By Brent Zelinski, Standards Senior Manager, HITRUST 

Trending highlights  

• Compromise Accounts (T1586) 

• Indicator Removal (T1070)  

New technique in MITRE ATT&CK 

• Hide Infrastructure (T1665) 

After analyzing second-quarter cyber threat data, we’ve put our i1 assessment controls to the test. Our i1 controls are selected to ensure coverage against tried and true and emerging cyber threats alike. The Q2 threat data and corresponding analysis confirm the relevance of previously trending threats, as well as highlighting the continuing need for baseline security controls. 

Based on the top techniques and associated mitigations identified and addressed in the most recent version of the MITRE ATT&CK Framework (v15.1), the control requirements in the i1 assessment continue to address the top 20 cyber threats by volume identified during the second quarter of 2024 and address all techniques with associated MITRE mitigations including 99% of all cyber threats seen. 

Q2 2024 threat data analysis details  

Initial findings 

HITRUST noted the following MITRE ATT&CK techniques shown below had the largest increase in occurrence during Q2 2024, compared to the same data from Q1 2024.  

i1 status evaluation

For each of the threat techniques identified above, HITRUST explored in depth the existing i1 assessment control set and found that the requirement statements currently included provided significant coverage against each of these techniques. 

Overall technique coverage 

T1586: Compromise Accounts 

The T1586 attack technique was the top growing threat technique in Q2 of 2024.  

T1586: i1 Coverage Evaluation  

For the T1586: Compromise Accounts attack technique, MITRE associates a mitigation named Pre-compromise (M1056). The description of this mitigation states that “[t]his technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.” [emphasis added by HITRUST] 

The following HITRUST CSF requirements contained in the i1 provide coverage for this technique. 

• The organization (i) reviews the proposed content of information prior to posting on the publicly accessible information system and on a recurring bi-weekly basis to ensure non-public information is not included, and (ii) removes nonpublic information if discovered. 
• Dedicated phishing awareness training is developed as part of the organization’s onboarding program, is documented and tracked, and includes the recognition and reporting of potential phishing attempts. 
• The operating system has in place supporting technical controls such as antivirus, file integrity monitoring, host-based (personal) firewalls or port filtering tools, and logging as part of its baseline. 

T1586: Q2 Coverage Summary  

The expansive attack technique of compromising accounts will always be a popular primary step to gain a foothold in an environment. As MITRE suggests, it is nearly impossible to completely eradicate the possibility of compromised social media, email, cloud, or other account types. The above requirement statements from the HITRUST CSF framework provide sensible preventive controls to reduce attack surfaces and reduce the organization’s exposure to a potential cybersecurity incident. 

T1070: Indicator Removal 

The T1070 attack technique showed significant growth in Q2 of 2024.  

 T1070: i1 Coverage Evaluation  

For the T1070: Indicator Removal attack technique, the existing coverage is currently addressed in the i1 through four HITRUST CSF requirements. 

• Access to audit trails/logs is safeguarded from unauthorized access and use. 
• Access control rules and rights for each user or group of users are based on clearly defined requirements for information dissemination and authorization (e.g., need-to-know, need-to-share, least privilege, security levels, and information classification). The policy further defines logical and physical access control rules and rights for each user or group of users are considered together and clearly defined in standard user access profiles (e.g., roles). The access control program takes into account the security requirements of individual business applications and business units and ensures standard user access profiles for common job roles in the organization. 
• Covered and/or confidential information, at minimum, is rendered unusable, unreadable, or indecipherable anywhere it is stored, including on personal computers (laptops, desktops) portable digital media, backup media, servers, databases, or in logs. Exceptions to encryption requirements are authorized by management and documented. Encryption is implemented via one-way hashes, truncation, or strong cryptography and key-management procedures. For full-disk encryption, logical access is independent of O/S access. Decryption keys are not tied to user accounts. If encryption is not applied because it is determined to not be reasonable or appropriate, the organization documents its rationale for its decision or uses alternative compensating controls other than encryption if the method is approved and reviewed annually by the CISO. 
• Access to information systems audit tools is protected to prevent any possible misuse or compromise. 

T1070: Q2 Coverage Summary 

When an adversary executes action against a target, it is common practice to attempt to cover their trails and remove indications of their presence. Without adequate coverage to prevent and/or detect such actions, compromised targets can remain in an environment without detection and can continue to be used by attackers.  

New techniques 

T1665: Hide Infrastructure 

In addition to detecting ongoing and emerging trends of attacker techniques, it is also good practice to study new technique methods. In MITRE’s latest version release ATT&CK v15.1, the technique to Hide Infrastructure was added to the robust list of Enterprise Techniques. While similar methods such as the aforementioned T1070: Indicator Removal already existed for individual actions, T1665 expands on this line of malicious thinking. When utilizing this technique, adversaries manipulate network traffic in order to hide and evade detection of their command and control (C2) infrastructure. C2 infrastructure is a set of tools and protocols an attacker uses to maintain communication and manage their compromised machines. Since this infrastructure must live on the machine, common attempts to hide can include setting hostnames and domains to match the names of legitimate hostnames and/or services in the environment and using IP addresses within the victim’s correct address range as proxies or VPN to hide the true source of the attack.  

While we have not yet seen significant activity with this technique since its introduction to the ATT&CK framework, it is important to stay informed and up-to-date with detection methods. This technique is also of note as it cannot easily be mitigated with mitigating controls due to its simple nature of abusing legitimate system features.  

For a full breakdown of the new technique, refer to MITRE: T665: Hide Infrastructure. 

Conclusion 

As we continue to gather emerging cyber threat data and learn from real-world attack techniques, we will continue to update the HITRUST CSF framework and the preset controls in the i1 assessment. By committing to a dynamic and threat-adaptive control library, we can remain vigilant in a constantly evolving realm of cyber threats. This unique functionality sets the HITRUST i1 apart from other assessments. 

AI has rapidly become a cornerstone of modern innovation, transforming industries and creating opportunities. However, these advancements can give rise to significant risks and challenges that organizations must address to ensure the safe and ethical use of AI. It is essential for organizations to establish a robust risk management program as threats evolve.

The challenge: Navigating AI risks

Organizations face a daunting task when it comes to managing AI risks. The landscape is complex with standards like ISO/IEC 23894:2023 and NIST AI Risk Management Framework (RMF) that are lengthy and difficult to harmonize. These critical standards span thousands of pages and require significant effort to understand and implement. Moreover, AI development outpaces the speed at which standards bodies adapt.

Businesses must select, implement, and maintain appropriate controls for safe AI use. They should assess their effectiveness and continuously update their risk management programs to keep pace with new developments. The stakes are high as failure can lead to regulatory challenges, legal consequences, operational disruptions, and loss of stakeholder trust.

The solution: HITRUST AI Risk Management Assessment

Recognizing these challenges, HITRUST has developed the AI Risk Management Assessment, a comprehensive solution designed to help organizations effectively manage AI risks. This first-of-its-kind assessment is tailored to meet the needs of any organization involved in the development or use of AI.

Key features

1. Comprehensive control requirements: The assessment includes 51 practical and prescriptive risk management control requirements harmonized with leading standards such as ISO/IEC 23894:2023 and NIST AI RMF. It provides a unified approach that is comprehensive and easy to understand for AI governance.
2. Advanced software platform: The assessment is supported by HITRUST’s MyCSF platform, a powerful SaaS-based assessment tool that simplifies the entire risk management process and enables seamless results sharing.
3. Actionable reporting: The assessment generates an AI Risk Management Insights Report. The report provides detailed scoring and observations, helping organizations identify vulnerabilities and prioritize actions. The report offers demonstratable proof of the organization’s commitment to managing AI risks.
4. Flexible application: The HITRUST assessment is adaptable to any organization’s needs, whether it is just starting an AI journey or is deeply involved in AI development. It can be used as a self-assessment or for independent validation through an external assessor.
5. Efficiency and consistency: The HITRUST AI Risk Management Assessment follows a systematic, consistent protocol that directly maps to multiple authoritative standards. This approach ensures reliable assurance and reporting. It is designed to save time and resources, enabling organizations to focus on what matters most — innovation and growth.

Why choose HITRUST?

HITRUST provides a solution that addresses unique AI risks, while also being scalable and accessible to organizations of all sizes and across all industries with its AI Risk Management Assessment.

By choosing HITRUST, you’re not just implementing a risk management program — you’re partnering with a leader in the field who is committed to helping you navigate the complexities of AI governance with confidence.

Get in touch and secure your AI future with HITRUST.

Ransomware has become one of the most dangerous threats to organizations of all sizes. It is crucial to understand ransomware and prepare your organization to safeguard its data, operations, and reputation to remain resilient.

What is ransomware?

Ransomware is a type of malicious software designed to block access to a computer system or encrypt its data, making it inaccessible to the user until a ransom is paid. Attackers typically demand payment in cryptocurrency to maintain anonymity. Ransomware enters a system through various means, including phishing emails, malicious downloads, or software vulnerabilities. Ransomware spreads quickly, locks users out of their systems, and holds critical data hostage.

Why does ransomware matter?

Ransomware’s impact is far-reaching. An attack doesn’t just affect the targeted organization — it also affects customers, partners, and the entire industry. The following are some of the consequences of a ransomware attack, making it clear why you should take this threat seriously.

Financial losses

Ransomware can lead to huge financial losses. Affected organizations bear the burden of the ransom payment and other associated costs such as data recovery, legal fees, regulatory fines, and business downtime.

Reputational damage

A ransomware attack can severely damage an organization’s reputation, eroding customer trust and potentially leading to lost business.

Operational disruption

Ransomware impacts productivity and leads to significant delays in business processes as it can bring an organization’s operations to a standstill.

Data loss and privacy concerns

There’s no guarantee that data will be restored even after paying the ransom. Moreover, sensitive information gets exposed, leading to privacy breaches and compliance issues.

Double extortion

Ransomware tactics are becoming more advanced, with attackers using double extortion. They are demanding payment for both decrypting data and not publishing it. Attackers are also targeting backup systems to further pressurize victims.

How should organizations prepare for ransomware?

Proactive preparation is essential as a ransomware attack can have severe consequences. Here are some key steps organizations should take for ransomware protection and preparation.

Strong cybersecurity measures

Organizations must have robust cybersecurity controls in place. Regularly updating software, applying patches, and using advanced threat detection tools are critical to mitigating risks. HITRUST’s threat-adaptive framework offers comprehensive protection against emerging threats, including ransomware.

Employee training and awareness

Human error is often the weakest link in cybersecurity. Regular training sessions should be conducted to educate employees about the dangers of phishing and the importance of cautious online behavior. Creating a culture of security awareness significantly reduces the risk of ransomware entering the network.

Regular backups and recovery plans

Backing up data regularly and ensuring that backups are stored securely is critical for ransomware protection. This can minimize downtime and data loss in the event of an attack.

Incident response planning

Develop and regularly test an incident response plan outlining the steps to be taken if a ransomware attack occurs. Ensure it includes communication protocols, containment strategies, and legal considerations.

Third-party risk management

Many ransomware attacks target vulnerabilities in third-party vendors or supply chains. Evaluate the security posture of your partners and enforce strong contractual obligations to ensure compliance with stringent security standards.

Cyber insurance

Cyber insurance can help mitigate the financial impact of a ransomware attack. Review the policies carefully to ensure they cover ransomware-related damages.

Preparing for the future: Expert insights

Ransomware is a significant threat that organizations across all sectors must address. Ransomware protection requires vigilance, preparation, and continuous learning. To deepen your understanding, listen to Ransomware Sommelier Allan Liska discuss the criminal mindsets behind ransomware and the growing risk of new extortion tactics in the latest podcast episode of Trust vs., The Ransomware Battle on the Cyber Frontier.

The time to prepare is now — don’t wait until it’s too late.