Building an Early Warning System: Introduction [New Series]
Getting ahead of the attackers is the holy grail to security folks. A few years back some vendors sold their customers a bill of goods, claiming they could “get ahead of the threat.” That didn’t work out so well, and most of the world appreciates that security is a reactive situation. The realistic objective is to reduce the time it takes to react. We call this React Faster and Better. The foundation of the philosophy is an effective incident response process. But you can shrink the window of exploitation by leveraging cutting-edge research to help focus your efforts more effectively. You need an early warning system for perspective on what’s coming at you. Pragmatic Intelligence Back in 2007 when the Pragmatic CSO was written, prioritization was a key part of the operational methodology espoused as part of the P-CSO process. Over the past 5 years we have kept focus on the importance of prioritizing your limited funding, resources, and expertise, on the highest-value activities. To get a feel for how this concept works, let’s excerpt a small section from the Pragmatic CSO: [A key operational discipline is] figuring out the most likely exposure and working to eliminate it. This is particularly hard because many CSOs run from emergency to emergency without ever getting a chance to manage their security environment or even spend 10 minutes thinking about what is next. Unfortunately, what’s next has already happened. Clearly this situation must be addressed. “A good hockey player plays where the puck is. A great hockey player plays where the puck is going to be.” – Wayne Gretzky The great ones, in whatever pursuit, figure out how to anticipate what is most likely to happen, so they are ready if it does. Some think it’s luck, others figure it’s a talent bestowed by a higher power. Actually, in most cases, it is the result of a tremendous amount of hard work. The ability to anticipate is especially critical in security because of the unlimited number of possible attacks across an infinite attack surface. You cannot cover all the bases, so you need to be focused and choose correctly. What is the best way to choose correctly? You need an “inside man” working on your behalf to figure out what the bad guys are working on. Thus, security research plays a critical role in the life of a Pragmatic CSO. It’s hard to believe, but Pragmatic CSOs read a lot. They are plugged into the underground networks of researchers that spend time penetrating the hacker networks and tracking down the bot masters to figure out what they are working on. If you know what the bad guys are focused on, you can get a real good idea about what they are planning to strike next. Even though you don’t have to spend money to get connected with the research folks, a number of services focus on reporting new exploits and figuring out what is most likely to be attacked on any given day. Of course context is everything, so although third party research may give you a clue to what the next exploit or botnet looks like, it cannot tell you how it will be used against your defenses. You need to provide that context, which requires looking at the situation from two different perspectives: In Here: This is the internal perspective gleaned from what’s happening on your network. Whether the platform to aggregate and analyze the data is a SIEM or a Vulnerability Management platform or any other technology, the point is the same. The foundation for context is a clear understanding of what’s going on within your environment. Then you can move on to the next view for an idea of what’s exposed and what needs to be fixed right now. Out There: The reverse perspective looks at the macro environment, understanding attacker tactics and exploits, and then figuring out how they will affect you. If you know about attacks you can preemptively implement protections. Obviously you need to walk before you run, so getting a handle on your internal security data is a necessary first step. But once you are there, factoring in the external view can really help narrow down your attack surface. None of this is new. Law enforcement has been doing this, well, forever. The goal is to penetrate the adversary, learn their methods, and take action before an attack. Even in security there is a lot of precedent for this kind of approach. Back at TruSecure over a decade ago, the security program was based on performing external threat research, and using it to prioritize the controls to be implemented to address imminent attacks. Amazingly enough it worked. But this approach fell out of favor over the past 5-7 years as the entire industry got weighed down by the compliance albatross. Now that the pendulum is swinging back toward actually securing stuff, we see a resurgence of threat intelligence as a way to make our defenses more effective and efficient. Let’s run through the history of security research, now typically called threat intelligence. The Evolution of Threat Intelligence Back in the day, security research really meant anti-virus research. The AV companies would look at viruses, build signatures, and move on to the next one. It was a fairly collegial environment, and AV companies shared the malware they discovered, making sure everyone was protected within a couple hours. The next wave of research resulted from the avalanche of spam, which required security companies to build global networks of honeypots to capture bad email directly, create signatures to identify it, and distribute the signatures to their gateways. Of course, that lasted only until the spammers became more effective at evading signatures, which drove heavier reliance on behavioral indicators to infer which files were malware and which messages were spam. This required security vendors to spend time evaluating behavior and tuning their detection cocktails to maintain efficiency. At about this time, IP and file reputation started to be more
