Computer Security Incidents Lesson 2 Computer Security Incidents Taxonomy

Need an accepted taxonomy because . . . Provides a common frame of reference If no taxonomy, then we: Can’t develop common reporting criteria Can’t develop processes and standardization Ultimately-no IA “Common Language”

Must have these characteristics . . . + B = C Logically related columns Taxonomy Must be: 1 2 3 4 5 1 2 3 1 2 3 4 Categories Exhaustive Mutually exclusive Repeatable Unambiguous Accepted Useful

Where to start? The inability to share data because of non- standard terminology is not a new problem For this reason several computer security taxonomies have already been developed Most comprehensive study done by Sandia Labs in conjunction with Carnegie Mellon University Currently in use at Carnegie Mellon’s CERT/CC Sandia Report: “A Common Language for Computer Security Incidents”, John D. Howard and Thomas A. Longstaff (October 1998)

Network Based Taxonomy Network Based Taxonomy Incident Attack Network Based Taxonomy Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Event Sandia Labs Attackers Hackers Spies Terrorists Corporate Raiders Professional Criminals Vandals Voyeurs Tool Physical Attack Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Vulnerability Design Implementation Configuration Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Denial of Service Theft of Resources Objectives Challenge, Status, Thrills Political Gain Financial Damage Network Based Taxonomy

Basic Model Incident Intrusions Attacks Intruders Attackers Attackers Objectives Tool Vulnerability Action Target Unauthorized Result Attackers Objectives

Computer Network “Incident” Defended Network Intruders Hackers Terrorists Other Intrusions Increased access Disclosure of info Theft of resources Corruption of info Denial of Service Objectives Status/Thrills Political Gain Financial Gain Damage

Intrusion Taxonomy Intrusion Event Intruders Action Target Tool Tool Vulnerability Vulnerability Action Action Target Target Unauthorized Result Unauthorized Result Intruders Objectives

Intrusion Intrusion Intruder Connection SECURITY Defended Network Vulnerabilities Design Implementation Configuration Connection Defended Network Jl;j;j jjl;j;lj jl;kllkj Physical force Info exchange User command Script/Program Autonomous agent Toolkit Distributed tool Data tap Tools Events Action Target Unauthorized Results Increased access Disclosure Corrupt data Denial of Service Theft Thrills Political Gain Financial Gain Damage Objective

No Intrusion Attempted Intrusion FIREWALL Intruder Connection FIREWALL Defended Network Jl;j;j jjl;j;lj jl;kllkj Physical force Info exchange User command Script/Program Autonomous agent Toolkit Distributed tool Data tap Tools Vulnerabilities Design Implementation Configuration Did have Intent Thrills Political Gain Financial Gain Damage No Unauthorized Results Objective

Intrusion Intrusion taxonomy in practice . . . Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Sandia Labs Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Event Unauthorized Result Increased Access Disclosure of Corruption of Denial of Service Theft of Resources Attack Vulnerability Design Implementation Configuration Intrusion Intruders Objectives Intrusion taxonomy in practice . . . Toolkit Design Bypass Process Corruption of Data Denial of Service Computer Network Intrusion

Intrusion Intrusion taxonomy in practice . . . Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Sandia Labs Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Event Unauthorized Result Increased Access Disclosure of Corruption of Denial of Service Theft of Resources Attack Vulnerability Design Implementation Configuration Intrusion Intruders Objectives Intrusion taxonomy in practice . . . Unauthorized Result Intrusion Tool Kit Design Increased Access Bypass Process Authorized User Authorized User Insider Threat

Taxonomy applied A Case Study

Network Based Taxonomy Network Based Taxonomy Intrusion Attack Event Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Sandia Labs Intruders Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Vulnerability Design Implementation Configuration Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Denial of Service Theft of Resources Objectives Design User Command Authenticate Account Increased Access Network Based Taxonomy Network Based Taxonomy Intrusion 1

Intrusion 1 - Increased Acess Intruders Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Vulnerability Design Implementation Configuration Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Unauthorized Result Objectives Target User Command Design Bypass Process Root Access Increased Access Account Intrusion 2 Disclosure of Information Process Corruption of Information Data Denial of Service Component Theft of Resources Computer Network Internetwork

Intrusion 2 - Root Level Access Intrusion 1 - Increased Access Intruders Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Vulnerability Design Implementation Configuration Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Denial of Service Theft of Resources Objectives Root Access User Command Design Intrusion 3 Disclosure of Information Steal Data

Intruders Objectives Intrusion 3 - Disclosure of Information Intrusion 2 - Root Level Access Intrusion 1 - Increased Access Intruders Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Vulnerability Design Implementation Configuration Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Denial of Service Theft of Resources Objectives

Process Modify Intruders Objectives Script or Denial of Program Intrusion 3 - Disclosure of Information Intrusion 2 - Root Level Access Intrusion 1 - Increased Access Intruders Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Data Tap Vulnerability Design Implementation Configuration Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Denial of Service Theft of Resources Objectives Script or Program Implementation Modify Process Disclosure of Information Denial of Service Theft of Resources

New definition: “Intrusion Set” Multiple related intrusions = “Intrusion Set” Multiple Events Tool Vulnerability Unauthorized Result Action Target Intruder Objective

? Who? What? Why? Intrusion Sets Intruder AND OBJECTIVES answer the what Intrusion Sets Need more information to get to attribution Need to know who? AND Need to know why? ? OBJECTIVES Intruder

Attribution Who and Why? Objectives Intruders Intrusion Set Tool Vulnerability Action Target Unauthorized Result Attribution

Objective reporting criteria Must report all unauthorized results (Actual or attempted) Including intrusion data Intrusion(s) Unauthorized Result Disclosure of Information Corruption of Denial of Service Theft of Resources Increased Access Action Target Not every event? Action Target Unauthorized Result Action Target Vulnerability Tool Disclosure of Information Corruption of Denial of Service Theft of Resources Unauthorized Result Increased Access Attackers Intruders Tool Vulnerability Action Target Objectives Physical Force Challenge, Status, Thrills Challenge, Status, Thrill Hackers Hackers Design Probe Account Information Exchange Political Gain Group 1 Spies Spies Implementation Scan Process Pol/Mil Gain User Command Financial Gain Terrorists Terrorists Configuration Flood Data Financial gain Group 2 Corporate Raiders Corporate Raiders Script or Program Authenticate Component Damage Damage Professional Criminals Professional Criminals Autonomous Agent Bypass Computer Group 3 Vandals Vandals Toolkit Spoof Network Distributed Tool Voyeurs Voyeurs Read Internetwork Group 4 Data Tap Copy Steal Modify Delete

New Work US Military: US Cyber Command FBI: Cyber Forensic Centers MITRE ATT&CK Matrix Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) is a model and framework for describing the actions an adversary may take while operating within an enterprise network.

MITRE ATT&CK Matrix https://attack.mitre.org/wiki/File:ATT%26CK_Matrix.png#file REF: https://attack.mitre.org/index.php/Main_Page

SUMMARY Common Taxonomy Developed Increased Data Sharing Ongoing Prosecutions Increasing More Frameworks emerging