in the infosec industry. He is the mastermind behind hackmageddon.com, a blog detailing timelines and statistics of all the main cyber-attacks occurred since 2011. It is the primary source of data and trends of the threat landscape for the Infosec community.

Stay informed!

Subscribe for the latest from the Netskope Blog