Be On Alert: Steps to Take Ahead of Possible Cyber Attacks

Netskope is keeping a close watch on the rapidly changing situation in Ukraine. Along with the attention we are giving to the safety and well-being of Netskope employees in the region, we are in a state of high alert with respect to cyber threats and risks to our customers. 

Netskope Threat Labs is continuously monitoring cybersecurity threats related to the conflict in Ukraine. Netskope leverages threat intelligence, signatures, machine learning, artificial intelligence, advanced heuristics, and sandboxing to protect our customers. Netskope Threat Labs will also continue to publicly provide analysis and intelligence of significant threats related to the conflict.

Several key sources are also providing valuable guidance. Gartner guides toward immediate, short-term, and mid-term priorities, including immediate additional due diligence to prevent user mistakes, starting with changes on critical security and IT infrastructure, and to prepare for incident response, as there might still be time to get or increase some threat detection, incident response retainer and services capabilities. In addition, Gartner notes in a February 28 brief that “teams should structure IR personnel schedules to avoid burnout and develop comprehensive shift handover and communication processes.” 

The United States Cybersecurity & Infrastructure Intelligence Agency (CISA) recommends “all organizations—regardless of size—adopt a heightened posture when it comes to cybersecurity and protecting their most critical assets.” Most technology vendors providing active guidance also urge similar vigilance and preparation. We agree that, as VMware notes, organizations should “operate under the assumption that they will be impacted by destructive cyberattacks, either directly or indirectly, and that adversary behavior will be punitive.”

Here are some steps we suggest organizations prioritize immediately:

• Ensure that multi-factor authentication (MFA) is enabled for all external and Cloud services and SaaS apps. If MFA is not an option, assess the risk of the service or SaaS app, evaluate the need for it, and either monitor access logs and behavior regularly or disable the service.
• Validate your internal logging and monitoring services and ensure completeness across your environment.
• Proactively hunt for indicators of compromise and techniques used by Russian threat actors. Curated Intel provides free, continuously updated intelligence that includes IoCs and threat reports. Netskope Threat Labs publishes free intelligence on our GitHub page.  
• Review your business continuity plans (BCP) and ensure they have been tested recently, focusing on disruption and destruction of digital services. Focus on roles and responsibilities, communication plans, and decision-making processes.
• Plan for data to be wiped and destroyed. Ensure that you have off-line, tamper-proof backups readily available and test your backup procedures to ensure that critical data can be restored quickly if the organization is impacted by ransomware or a destructive cyberattack.
• Ensure DDoS services are current, recently profiled, and can be enabled quickly.
• Ensure your incident response (IR) plans are updated and recently tested.
• Ensure all patches are up to date and that there is an emergency patch process ready in the event of new patches needing to be deployed quickly. If patching is not an option, upgrade the platform to supported versions with urgency. If this is not possible, look to segment and isolate the hosts, in order to limit the blast radius of any breach. 
• Ensure you have a response plan that manages team fatigue. If necessary, leverage external services for overflow and specialist support.
• Understand what services and infrastructure you can turn off or disable at any time, what the decision criteria are, and who is authorized to do so.
• Ensure you understand your critical suppliers and what they are doing to prepare. Plan for disruptions to these services in your BCP.
• Stay informed and maintain situational awareness through various security entities, key vendors, industry analysts, and so on. 
• Confirm all ports and protocols that are not essential for business purposes have been disabled.
• Identify and assess any unexpected or unusual network behavior.
• Stay attuned to guidance from CISA (https://www.cisa.gov/shields-up); and follow credible resources that provide actionable intelligence (not marketing). 

We will update this blog as needed and based on situational changes.