[BreachExchange] The value of 20/20 hindsight in cybersecurity

[Audrey McNeil]

https://www.csoonline.com/article/3268285/data-
protection/the-value-of-20-20-hindsight-in-cybersecurity.html

On March 27, 2018, US-CERT publicly disclosed widespread cyber-attacks on
domestic energy and other infrastructure locations.  These attacks had been
occurring since at least March 2016 and had successfully compromised a
number of locations including some nuclear facilities, water, and aviation
locations.

This was not a typical drive-by attack. It was a systematic, multi-staged
effort that advanced up the kill chain and utilized several sophisticated
targeting techniques including spear-phishing, watering-hole domains, and
ultimately the targeting of industrial control systems infrastructure.

Some details of this attack became known to the targets by at least
September 2017, approximately six months before the public disclosure.

Arming yourself against future attacks

The emergency readiness team produced a comprehensive document that
described the full strategy and tactics used by the attackers. This
included details of the entire kill chain, from the reconnaissance phase,
through lateral spread to other devices on their network.   When they
published their findings, they highlighted important “indicators of
compromise” (IOCs) including:

- Suspicious URLs
- Suspicious IP addresses
- MD5 Hashs and filenames associated with a malware attack

With these IOCs, organizations can arm themselves against similar attacks
in the future.  These can be used to provide network security tools,
including firewalls, IPS/IDS, and web proxies with a list of the IP
addresses and URLs to interfere with the communication lines for this
attack.  In addition, the MD5 hashes allow network and endpoint solutions
to be aware of the malware associated with this group.

The challenge is that once these IOCs are known, it becomes less likely
that these same adversaries will continue to use them.  This is because it
becomes more difficult to use the same strategy once your targets become
aware of your tactics.  Some copycat adversaries may use this as a
blueprint for ways to launch similar attacks, but these adversaries are
often less resourceful than the originators of the attack.

So, while having public disclosure of the details and IOCs are useful,
often the security operations team is left wondering what they may have
prevented had they been informed of these IOCs six months earlier and not
after they become less valuable.

Hindsight is key to good threat hunting

An organization would be able to use these IOCs to discover new attacks
using the same techniques – and to look into the past to identify whether
these important markers were present before you became aware of them.
Unfortunately, most organizations do not have easy access to this
information, and you can’t start after there has been a big discovery.

The US-CERT announcement should be the wake-up call to not just monitor and
track the information frequently associated with IOCs, but also to include
a simple and consolidated method to search for these following an
announcement like this.

Many organizations already log this data but isn’t always collected,
archived and maintained in a system that is easily queried.  As a result,
this data is used in forensics to determine how a serious breach occurred,
once it is discovered, but it isn’t often the vehicle that enables this
detection itself.

Now is the time to ask yourself:

- If there is a new discovery, where can I go to discover if there was any
evidence of it in my environment?
- Where can I go to look for URLs, domain names and remote IP addresses?
- Where can I obtain a list of all new MD5 hashes downloaded into my
network and on which systems did they land?

Once your team has this information, the next step is to develop a process
around which new discoveries are investigated:

- How and when are new discoveries investigated?
- If your team does discover a hidden threat, exposed by this new
information, does eliminating the threat on the discovered device also
eradicate it throughout your entire network?
- What can you learn from this discovered device to ensure there are no
other threats lying dormant in your environment?

Ultimately, you can only depend on real-time detection techniques to a
point, but study newly discovered IOCs will help uncover the more important
threat:  The ones hidden on your network.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20180409/fb7ca006/attachment.html>