2

My company is in the process of training and testing all employees on our security policies and practices. As a member of the team doing this training and testing, I had a thought that it may be beneficial to invent a set of drills. These drills would test against different critical security controls as well as the execution of the response plans. I know a number of companies do tests like these for phishing, which we will also do.

One thing that I'd like to test is a suspected malware infection. My thought process for this is to have someone with remote administrator access to a given employees machine could trigger an event which emulated a malware infection. More importantly, it would be an infection which bypassed our anti-virus.

Obviously, there are a number of behaviors which a malware may exhibit, with the "ideal" (for the malware) being to exhibit no behaviors. That said, is there a set of malware characteristic behaviors that could be replicated in a safe and reversible manner by an administrator or tool we have installed on their system? A list of my current thoughts:

  • Browser hijack - Redirect the user's browser to a malicious intranet page
  • Edit the hosts file - Redirect common IPs/DNS entries to a malicious intranet page
  • High CPU Use - Emulate a botnet or bitcoin-mining malware by creating a spurious process which performs harmless but excessive calculations
  • High Disk Use - Emulate a current ransomware attack by creating a spurious process which performs harmless but excessive disk reads/writes
  • Ransomware popup - Create a popup image taken from one of the popular ransomwares and simply show the ransom page
  • Unauthorized access - Have an administrator remote in and leave open a page signed in to something like an AdSense account, signed in to the "attacker's" account (I've seen this happen before)

Are there any that I'm missing? Any that should be removed?

Whatever battery of tests we create may not be exhaustive, but the goal is to simply test that employees are being attentive to these kinds of breaches and report them when detected. Hopefully this will have the side benefit of having them be more sensitive to these kind of attacks at home as well.

5
  • No offence, but I think you (like a lot of other IS dept) are going in the wrong direction. People know when they are infected ... what they need is knowledge of how to prevent the infection and/or how to fix/contain the infection once they have it. You would be better off giving training on NoScript and uBlockOrigin Jan 23, 2018 at 22:20
  • I agree, you're delegating the wrong tasks and creating artificial urgency for your poor IT department. Now everything wrong with the computer will be presumed malware, most of which doesn't follow these patterns in practice. You're better off focusing on anti-phishing, a more likely and fallible vector for attack, and leaving malware detection to your dedicated analysts and appliances.
    – Ivan
    Jan 23, 2018 at 22:25
  • Good malware is not going to be detected by the average user unless they are actively reviewing behavior and logs - at which point they are a security analyst not a user.
    – McMatty
    Jan 23, 2018 at 23:48
  • Just to chime in to the other comments here. I agree in that I suspect you might be taking the wrong approach. Like many things in life, prevention is the best cure; truthfully if you're expecting your average user to know when resources are being used excessively then they're probably not your average user. I can tick off a number of those things you've listed as being attributed to system updates I regularly receive and I think it's unrealistic to get your users to know whether IT are doing something to their machine or a malicious user is doing something.
    – Kit
    Jan 24, 2018 at 3:42
  • I think these are all good comments and we'll take them to heart. It sounds like it's worth more time and resources investing in IDS's for this kind of thing as it is, as well as traditional security controls, like limiting administrator privilege use. We'll focus our testing in this regard on phishing exercises. Jan 24, 2018 at 17:34

2 Answers 2

2

I would question the value of anti-malware software which cannot detect unusual behavior and why other layers of defense are not detecting attacks. For the list you proposed, there are legitimate reasons for most of those things to occur, so I would not expect an end user to think they should report this as malware. You could find or write a tool that detects and reports on these scenarios (e.g., HIPS, IDS/IPS, stateful firewall, etc.).

Perhaps the more reasonable scenario is the user contacts IT for weird behavior and IT does an investigations, malware scan, etc.

End users should be your last line of defense (The military does not rely on school teachers instead of intelligence agencies). Reliance on end users usually indicates insufficient technical controls. Most organizations do not deploy anything beyond spam filters for email and emails are designed to be something end users interact with on a daily basis. I would be surprised if end users event know how to monitor utilization or what a hosts file even does or where it is located.

An important thing to consider with the rise of phishing simulation and testing it the market/vendor effect. Phishing simulation is pretty much the same as sending marketing emails with tracking links, its not super complicated software to write and the sales pitch is relatively easy.


At a higher level, a drill is a good thing to test, but you should focus on your response from the IT team, not end users as a KPI. For example, how quickly can IT identify and quarantine a machine are they asking the right questions to determine if there is malware and investigation is necessary or are they just trying to close out ticket as quickly as possible?

If you want to test your malware response from end-user reporting and IT follow-up you can use an EICAR test file.

1
  • 1
    Thanks for the answer! This I think both hits on the 'why' we should/not invest in this kind of testing, as well as providing a direct answer to the question, giving context in the way it makes sense. As such, I'm selecting it as the answer to the question. Jan 24, 2018 at 17:35
2

Start with the easy stuff

As pointed out in the comments and in Eric's answer what you are asking from your end users is to fulfill tasks that are not part of their job description and (depending on how tech-savvy they are) are too complicated for them. Unless all your employees want to go into forensics, you should go another route. In this answer I want to describe very shortly how that route can look like, because there is a lot of literature on this and you really shouldn't conceptualize a training off a StackExchange answer.

I regularly conduct interviews with CIOs & CSOs in mid-sized institutions to analyze their security-related processes. Topics are infrastructure, security controls etc. In pretty much all of these institutions an overwhelming majority of employees will fail at the following (basic) tasks:

  • recognize a phishing mail
  • report a malware find or infection1
  • report a security incident2
  • and more..

These are the things I would go for, when starting a new process to educate my users. Practical examples are great, so I would keep that mindset. Most people still cannot imagine what a piece of malware can do. Show your employees how impactful a malware infection can be, how easy it is to get infected and that it can happen to anyone.

As Eric pointed out, for all sophisticated attacks there should be technical solutions. The main point in this answer is, when end user's have to engage in any security related process - in my experience - they typically flat out wont or will fail in doing it the right way. The more complex the task at hand, the harder it will be for your user's to act accordingly. So start by preparing them for these relatively typical easy cases.
A good way to do that, is in group trainings in small teams on a regular basis. This will also reinforce an awareness for IT security and the importance of all related processes.


1 Typical case: an anti virus software will report the find or infection and employees are obligated to report this to whoever is in charge for IT security or the IT department. Being so used to just clicking on "Okay" or "Cancel" on pop-up windows, most people close these windows more or less immediately and don't even know what happened. Others are too ashamed to report it and fear repercussions for themselves or their colleague that send them that funny PowerPoint. Think about introducing a process to report infections/incidents anonymously.

2 Things like the bystander effect or the fear of repercussions is directly influenced by company culture and if and how the management embraces your IT security strategy. If management lives it, your employees will as well.

1
  • Thank you for the answer! This makes a lot of sense. I would accept it as well if I could, but Eric's answer also gave a link to the EICAR test file so that we can test the reporting and security incident response process as you've recommended, so I've selected that one. Jan 24, 2018 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .