Understanding post-breach threat detection in the digital era

Cyber security is quickly becoming the biggest concern for enterprises in Southeast Asia, causing enormous financial and political damages to corporations, institutions and government agencies across the region. In fact, a recent report by Mandiant reveals that Asia is the top target for cyber attackers in the world.

From Singapore's StarHub DDos attacks to the Bangladesh Central Bank's million-dollar heist and the hacking of a bitcoin exchange in Hong Kong, the series of cyberattacks in 2016 has left enterprises across the region worrying for the safety of their business, data and people.

While the businesses are moving towards a digital economy, they are also opening a whole new surface area for hackers to attack. The emergence of digital technologies such as cloud has enabled attackers to employ more sophisticated attack tactics such as exploiting zero day vulnerabilities, using modified malware, customising threat tools to escape detection by traditional firewalls and even signature-based next-generation firewall (NGFW) at network perimeters.

How data breaches happen

Typically, the data breaches are executed by physically accessing a computer or network, or by bypassing network security remotely; the latter being the most popular technique for targeting big organisations.

Many of the cyber-attacks that we witness today are not random, but are a result of methodical and carefully planned attack strategies. To execute such large-scale attacks, cybercriminals typically start by identifying the weakest link in the target organisation's security - its people, systems, or network. Once the attack point has been identified, the cybercriminal makes the initial contact with the target by leveraging either a network or social attack.

 Network attacks exploit an organisation's infrastructure, system, and application loopholes to breach the network by leveraging tools such as Viruses, Trojans, spyware and rootkits. On the other hand, the social attack involves tricking the employees into giving access to the organisation's network through tactics such as phishing, drive-by downloads, and more.

Once the cybercriminals have secured access to the company's network, they further lower the security by infecting endpoints and devices across the network. With the lowered defense, attackers can extract maximum data from the network without getting caught. The extraction process can vary from a day to weeks or months, depending on the magnitude of the attack.

Why we need threat detection

According to the 2016 Verizon Data Breach report, 83 percent of security breaches took organisations months or even longer to discover. While enterprises are bolstering their security, so are attackers with their attack methods. With the rapidly evolving threat landscape, it is becoming even harder for businesses to identify new attack patterns and stop them in time. Threat detection comes to the rescue in such scenarios, enabling businesses to not only identify the intrusion after it has happened but also mitigate the damage in time.

Data breaches are not a one-off process but rather, an ongoing one. With most of the data exfiltration typically happening after lowering the first line of defense such as network perimeter, employing threat detection technology can help enterprises to enhance their security to a large extent.

Effectively detecting threats

An ideal threat detection solution will provide security analysts with an integrated, multi-surfaced detection across the organisation's entire network, endpoints and devices. Rather than a single attack vector, the solution needs to focus on the whole attack cycle also known as "cyber kill chain", continuously cross-referencing events from every stage in the chain to give analysts a holistic view of network security.

Some of the key characteristics of a robust threat detection solution are:

• Rich Forensic Analysis: By leveraging the forensic information attached to each of the attacks, security analysts can determine the origin of the attack, the severity of the attack, and the methodology employed to execute it. This allows analysts the ability to modify security policies to prevent similar and future intrusions in the network.
• Abnormal Behavior Detection: Through efficient behavior modelling, analysts can identify abnormal attack patterns as well as the known malicious attacks as well as in real-time, enabling analysts to prevent advanced level of threats quickly.
• Threat Correlation Analytics: By leveraging threat correlation analytics, analysts can trace the entire kill chain for cyber breaches as well as identify the stage where the risky host resides to reveal the extent of the damage for the attack and take mitigation measures accordingly.

Detecting Post-Breach Threats in Action: Using Cyber Kill Chain

The Cyber Kill Chain model provides real time visibility and deep insights into the post-breach threat attack path inside the victim network. Threat intelligence information is provided from multiple detection engines and mapped against the CKC stages with forensic evidence data and other actionable options.

The detection engines include signature based IPS/AV, they also include engines that are based on machine learning modeling using large amounts of malware samples as well as L3-L4 behavioral-based modeling for host or server machines.

Figure 1: Detected C-C activities

In figure 1, there are detected threat events that point to suspected C-C activities with detailed information. These threat events can be reported from one of the IPS/AV engines, advanced malware detection engine and DGA detection engine.

Figure 2: Detected lateral movement activity

In figure 2, there are detected threat events that point to suspected lateral movement activities with detailed information. These abnormal behaviours are detected by an abnormal behaviour detection engine.

For today's cyber threat attacks, simply compromising and breaking into a victim host machine and network is no longer the only goal. Instead, the attackers carefully design and utilise post breach activities at different stages to achieve different purposes. In such case, it requires security vendors to continuously develop defence technologies at both the network perimeters as well as inside the victim network for post breach threat detection and protection.