Many organizations have implemented work from home (WFH) strategies due to COVID-19. This measure, although enabling business continuity for many, introduces increased risk to cyber threats and attacks.
Cisco Talos has been proactively hunting COVID related outbreaks, educating the public, and pushing these discoveries to all Cisco Security tools for blocking. I encourage you to read the Talos blog, “Threat Actors attempt to capitalize on coronavirus outbreak” and “Threat Update: COVID-19“.
Talos goes as far as to list ways that you can defend against COVID related attacks. Cisco Umbrella, in particular, can leverage threat intelligence from Cisco Talos, to uncover and block these malicious domains, IPs, URLs, and files that are used in attacks. It’s not just Talos intelligence that Umbrella can leverage, however. You can take advantage of 3rd party threat intelligence platforms (TIP) that you may have and create a completely robust, kickass defense for your work from home workforce.
Here’s how –
Turn on – Newly Seen Domains: As part of Cisco Umbrella intelligence, some domains may be blocked as Newly Seen Domains (NSD). Newly created domains related to COVID-19 will also be flagged as NSD as long as they fit the criteria.
Third Party Integration: Umbrella support integrations with SIEM, threat intelligence platforms, or homegrown systems. This feature utilizes the ‘Enforcement API‘ in Umbrella.
Here are the default integrations.
In this case, I want to show you how to leverage a homegrown system. We’ll call it “COVID-19-BLOCK”
When you add a new integration, an API key is generated. This API key can be used to make requests to and from Umbrella.
Our homegrown system is nothing more than a simple python script that makes POST requests to Umbrella.
# Custom integration - ADD EVENT URL
import requests
url = "https://s-platform.api.opendns.com/1.0/events?customerKey=c988727a-XXX-XXXX-XXXX-XXXXXXXXX";
payload = "{\n \"alertTime\": \"2013-02-08T11:14:26.0Z\",\n \"deviceId\": \"ba6a59f4-e692-4724-ba36-c28132c761de\",\n \"deviceVersion\": \"13.7a\",\n \"dstDomain\": \"coronadiseasenews.com\",\n \"dstUrl\": \"http://coronadiseasenews.com/a-bad-url\",\n \"eventTime\": \"2020-03-31T09:30:26.0Z\",\n \"protocolVersion\": \"1.0a\",\n \"providerName\": \"Security Platform\"\n}"
headers = {
'Content-Type': 'application/json'
}
response = requests.request("POST", url, headers=headers, data = payload)
print(response.text.encode('utf8'))After running the script, we can confirm that our request to block the COVID-19 malicious domain was successful.
As you can see, we were successful in adding this malicious domain to our block list.
Now, take a moment to expand on this custom integration that we just made. There are roughly 70,000 COVID-19 malicious domains and growing daily. What if we were able to take all of the published COVID-19 molicous domains and add them to an Umbrella block policy like we did above?
I think that would make any CSO smile.
Mike
Apronets 