Story image

Understanding post-breach threat detection in the digital era

26 Oct 17

Cyber security is quickly becoming the biggest concern for enterprises in Southeast Asia, causing enormous financial and political damages to corporations, institutions and government agencies across the region. In fact, a recent report by Mandiant reveals that Asia is the top target for cyber attackers in the world.

From Singapore’s StarHub DDos attacks to the Bangladesh Central Bank’s million-dollar heist and the hacking of a bitcoin exchange in Hong Kong, the series of cyberattacks in 2016 has left enterprises across the region worrying for the safety of their business, data and people.

While the businesses are moving towards a digital economy, they are also opening a whole new surface area for hackers to attack. The emergence of digital technologies such as cloud has enabled attackers to employ more sophisticated attack tactics such as exploiting zero day vulnerabilities, using modified malware, customising threat tools to escape detection by traditional firewalls and even signature-based next-generation firewall (NGFW) at network perimeters.

How data breaches happen

Typically, the data breaches are executed by physically accessing a computer or network, or by bypassing network security remotely; the latter being the most popular technique for targeting big organisations.

Many of the cyber-attacks that we witness today are not random, but are a result of methodical and carefully planned attack strategies. To execute such large-scale attacks, cybercriminals typically start by identifying the weakest link in the target organisation’s security - its people, systems, or network. Once the attack point has been identified, the cybercriminal makes the initial contact with the target by leveraging either a network or social attack.

 Network attacks exploit an organisation’s infrastructure, system, and application loopholes to breach the network by leveraging tools such as Viruses, Trojans, spyware and rootkits. On the other hand, the social attack involves tricking the employees into giving access to the organisation’s network through tactics such as phishing, drive-by downloads, and more.

Once the cybercriminals have secured access to the company’s network, they further lower the security by infecting endpoints and devices across the network. With the lowered defense, attackers can extract maximum data from the network without getting caught. The extraction process can vary from a day to weeks or months, depending on the magnitude of the attack.

Why we need threat detection

According to the 2016 Verizon Data Breach report, 83 percent of security breaches took organisations months or even longer to discover. While enterprises are bolstering their security, so are attackers with their attack methods. With the rapidly evolving threat landscape, it is becoming even harder for businesses to identify new attack patterns and stop them in time. Threat detection comes to the rescue in such scenarios, enabling businesses to not only identify the intrusion after it has happened but also mitigate the damage in time.

Data breaches are not a one-off process but rather, an ongoing one. With most of the data exfiltration typically happening after lowering the first line of defense such as network perimeter, employing threat detection technology can help enterprises to enhance their security to a large extent.

Effectively detecting threats

An ideal threat detection solution will provide security analysts with an integrated, multi-surfaced detection across the organisation’s entire network, endpoints and devices. Rather than a single attack vector, the solution needs to focus on the whole attack cycle also known as “cyber kill chain”, continuously cross-referencing events from every stage in the chain to give analysts a holistic view of network security.

Some of the key characteristics of a robust threat detection solution are:

  • Rich Forensic Analysis: By leveraging the forensic information attached to each of the attacks, security analysts can determine the origin of the attack, the severity of the attack, and the methodology employed to execute it. This allows analysts the ability to modify security policies to prevent similar and future intrusions in the network.
  • Abnormal Behavior Detection: Through efficient behavior modelling, analysts can identify abnormal attack patterns as well as the known malicious attacks as well as in real-time, enabling analysts to prevent advanced level of threats quickly.
  • Threat Correlation Analytics: By leveraging threat correlation analytics, analysts can trace the entire kill chain for cyber breaches as well as identify the stage where the risky host resides to reveal the extent of the damage for the attack and take mitigation measures accordingly.

Detecting Post-Breach Threats in Action: Using Cyber Kill Chain

The Cyber Kill Chain model provides real time visibility and deep insights into the post-breach threat attack path inside the victim network. Threat intelligence information is provided from multiple detection engines and mapped against the CKC stages with forensic evidence data and other actionable options.

The detection engines include signature based IPS/AV, they also include engines that are based on machine learning modeling using large amounts of malware samples as well as L3-L4 behavioral-based modeling for host or server machines.

Figure 1: Detected C&C activities

In figure 1, there are detected threat events that point to suspected C&C activities with detailed information. These threat events can be reported from one of the IPS/AV engines, advanced malware detection engine and DGA detection engine.

Figure 2: Detected lateral movement activity

In figure 2, there are detected threat events that point to suspected lateral movement activities with detailed information. These abnormal behaviours are detected by an abnormal behaviour detection engine.

For today’s cyber threat attacks, simply compromising and breaking into a victim host machine and network is no longer the only goal. Instead, the attackers carefully design and utilise post breach activities at different stages to achieve different purposes. In such case, it requires security vendors to continuously develop defence technologies at both the network perimeters as well as inside the victim network for post breach threat detection and protection.

Article by Francis Teo, South East Asia regional director at Hillstone Networks. 

Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).