Presentation is loading. Please wait.

Presentation is loading. Please wait.

Adapting Incident Response to Meet the Threat

Similar presentations

Presentation on theme: "Adapting Incident Response to Meet the Threat"— Presentation transcript:

1 Adapting Incident Response to Meet the Threat
SecureWorks Adapting Incident Response to Meet the Threat Jeff Schilling Director, Global Incident Response and Digital Forensics

2 Agenda Why change your approach? Do you really know your environment?
Do You really know/understand your threat? Where to focus your efforts to respond? Measuring success

3 My Press Box View My view as the Director of the Army’s
Global Network Security Team My view as the Director of the Dell SecureWorks Incident Response Practice

4 The Dell SecureWorks Incident Response Practice
300+ projects last year 42% of our engagements were with Medium-sized business 58% were large enterprise customers 70% of our engagements were active Incident Response 30% were proactive engagements 20% of our projects involved Advance Persistent Threat (Targeted Threat) Our observations from 2012 engagements: End users still the primary targets (51% of the time) Servers and applications running second (39% of the time) 20% of our engagements involved insider threat activity

5 Do I need to change my approach?

6 Getting to “yes” Do you rarely see the same activity on your networks with the same success? Do you conduct trend analysis of your security incidents? Have you analyzed the things you can control and the things you can’t? People Processes Technology For the things you can’t control, have you calculated the risks or outcomes? Have you insured or transferred that risk? Do you make adjustments to your security controls based on trends? Do you have a plan or playbook to address your most common Incidents? Do you rehearse and update these plans?

7 Do you really know your environment?

8 Which picture best describes your network?
Do you have an updated/accurate network diagram? Are you a part of the change management process so you know when it changes? Have you studied your network flow to know what ports and protocols to accept and ones to deny? Do you validate with Pen Tests, Vulnerability Scans, Netflow Monitoring? Do you have defined network boundaries with the Internet? Do you Leverage Active Directory to assign risk and controls to Organizational Units? Is “white listing” embraced in your organization? Do you have a standard, secure image/baseline for hosts and servers? Do you centralize your event log monitoring? Do you limit workstation to workstation communication?

9 Do you really know your enemy?

10 May be some overlap in APT and Insider threat detection
Categories of threat May be some overlap in APT and Insider threat detection Commodity Threat Phishing with Dynamite Automated control for scale Can be defended with good Signature based controls Buys trade craft Can be sophisticated and polymorphic Favorite vectors Server compromises Non-targeted phishing Web drive bys Smash and grab Playing chess Human controlled (just for you) Custom trade craft Favorite vectors Highly targeted phishing Water holing web drive bys Some server compromises Highly targeted efforts Attempts to cover their tracks Will compromise partners to get to you Goal is to log on, become an insider Fly on the wall Hardest to detect, tries to hide in normal activity Usually has elevated privileges In most cases, assumes not being monitored Rarely uses tradecraft: when they do, normally crawlers Usually has access to data that does not pertain to their job, that is what they take May use “close access” techniques Attempts to cover their tracks Managers/HR usually not surprised when insider is caught

11 Categories of Intent/Motive
Hacktivists/Revenge Cyber Warfare Intellectual Property Theft Crime Disrupt Destroy Deny Revenge Embarrass Intimidate Competitive advantage Fill in an innovation gap Nation-state level espionage Steal your Money Steal your clients money Identity Theft Fraud

12 Pulling it all together
Threat Actor Categories Threat Actor Motives Targeted Assets Impacts Vectors Security controls Commodity Advanced Persistent Threat Insider Crime Hacktivism Revenge Intellectual property theft Cyber Warfare Cardholder Data/PII/Identity Core Business Processes Critical Infrastructure Intellectual Property Web applications Financial data/processes Executive communication Monetary loss Availability Confidentiality Integrity Personal harm Reputation Botnets Server compromise DoS Malicious code Web infection Phishing Physical Theft/Loss/ Damage Targeted Attacks Worms/Trojans IPS/IDS Firewall/Web app FW DDOS filtering Web/mail Proxy VM inspection Host level controls SIEM/Log monitoring Vulnerability mgt Access control DLP DRM User actions Policy

13 What should an IR plan look like?
Base document (Policy and Guidelines, does not change very often) Roles and responsibilities Description of the overall process Identification of Incident Types Work flows Identification of third party providers Playbooks/Appendix/Run Books (Procedures, constantly updated) One for each Incident Type Criteria for declaring an incident Checklist driven actions Point of Contact Lists Key players on the Security team Key players on the IT staff (if separate from the Security team) Key decision makers outside of Security and IT Third party providers (ISP, outside consulting, etc)

14 Threat Intelligence Maturity Model
Data Collection Analysis Investigation Synthesis Decision Making and Action Analysis Investigation Synthesis Decision Making and Action Time Maturity Enhanced from “BI Capability Maturity Model” When establishing a Threat Intelligence capability [whether insourced, outsourced or a mix], the bottom line is that you are working to get to a point where TI is fueling stronger, more accurate decision making and action on the part of your team and across your overall business operations as you will see later.

15 How do you apply intelligence?
Intel on tradecraft What does it mean? How to resist? What is the next action? IT Security Hostile actor ID Material threats Hostile actor ID Actor motivations Attacker tactics Incident Response Threat Intelligence Database Context and countermeasures Physical security Business Operations Hiring practices Data protection Feedback loop

16 Where to focus your Response Efforts?

17 Analysis & Classification
Do you live on OODA Loop? Observe Orient Decide Act Malware Analysis & Classification Counter-measure Plan Develop & Deploy Counter-measures Vulnerabilities Risk Assessment Apply Threat Intel to control Adversaries Counter Measure Control and Efficacy Detect SOC Ops Your Assets Incident Response Contain/ Eradicate

18 The “Broken Windows” approach
Questions Where is my most important data? Where are most of my incidents happening? Where am I most vulnerable? What is (are) the worst possible thing(s) that could happen? Can I detect where I am most vulnerable? Can contain where I am most vulnerable? Can I see the insider threat? Answers Identify your “broken windows” Establish network visibility Segment to protect critical assets, create security zones Layered defensive strategy Intelligence informed SIEM Network detection/prevention Host level detection/prevention Virtual machine detonation Get control of your elevated privileges, if you can Protect and leverage your Active Directory structure Whitelist your servers, protocols and ports Focus on SMTP and Web traffic Talk to managers and HR about high risk employees with elevated privileges

19 How do you measure success?

20 Success, Failure and False metrics
Indications of Failing Trends Increase of recurring incidents Increased in dwell time Increase # of incidents reported by the user v. detected by SOC Increased number of root level and domain compromise Increase number of compromised servers/web applications Increase in the number of incidents involving CVE’s Increase of business impact of Incident Increase of incidents closed where root cause is indeterminate Indication of Successful Trends Decrease in time between detection and containment Decrease in the number of successful commodity infections Decrease in number of incidents that spread to multiple host Increase in the number of APT and Insider threat detection Decrease in third party reporting of incidents (FBI, USSS, partners) Reduction in successful Phishing False Metrics Increase or decrease in number of incidents Increase or decrease in number of detections Investment on security technology !

21 Conclusion Analyze your environment; Know your strengths and weaknesses Ensure you understand the threat’s capabilities, intent and vectors Focus your response on your “broken windows” Ensure you are achieving success and not reinforcing failure in your Incident Response processes

22 Resources Dell SecureWorks Incident Response SANS Incident Response Training response White Paper - Accelerating Incident Response: How Integrated Services Reduce Risk and the Impact of a Security Breach incident-response-reducing-risk-and-impact NIST Computer Security Incident Handling Guide If you suspect a security breach, contact the Dell SecureWorks Incident Response team at

23 Questions?

Download ppt "Adapting Incident Response to Meet the Threat"

Similar presentations

Ads by Google