Losing battles, winning wars

Proprietary and Confidential. Do Not Distribute. © 2014 Accuvant, Inc. All Rights Reserved.
Losing Battles,
Winning Wars
Frustrating adversaries using threat intelligence

AGENDA
Proprietary and Confidential. Do Not Distribute. © 2014 Accuvant, Inc. All Rights Reserved.2
• 1st – Background and perspective
• 2nd – Understanding “winning” and “losing”
• 3rd – Playing the defensive long game

Background
• This is knowledge based on research
• Leading practices from world-class (and not-so-world-class)
security organizations
• Drawing from industry experts, leading minds
• YMMV, this is not a silver bullet (and there are no werewolves)
• Trident Research Methodology
• 60+ enterprise adopters
• 30+ leading industry experts
• 60+ solution providers

UNDERSTANDING
WINNING AND LOSING

Are we winning yet?

Have you beaten an adversary today?

How would you know?

We’ve been thinking about this wrong.

What does it mean to “lose”?

Any guesses?

If you’ve been hacked, is that losing?

The bar is set unrealistically
high.

As defenders – 3 key questions

Do you control the situation?

If no, you’re losing.

Have critical assets been exfiltrated?

If yes, you’re losing.

Is the situation recoverable?

If no, you’ve lost.

For perspective –

Malware on your systems
Distributed Denial of Service (DDoS)
Website defacement

versus

Stolen trade secret(s).

Defenders must understand difference.

As attackers – 1 key question.

Have you achieved your objective?

If no, you haven’t won.

With this new focus we shift the game

From short-game (discrete incident)

To long-game (campaign à objectives)

PLAYING THE
DEFENSIVE LONG
GAME

Fundamentals – live it, love it.

Asset
Classification
Configuration
Change

Know. Your. Battlefield.

“Home ice advantage.”

Defending the unknown is unpossible.

Actively map your protected space.

Collect data, build baselines.

Get some threat intelligence goodness.

Intelligently incorporate externalities.

More data is not necessarily good.

10,000 bad IP addresses.

and?

Where will you put this data?

What will you do with this new data?

Much harder question.

Your security tools are killing you.

How many alerts do you receive…
per day?

Typically 10x your capacity to respond.

Average: 24-32 alerts /8hr shift
Realistic

Receive à Triage à Decision

You will drown chasing “incidents”.

STOP and FOCUS

What threats are relevant?

Malware. Malware. Adversary. Malware.

3 types of threats.

Keys to differentiating threat types:
• Targeting –whether the victim is one of opportunity, or specifically
tasked (individually, by industry, or in another manner)
• Persistence –whether the intent is a long-term embedded or
short-term infiltration;; generally speaking to a level of stealth and
extent of infiltration
Category Targeting Persistence Example
Generic no no ransomware
Targeted yes no credential thief
Persistent yes yes embedded RAT

Why does this matter?

Vastly different responses.

Generic: “Kill it with fire”
Tier 1 automated response

Destroy or re-image. Move on.

Near-zero human time expended.

Targeted: Focused, tier 2 response.

Contain. Analyze. Destroy.

Minimal human time expended.

Persistent: Focused, tier 3 response.

Contain. Analyze. Remove. Recover.

Necessary human time expended.

How do you tell the difference?

Your threat intelligence works here.

Atomic indicators need c o n t e x t .

The goal: intelligent prioritization.

Opportunistic malware vs. adversary.

Feeding an intelligence process loop.

core processes
strategy
acquisition triage executiondistribution
development
collaboration
enrichment
governance
feedback
measurement
Intialize
reﬁnement
(ﬁnishing)
secondary development

Start with (external) indicators.

core processes
strategy
development
collaboration
enrichment
governance
feedback
measurement
Intialize
reﬁnement
(ﬁnishing)

Enrich with context (internal & external).

core processes
strategy
development
collaboration
enrichment
governance
feedback
measurement
Intialize
reﬁnement
(ﬁnishing)

Distribute and execute.

core processes
strategy
development
collaboration
enrichment
governance
feedback
measurement
Intialize
reﬁnement
(ﬁnishing)

Which type of response does it warrant?

Tier 1 à 3 response type.

Can you learn from the incident?
Can you improve from the incident?

Now let’s figure out how to win.

Goal 1: Raise the cost for adversary.

Goal 2: Frustrate the adversary.

Goal 3: Keep from achieving objective.

An adversary will be persistent.

Malware won’t care.

Tie atomic indicators à adversary

Disrupt efforts to achieve objective.

Repeat as necessary.

This is winning.

Releasing our research at RSA Conf.
Comprehensive program guidance
on threat intelligence as a program.

Want it?

Losing battles, winning wars

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (7)

Destaque

Destaque (15)

Semelhante a Losing battles, winning wars

Semelhante a Losing battles, winning wars (20)

Mais de Rafal Los

Mais de Rafal Los (20)

Último

Último (20)

Losing battles, winning wars