Machine learning has moved enterprise security forward, allowing for visibility inside the network in order to better understand user behavior. However, malicious actors are using what is done with machine learning on the inside in order to attack the perimeter.\n\nSpecifically, these types of attacks include DNS tunneling, attaching to Tor networks, and sending rogue authentication requests to directory services. Tom Gorup, security operations leader for Rook Security, said that in addition to these threats, "In general what we are seeing across the board is phishing, from wire fraud to distribution of malware. Generally we\u2019re seeing scans they're attempting to exploit."\n\nEven though DNS tunneling is not as prominent as it used to be, attackers trust that most people aren\u2019t monitoring their DNS, which "Enables a hacker to bypass proxy servers and firewalls that protect internal data from attack," said Gorup.\n\nAttaching to Tor networks is also becoming more and more painful for blue teams as it is more expensive to defend the environment. Gorup said, "If you don\u2019t see that initial packet, everything else just looks like SSL traffic. Some malware do use Tor, and when they do it, it\u2019s definitely difficult. Depends on how much effort the attacker wants to put into it."\n\nAnother threat that requires consistent monitoring is sending authentication requests. "Authentication to directory services enables hackers to learn more about servers on the network, including naming, users, and passwords," said Gorup. \n\nBarry Shteiman, threat research director from Exabeam, said, "When looking at machines, they need to look at the machine's behavior without the requirement of someone actively doing something on it."\n\nFrom a security standpoint, it's difficult to detect because when a person interacts with machine, that\u2019s a human user doing something to that machine. "Even if a machine does something right or wrong, there\u2019s always a human service that initiates that activity," Shteiman said.\n\nMost often, in a machine that has been breached, it's difficult to discern exactly what happened. "DNS tunneling is a classic threat," said Shteiman. "Someone installs some piece of software on a machine that starts exfiltrating data through a protocol that is used between the server and an IP address."\n\nWhat hackers came to understand is that DNS is robust. "It includes meta information. Because there are free text fields or hardly a limitation on the length of a domain name, there is room there to input free text. Hackers started to manipulate DNS to exfiltrate data by taking a file and breaking it into chunks, then reconnecting to a file outside of the network," said Shteiman.\n\nSince DNS is a required protocol, these are legitimate things to see happen from a security or network monitoring standpoint. Nothing looks weird. "The machine has the DNS tack that it\u2019s using. The service is on the machine itself. It requires no human interaction. It's common to see these things on closed networks," Shteiman said.\n\nThe problem is that the hacker will try to manipulate a machine that has access to certain data, "Using the machine to exfiltrate data, and security practitioners can\u2019t whitelist or blacklist or create a reel that doesn\u2019t allow DNS access. It\u2019s a unique file broken into millions of chunks," said Shteiman.\n\nThe problem with machine threats, said Citrix's CSO Stan Black, is that there is no clearly defined and consistently accepted understanding of them. The attacks that are underway have the ability to adapt and find new binaries very quickly.\n\n"Machine threats from my point of view is when the machine learning that we do on the inside is being turned to the outside against our perimeter," Black said. "Machine threats are when a malicious actor attempts to use machine technology against us."\n\nBad actors are so good at going after companies around the world that they now are able to take public information and do a vast majority of their attacks through automation. "There are 50 to 60 billion new attacks per quarter with multiple campaign elements. That used to require a person to look at the data, but now, it\u2019s full automation," said Black.\n\nAutomation has allowed hackers to gather even more intelligence than they had previously been able to obtain. Black said, "If you look at traffic on the internet, very few people are familiar with what is supposed to be happening. These guys are using connections, carriers, carrier calls, health checks, and parody analysis to gather additional intelligence."\n\nSecurity practitioners are monitoring traffic, but Black said, "Previously we would see someone running active scanning on us. Now, they are able to utilize malicious code to gather more than they used to. This is going to be huge in the IoT space."\n\nA return to basics, said Black, might be the best measure of defense. "Development is moving quickly, but we need to go back to basics. Applications are supposed to do certain types of transactions at each port. We need to clearly define what good traffic is and what it should look like. If it deviates from the published standard, that might be bad."\n\nRelying on modeling and machine learning, said Shteiman, is another way to protect the gaps that aren't covered by blocking access to known Tor IPs. "I work on Tor, but I can model how I work on my computer. Access is only allowed when there is a keyboard interaction, or during working hours so that if I'm not on my computer, Tor can't be used."\n\nAs is most often the case, mitigating these threats requires education and training. Gorup said, "Regular code review and training developers will lower risk and vulnerabilities."\n\nBlack agreed noting that, "Coding is going to be a major step forward. The internet and the carriers of the world have allowed dirty data to come to our door. As consumers of that data we need to demand that they clean up our pipes."\n\nEverybody is getting tired of the constant breaches and attacks. Creating more clarity on what carriers and companies' responsibilities are will work towards cleaning up those pipes.\n\n"We need to understand what is going into our facilities and what is going out," said Black. "They're also going to see encrypted traffic that is not encrypted by companies and countries, but if they don\u2019t have the keys, they're going to block the payload."\n\nSimplifying and consolidating with fewer layers will also be a necessary part of the clean up process, said Black. "I\u2019m more confident now than I have been in a really long time for several reasons. The number of technologies you need to layer on are being rapidly consolidated. Simplification is going to be critical."