Story image

Understanding post-breach threat detection in the digital era

26 Oct 2017

Cyber security is quickly becoming the biggest concern for enterprises in Southeast Asia, causing enormous financial and political damages to corporations, institutions and government agencies across the region. In fact, a recent report by Mandiant reveals that Asia is the top target for cyber attackers in the world.

From Singapore’s StarHub DDos attacks to the Bangladesh Central Bank’s million-dollar heist and the hacking of a bitcoin exchange in Hong Kong, the series of cyberattacks in 2016 has left enterprises across the region worrying for the safety of their business, data and people.

While the businesses are moving towards a digital economy, they are also opening a whole new surface area for hackers to attack. The emergence of digital technologies such as cloud has enabled attackers to employ more sophisticated attack tactics such as exploiting zero day vulnerabilities, using modified malware, customising threat tools to escape detection by traditional firewalls and even signature-based next-generation firewall (NGFW) at network perimeters.

How data breaches happen

Typically, the data breaches are executed by physically accessing a computer or network, or by bypassing network security remotely; the latter being the most popular technique for targeting big organisations.

Many of the cyber-attacks that we witness today are not random, but are a result of methodical and carefully planned attack strategies. To execute such large-scale attacks, cybercriminals typically start by identifying the weakest link in the target organisation’s security - its people, systems, or network. Once the attack point has been identified, the cybercriminal makes the initial contact with the target by leveraging either a network or social attack.

 Network attacks exploit an organisation’s infrastructure, system, and application loopholes to breach the network by leveraging tools such as Viruses, Trojans, spyware and rootkits. On the other hand, the social attack involves tricking the employees into giving access to the organisation’s network through tactics such as phishing, drive-by downloads, and more.

Once the cybercriminals have secured access to the company’s network, they further lower the security by infecting endpoints and devices across the network. With the lowered defense, attackers can extract maximum data from the network without getting caught. The extraction process can vary from a day to weeks or months, depending on the magnitude of the attack.

Why we need threat detection

According to the 2016 Verizon Data Breach report, 83 percent of security breaches took organisations months or even longer to discover. While enterprises are bolstering their security, so are attackers with their attack methods. With the rapidly evolving threat landscape, it is becoming even harder for businesses to identify new attack patterns and stop them in time. Threat detection comes to the rescue in such scenarios, enabling businesses to not only identify the intrusion after it has happened but also mitigate the damage in time.

Data breaches are not a one-off process but rather, an ongoing one. With most of the data exfiltration typically happening after lowering the first line of defense such as network perimeter, employing threat detection technology can help enterprises to enhance their security to a large extent.

Effectively detecting threats

An ideal threat detection solution will provide security analysts with an integrated, multi-surfaced detection across the organisation’s entire network, endpoints and devices. Rather than a single attack vector, the solution needs to focus on the whole attack cycle also known as “cyber kill chain”, continuously cross-referencing events from every stage in the chain to give analysts a holistic view of network security.

Some of the key characteristics of a robust threat detection solution are:

  • Rich Forensic Analysis: By leveraging the forensic information attached to each of the attacks, security analysts can determine the origin of the attack, the severity of the attack, and the methodology employed to execute it. This allows analysts the ability to modify security policies to prevent similar and future intrusions in the network.
  • Abnormal Behavior Detection: Through efficient behavior modelling, analysts can identify abnormal attack patterns as well as the known malicious attacks as well as in real-time, enabling analysts to prevent advanced level of threats quickly.
  • Threat Correlation Analytics: By leveraging threat correlation analytics, analysts can trace the entire kill chain for cyber breaches as well as identify the stage where the risky host resides to reveal the extent of the damage for the attack and take mitigation measures accordingly.

Detecting Post-Breach Threats in Action: Using Cyber Kill Chain

The Cyber Kill Chain model provides real time visibility and deep insights into the post-breach threat attack path inside the victim network. Threat intelligence information is provided from multiple detection engines and mapped against the CKC stages with forensic evidence data and other actionable options.

The detection engines include signature based IPS/AV, they also include engines that are based on machine learning modeling using large amounts of malware samples as well as L3-L4 behavioral-based modeling for host or server machines.

Figure 1: Detected C&C activities

In figure 1, there are detected threat events that point to suspected C&C activities with detailed information. These threat events can be reported from one of the IPS/AV engines, advanced malware detection engine and DGA detection engine.

Figure 2: Detected lateral movement activity

In figure 2, there are detected threat events that point to suspected lateral movement activities with detailed information. These abnormal behaviours are detected by an abnormal behaviour detection engine.

For today’s cyber threat attacks, simply compromising and breaking into a victim host machine and network is no longer the only goal. Instead, the attackers carefully design and utilise post breach activities at different stages to achieve different purposes. In such case, it requires security vendors to continuously develop defence technologies at both the network perimeters as well as inside the victim network for post breach threat detection and protection.

Article by Francis Teo, South East Asia regional director at Hillstone Networks. 

Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.
Hackers increasingly ‘island hopping’ – so what does it mean?
Carbon Black's Rick McElroy discusses this new trend and what it means for the new age of cybercrime.
Trust without visibility is blind – Avi Networks
Enterprises are wanting to gain the trust of their customers, but are often found blindly defending themselves.
How to avoid becoming a cryptojacking victim - Bitglass
Large-scale cryptojacking is a lucrative business due to the popularity and value of cryptocurrencies like Bitcoin and Ethereum.
Symantec, Ixia combine efforts to secure hybrid networks
Ixia’s CloudLens and Symantec Security Analytics now feature complete integration, which allows Symantec customers to gain real-time visibility into their hybrid cloud environments.