NCSC Recommends Defenses Against China-Nexus Covert Networks of Compromised Devices
Summary
The NCSC recommends network monitoring, stronger remote-access controls, threat-feed use, and active hunting to help organisations defend against China-nexus covert networks of compromised devices.
Key points
- Map network-edge devices and establish which connections to them are expected.
- Baseline connections to corporate VPNs and other remote services, including whether consumer broadband connections are normal.
- Use threat feeds covering covert network infrastructure and implement multi-factor authentication for remote connections.
- Higher-risk organisations can use IP or geographic allow lists, zero-trust policies, machine certificates, and reduce internet-facing systems.
- Organisations with APT-tracking capabilities should consider tracking these covert networks and actively hunting for likely nodes, including SOHO routers and IoT devices.
- Use banners, certificates, threat reporting, blocklists, alert rules, and NetFlow to map networks and detect or block threats.
Article Details
- Defense Focus
- Detect and block connections associated with covert networks of compromised devices, and reduce exposure to remote-access and internet-facing systems.
- Detection Methods
- Map network-edge assets and expected connections; baseline normal connection patterns, especially to corporate VPNs.
- Hunt for connections from IP addresses likely to belong to covert networks, including addresses hosting SOHO routers or IoT devices.
- Track and map reported covert networks using banners and certificates.
- Use machine-learning techniques to profile normal network-edge activity and detect anomalies.
- Use NetFlow to examine upstream traffic and map covert networks for new nodes.
- Use threat reporting and dynamic threat feeds to identify covert-network infrastructure and create alerts for incoming threats.
- Data Sources
- Network connection records for network-edge devices and corporate VPNs
- IP addresses and dynamic threat feeds
- Banners and certificates
- NetFlow
- Incoming connection attributes, including operating system, time zone, and organisation-specific system configuration
- Rule Types
- Dynamic IP blocklists
- Alert rules for incoming threats
- Defensive Actions
- Inventory network-edge devices and establish which assets and connections are expected.
- Apply IP address allow lists for corporate VPN connections; consider geographic allow lists or profiling connections by operating system, time zone, and organisation-specific configuration.
- Implement multi-factor authentication for remote connections, zero-trust policies, and machine certificates for SSL connections.
- Reduce the internet-facing presence of the IT estate.
- Consider tracking China-nexus covert networks as APTs and use security providers to investigate where appropriate.
Countries
Industries
Digital infrastructureincluding those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government. Energyunder the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government. GovernmentTrack and map covert networks reported by industry or government by looking at banners and certificates.Healthcarethe highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government. Transportlevels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.