Story image

Understanding post-breach threat detection in the digital era

26 Oct 2017

Cyber security is quickly becoming the biggest concern for enterprises in Southeast Asia, causing enormous financial and political damages to corporations, institutions and government agencies across the region. In fact, a recent report by Mandiant reveals that Asia is the top target for cyber attackers in the world.

From Singapore’s StarHub DDos attacks to the Bangladesh Central Bank’s million-dollar heist and the hacking of a bitcoin exchange in Hong Kong, the series of cyberattacks in 2016 has left enterprises across the region worrying for the safety of their business, data and people.

While the businesses are moving towards a digital economy, they are also opening a whole new surface area for hackers to attack. The emergence of digital technologies such as cloud has enabled attackers to employ more sophisticated attack tactics such as exploiting zero day vulnerabilities, using modified malware, customising threat tools to escape detection by traditional firewalls and even signature-based next-generation firewall (NGFW) at network perimeters.

How data breaches happen

Typically, the data breaches are executed by physically accessing a computer or network, or by bypassing network security remotely; the latter being the most popular technique for targeting big organisations.

Many of the cyber-attacks that we witness today are not random, but are a result of methodical and carefully planned attack strategies. To execute such large-scale attacks, cybercriminals typically start by identifying the weakest link in the target organisation’s security - its people, systems, or network. Once the attack point has been identified, the cybercriminal makes the initial contact with the target by leveraging either a network or social attack.

 Network attacks exploit an organisation’s infrastructure, system, and application loopholes to breach the network by leveraging tools such as Viruses, Trojans, spyware and rootkits. On the other hand, the social attack involves tricking the employees into giving access to the organisation’s network through tactics such as phishing, drive-by downloads, and more.

Once the cybercriminals have secured access to the company’s network, they further lower the security by infecting endpoints and devices across the network. With the lowered defense, attackers can extract maximum data from the network without getting caught. The extraction process can vary from a day to weeks or months, depending on the magnitude of the attack.

Why we need threat detection

According to the 2016 Verizon Data Breach report, 83 percent of security breaches took organisations months or even longer to discover. While enterprises are bolstering their security, so are attackers with their attack methods. With the rapidly evolving threat landscape, it is becoming even harder for businesses to identify new attack patterns and stop them in time. Threat detection comes to the rescue in such scenarios, enabling businesses to not only identify the intrusion after it has happened but also mitigate the damage in time.

Data breaches are not a one-off process but rather, an ongoing one. With most of the data exfiltration typically happening after lowering the first line of defense such as network perimeter, employing threat detection technology can help enterprises to enhance their security to a large extent.

Effectively detecting threats

An ideal threat detection solution will provide security analysts with an integrated, multi-surfaced detection across the organisation’s entire network, endpoints and devices. Rather than a single attack vector, the solution needs to focus on the whole attack cycle also known as “cyber kill chain”, continuously cross-referencing events from every stage in the chain to give analysts a holistic view of network security.

Some of the key characteristics of a robust threat detection solution are:

  • Rich Forensic Analysis: By leveraging the forensic information attached to each of the attacks, security analysts can determine the origin of the attack, the severity of the attack, and the methodology employed to execute it. This allows analysts the ability to modify security policies to prevent similar and future intrusions in the network.
  • Abnormal Behavior Detection: Through efficient behavior modelling, analysts can identify abnormal attack patterns as well as the known malicious attacks as well as in real-time, enabling analysts to prevent advanced level of threats quickly.
  • Threat Correlation Analytics: By leveraging threat correlation analytics, analysts can trace the entire kill chain for cyber breaches as well as identify the stage where the risky host resides to reveal the extent of the damage for the attack and take mitigation measures accordingly.

Detecting Post-Breach Threats in Action: Using Cyber Kill Chain

The Cyber Kill Chain model provides real time visibility and deep insights into the post-breach threat attack path inside the victim network. Threat intelligence information is provided from multiple detection engines and mapped against the CKC stages with forensic evidence data and other actionable options.

The detection engines include signature based IPS/AV, they also include engines that are based on machine learning modeling using large amounts of malware samples as well as L3-L4 behavioral-based modeling for host or server machines.

Figure 1: Detected C&C activities

In figure 1, there are detected threat events that point to suspected C&C activities with detailed information. These threat events can be reported from one of the IPS/AV engines, advanced malware detection engine and DGA detection engine.

Figure 2: Detected lateral movement activity

In figure 2, there are detected threat events that point to suspected lateral movement activities with detailed information. These abnormal behaviours are detected by an abnormal behaviour detection engine.

For today’s cyber threat attacks, simply compromising and breaking into a victim host machine and network is no longer the only goal. Instead, the attackers carefully design and utilise post breach activities at different stages to achieve different purposes. In such case, it requires security vendors to continuously develop defence technologies at both the network perimeters as well as inside the victim network for post breach threat detection and protection.

Article by Francis Teo, South East Asia regional director at Hillstone Networks. 

Industrial control component vulnerabilities up 30%
Positive Technologies says exploitation of these vulnerabilities could disturb operations by disrupting command transfer between components.
McAfee announces Google Cloud Platform support
McAfee MVISION Cloud now integrates with GCP Cloud SCC to help security professionals gain visibility and control over their cloud resources.
Why AI and behaviour analytics should be essential to enterprises
Cyber threats continue to increase in number and severity, prompting cybersecurity experts to seek new ways to stop malicious actors.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Cryptojacking and failure to patch still major threats - Ixia
Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018.
Princeton study wants to know if you have a smart home - or a spy home
The IoT research team at Princeton University wants to know how your IoT devices send and receive data not only to each other, but also to any other third parties that may be involved.
Organisations not testing incident response plans – IBM Security
Failure to test can leave organisations less prepared to effectively manage the complex processes and coordination that must take place in the wake of an attack.
65% of manufacturers run outdated operating systems – Trend Micro
The report highlights the unique triple threat facing manufacturing, including the risks associated with IT, OT and IP.