{"componentChunkName":"component---src-templates-article-js","path":"/lenny-zeltser-on-protean-security-tactics/","result":{"data":{"wordpressPost":{"title":"Lenny Zeltser on Protean Security Tactics","content":"

We’re big fans of the SANS team, and specifically of Lenny Zeltser. It’s gratifying then, to see him discussing deception and active defence in his recent  series  of blog posts, and we highly recommend reading his history of deception in computer security.

\n

Lenny Zeltser is right about deception and active defence on all account. Here, we’d like to extend a couple of his main arguments:

\n
    \n
  1. Thinking asymmetrically
    \nCyber-security has always been a form of asymmetric warfare. The defenders have expensive, monolithic defences, are slow to adapt, and are hampered by ‘terrain’ such as geographical boundaries. The attacker are quick to change tactics, rely heavily on deception, and make use of terrain. This is guerilla warfare, and only an asymmetrical defence will yield results.
    2. \n
  2. Support costs of honeypots
    \n    Honeypots in the traditional sense are expensive to deploy and difficult to maintain. They also increase attack surface for an attacker. However, virtual decoys solve all these problems. They are easy to deploy, administer and monitor, and they do not create vulnerabilities.
    3. \n
\n

When you integrate decoys and active defence into the fabric of the environment, you asymmetrically turn the tables on even the most advanced attackers. They are human after all.

\n","excerpt":"We’re big fans of the SANS team and of Lenny Zelster. Lenny has discussed deception in his recent series of blog posts, and we highly recommend reading his history of deception. Here we extend a couple of his main arguments.\n","slug":"lenny-zeltser-on-protean-security-tactics","date":"2015-05-10T13:57:39.000Z","modified":"2020-01-06T07:05:17.000Z","status":"publish","featured_media":{"id":"4c6ca115-85db-5bad-a8a7-05e1bd3a85b4","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/06/bg.jpg","alt_text":"Lenny Zeltser","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAECBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHAqGiAX//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEAAQUCX//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEABj8CX//EABgQAAIDAAAAAAAAAAAAAAAAAAABIDFB/9oACAEBAAE/IUXkf//aAAwDAQACAAMAAAAQr8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAZEAEBAAMBAAAAAAAAAAAAAAABABEhMUH/2gAIAQEAAT8QQmHk8ADHs6YZWVe3/9k=","aspectRatio":1.7699115044247788,"src":"/static/4bd58c20282a97532a0586a6a69e308a/14b42/bg.jpg","srcSet":"/static/4bd58c20282a97532a0586a6a69e308a/f836f/bg.jpg 200w,\n/static/4bd58c20282a97532a0586a6a69e308a/2244e/bg.jpg 400w,\n/static/4bd58c20282a97532a0586a6a69e308a/14b42/bg.jpg 800w,\n/static/4bd58c20282a97532a0586a6a69e308a/47498/bg.jpg 1200w,\n/static/4bd58c20282a97532a0586a6a69e308a/0e329/bg.jpg 1600w,\n/static/4bd58c20282a97532a0586a6a69e308a/d8255/bg.jpg 1920w","srcWebp":"/static/4bd58c20282a97532a0586a6a69e308a/58556/bg.webp","srcSetWebp":"/static/4bd58c20282a97532a0586a6a69e308a/61e93/bg.webp 200w,\n/static/4bd58c20282a97532a0586a6a69e308a/1f5c5/bg.webp 400w,\n/static/4bd58c20282a97532a0586a6a69e308a/58556/bg.webp 800w,\n/static/4bd58c20282a97532a0586a6a69e308a/99238/bg.webp 1200w,\n/static/4bd58c20282a97532a0586a6a69e308a/7c22d/bg.webp 1600w,\n/static/4bd58c20282a97532a0586a6a69e308a/25f09/bg.webp 1920w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAECBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHAqGiAX//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEAAQUCX//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEABj8CX//EABgQAAIDAAAAAAAAAAAAAAAAAAABIDFB/9oACAEBAAE/IUXkf//aAAwDAQACAAMAAAAQr8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAZEAEBAAMBAAAAAAAAAAAAAAABABEhMUH/2gAIAQEAAT8QQmHk8ADHs6YZWVe3/9k=","aspectRatio":1.765625,"src":"/static/4bd58c20282a97532a0586a6a69e308a/32fd5/bg.jpg","srcSet":"/static/4bd58c20282a97532a0586a6a69e308a/06e94/bg.jpg 113w,\n/static/4bd58c20282a97532a0586a6a69e308a/07ab6/bg.jpg 225w,\n/static/4bd58c20282a97532a0586a6a69e308a/32fd5/bg.jpg 450w,\n/static/4bd58c20282a97532a0586a6a69e308a/4a838/bg.jpg 675w,\n/static/4bd58c20282a97532a0586a6a69e308a/9842e/bg.jpg 900w,\n/static/4bd58c20282a97532a0586a6a69e308a/d8255/bg.jpg 1920w","srcWebp":"/static/4bd58c20282a97532a0586a6a69e308a/b8a88/bg.webp","srcSetWebp":"/static/4bd58c20282a97532a0586a6a69e308a/3a3bf/bg.webp 113w,\n/static/4bd58c20282a97532a0586a6a69e308a/975bf/bg.webp 225w,\n/static/4bd58c20282a97532a0586a6a69e308a/b8a88/bg.webp 450w,\n/static/4bd58c20282a97532a0586a6a69e308a/761da/bg.webp 675w,\n/static/4bd58c20282a97532a0586a6a69e308a/210c1/bg.webp 900w,\n/static/4bd58c20282a97532a0586a6a69e308a/25f09/bg.webp 1920w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"categories":[{"id":"a725b316-af4b-5d16-8453-4b07c65d8fca","slug":"deception","name":"deception"},{"id":"a968152c-f7b0-528a-95cc-b0e28c991f79","slug":"sans","name":"SANS"},{"id":"0aaaa4e2-c9fd-5357-95d2-3884b38b33c0","slug":"strategy","name":"strategy"}],"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"},"yoast_meta":{"yoast_wpseo_twitter_title":"","yoast_wpseo_twitter_description":"","yoast_wpseo_redirect":"","yoast_wpseo_opengraph_title":"","yoast_wpseo_opengraph_description":"","yoast_wpseo_metakeywords":"","yoast_wpseo_metadesc":"Deception is a key capability, according to SANS handler Lenny Zeltser. He advocates asymmetric thinking to defeat modern cyber-attacks.","yoast_wpseo_meta_robots_noindex":"","yoast_wpseo_meta_robots_nofollow":"","yoast_wpseo_meta_robots_adv":"","yoast_wpseo_linkdex":"64","yoast_wpseo_focuskw":"Lenny Zeltser","yoast_wpseo_canonical":""}},"relatedPosts":{"edges":[{"node":{"id":"58eb6f3c-c8ac-5680-a020-d1cc788cadbb","title":"The pragmatic security leader’s guide to deception technology","content":"\n

Deception technology provides a unique approach to detecting adversary activity in a network. Compared to other detection controls, it’s easier to deploy, gives you greater visibility, and solves your false positives problem.

\n\n\n\n

Let’s cut to the chase, shall we? Of course, I’m going to say this. I work for a company that sells a deception solution. I’m quite sure that if you’ve ever spoken to a deception vendor, you would have heard a similar pitch. If you haven’t talked to one, well, that’s more or less what you’re going to hear in a nutshell.

\n\n\n\n

While what I’ve stated above is accurate, there are nuances to every approach. As they say, when it comes to cybersecurity, there are no silver bullets. I’m writing this post because when you’re evaluating technology or deploying it, you must understand the conditions under which it can be effective. It allows you to be pragmatic and set realistic expectations.

\n\n\n\n

In the next couple of paragraphs, I’m going to delve into nuances of deception technology that often don’t make it to marketing materials.

\n\n\n\n

Visibility, realism, and fingerprinting – The deception trifecta

\n\n\n\n

As with any security control, there are several components that come together to make deception effective. For now, I’m going to focus on the three most important properties that can make or break a deception technology deployment. These are:

\n\n\n\n
  1. Visibility: The deceptive component/decoys must be visible to none but the adversary so that they lead to detection without raising any false positives.
  2. Realism: The deceptive component/decoys should be indistinguishable from your real assets so that malicious actors can’t tell the difference between what’s real and what’s fake.
  3. Fingerprinting: The deceptive component/decoys should not exhibit any property that would reveal their true nature resulting in the adversary not interacting with them.
\n\n\n\n

In an ideal world, every deceptive component should exhibit all three properties in totality. The reality, however, is different.

\n\n\n\n

Some decoys will be visible to folks inside your company but will be a popular target for attackers. Some will have limited realism but will not be fingeprintable. The point is, when you’re deploying deception in a living, breathing network, trade-offs have to be made – sometimes because of internal limitations, and other times because that’s the best strategy.

\n\n\n\n

In my experience, an understanding of these three properties helps in deciding what trade-offs to make and what you can expect. Let’s break them down one by one.

\n\n\n\n

Visibility

\n\n\n\n

Visibility is an important consideration when deploying deceptive components. In organizations, highly visible decoys will lead to false positives and noise. However, the decoys themselves may be the only effective way to detect an adversary. Being aware of different deceptive components and their visibility property can help inform your thinking about what to do. Here’s a handy table.

\n\n\n\n
Component Visibility to regular users
Private Threat Intelligence (Internet-facing decoys) Not visible
Internal network decoys Not visible
Active Directory decoys Not visible
MiTM Deception Not visible
Endpoint Deception – File Decoys * Invisible unless the user chooses the option to show hidden files. 

* The Endpoint deception policy allows file decoys to be hidden to make them invisible to regular users.
Endpoint Deception – Browser Lures * Cookies are invisible to the user.

* Credentials may be viewed if the user browses to the Saved Password page.

* Browser Favorites will be visible to the user.
Endpoint Deception – Session Lures * Network Shares and Windows Credentials are placed in Credential Manager and rarely accessed by regular users and are therefore effectively invisible.

* Session Lures created for software like PuTTY and WinSCP will be visible in the panel of saved sessions.
Endpoint Deception – Privilege Escalation Not visible
Endpoint Deception – Defense Evasion Effectively invisible. Fake Processes are visible in Task Manager but they masquerade as a real process and hide in plain sight.
\n\n\n\n

Fingerprintability

\n\n\n\n

If an adversary can fingerprint your deceptive assets, she will be able to avoid them altogether. That can’t be good, can it? Here are a couple of things to consider when looking at deception solutions to figure out if they’re fingerprintable.

\n\n\n\n

What are the characteristics of the decoys?

\n\n\n\n

For decoys deployed to the network, network characteristics can result in fingerprinting. While it’s relatively easy to fake characteristics like MAC addresses, Hostnames, and IP addresses, NetBIOS names are harder to spoof as they are tied to the machine itself. 

\n\n\n\n

Are they high interaction?

\n\n\n\n

All deception components have a limitation to the extent to which they fool an adversary. However, it’s important to test whether interacting with a deception component gives away large portions of your deployment. If decoys are created using multiple virtual network adapters from a single machine, it is likely that once you login to a decoy and run “ipconfig / ifconfig”, you will be able to figure out all the decoys projected from that host.

\n\n\n\n

Test open-source fingerprinting tools

\n\n\n\n

Open-source fingerprinting tools like HoneypotBuster, attempt to fingerprint deception in active directory and fake credentials in memory. We recommend testing these tools, especially on computer objects in Active Directory as they contain properties that cannot be easily modified in a deception scenario. Also, tools like HoneypotBuster check only the domain from which the tool is run and will not check domains that are trusted in any way. Ensure that you run the tool against the domain where the deception has been configured in Active Directory.

\n\n\n\n

Realism

\n\n\n\n

The realism of a deception component is critical to keeping an attacker engaged. Ideally, the component should be real enough that it allows the adversary to reveal tools, tactics, and techniques that are being used in your environment. It should also provide you with enough telemetry to determine what the next steps should be. 

\n\n\n\n

The overarching goal here is to make the deception component real enough to engage the adversary for long enough so that you can respond to the event. 

\n\n\n\n

Here is some guidance for ensuring that the deception technology components you opt for meet the realism criteria:

\n\n\n\n\n\n\n\n

In summary

\n\n\n\n

When evaluating deception technology, visibility, realism, and fingerprinting should be some of the key components that you should closely look at to figure how the solution will play out in your network.

\n","excerpt":"When evaluating deception technology, look at three key components of the solution to ascertain how effective it will be in your environment – visibility, realism, and fingerprintability.\n","slug":"the-pragmatic-security-leaders-guide-to-deception-technology","date":"2021-02-01T04:04:10.000Z","status":"publish","modified":"2021-02-01T12:39:33.000Z","wordpress_id":18727,"featured_media":{"id":"2a4ed0d8-6b54-5c32-b562-d58644b889bc","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/02/Maze.jpeg","alt_text":"deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5037593984962405,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/f836f/Maze.jpg 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/2244e/Maze.jpg 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/47498/Maze.jpg 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/0e329/Maze.jpg 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/61e93/Maze.webp 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/1f5c5/Maze.webp 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/99238/Maze.webp 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/7c22d/Maze.webp 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5066666666666666,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/06e94/Maze.jpg 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/07ab6/Maze.jpg 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/4a838/Maze.jpg 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/9842e/Maze.jpg 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/3a3bf/Maze.webp 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/975bf/Maze.webp 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/761da/Maze.webp 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/210c1/Maze.webp 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\n

Let’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.

\n\n\n\n

As more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,

\n\n\n\n

For a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?

\n\n\n\n

Opportunity #1 – Compromise the database cluster or core application

\n\n\n\n

The database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n

Not only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to: 

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

To achieve this target, adversaries will have to invest time and money into:

\n\n\n\n\n\n\n\n

Adversary Decision Criteria

\n\n\n\n

Cost-benefit analysis reveals Low to medium risk with an extremely high payout. 

\n\n\n\n

Adversary Profiles

\n\n\n\n

Advanced and organized criminal syndicates.

\n\n\n\n

Opportunity #2 – Deploy Ransomware

\n\n\n\n

Insurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Considerations

\n\n\n\n\n\n\n\n

Adversary Profile 

\n\n\n\n

Ransomware operators of any sophistication. 

\n\n\n\n

Opportunity #3 – Attacking public-facing Direct-to-Consumer applications

\n\n\n\n

Insurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

Mapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach. 

\n\n\n\n

Decision Criteria

\n\n\n\n

Low effort with payout equivalent to the criticality of the infrastructure they compromise.

\n\n\n\n

Adversary Profile

\n\n\n\n

Cybercriminals of any sophistication. 

\n\n\n\n

Your Defense Plan in a nutshell

\n\n\n\n\n\n\n\n

Enter Deception

\n\n\n\n

Deception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker. 

\n\n\n\n

The core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.  

\n\n\n\n

Using deception to beat adversary motivations

\n\n\n\n

Broadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:

\n\n\n\n
  1. Decoys in the perimeter.
  2. Decoys in the network.
  3. Decoys on the endpoint.
  4. Decoys in Active Directory.
\n\n\n\n

By spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once. 

\n\n\n\n

The following is a break-down of what this might look like in practice. 

\n\n\n\n

Decoy applications at the perimeter

\n\n\n\n\n\n\n\n

Decoy Systems on the network

\n\n\n\n\n\n\n\n

Decoy core application and database users in Active Directory

\n\n\n\n\n\n\n\n

Decoys on the endpoint

\n\n\n\n\n\n\n\n

What’s the alternative?

\n\n\n\n

Let’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed. 

\n\n\n\n

Deception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors. 

\n\n\n\n

Deception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.

\n\n\n\n

MITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.

\n","excerpt":"Insurance companies are under siege from cyberattacks. We take a look at some of the key pieces of an insurer’s infrastructure the adversaries target and how you can use deception to build active defenses.\n","slug":"using-deception-to-shield-the-insurance-sector","date":"2021-01-26T12:23:04.000Z","status":"publish","modified":"2021-02-01T03:41:54.000Z","wordpress_id":18716,"featured_media":{"id":"906d7d6e-966b-59f3-9c9d-9b14d27d8746","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/01/Shield-insurance.png","alt_text":"Active defense and deception for insurance","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACeElEQVQozz1Ta28SQRSdNGm1DaTE0oL0IQgFlncBeSwIC8tLHqUsUIRiRYqV2NZEU6OxNtUPxp99nHs/+OFkdmf2njn33LOiO55gPL+AMZnCrQTgC4URjEbx3OOB3+9HKpVCIpH4D13Xkc1m+czr9SISifB7oVBgiJRWgqpXUKjV4QtHEIrHET46ghIMIiiRy+VQKpVQr9dRqVTQarUQCASwurqKjY0NrK2t4eDgAB4pgFaRyBegxJOIpNLIFDW8UHNIS2QlEamj29PpNPL5PMrlMq+0T8UWiwVbW1sIhULw+XysVmjNFhzuQzj9CjSpcvb+EsbpKbKqimKxiEajgWazye2ocq/T6aDf77PSTCbD6mezGZbLJYbDIcTmUwceWZ7AvG3D400L9MYrLK+uYQwGGEicSvLRaATDMJhoMpGej8c4OztDrVbj58Vigel0ypaI4dsZ8tUaXP4Anh16kXlZQNfoo9PtcgEppBapJWq3Wq1yYTKZZC9dLheDOqAz8fXhF+7//MXHL7e4vfvJLauS1LqzA5PJBJvNxhBCYGVlBU6nkwkVRcHu7i4cDgf29vYQDofZb+GNHsEfi6NYb2Dybo75hyVC0RjcnkOeHKmiD6mILiA1pJymrmkax6jdbrM1ZJGIZFTYXW44fQpyZR0TacF4+gZD6dvx8TEbTxExm82IxWK8RyR0EUWKSGlQNJBerwfx6fsP9CWB3mpjIMPdkf6l5YeqBBWRSorGjrSAgk0k5J/VasX6+jrsdjt7R4rpIvH57h7fHn7j4uoGCzndy+sbTKXK0esxR2J/f5+LaDgnJyeshlTF5Q9AK03//Pwc8/mcU/APvBh2nCQ8QXsAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/69585/Shield-insurance.png 200w,\n/static/12a9f2eabb7e883c4f03074601938551/497c6/Shield-insurance.png 400w,\n/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png 800w,\n/static/12a9f2eabb7e883c4f03074601938551/f3583/Shield-insurance.png 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/5707d/Shield-insurance.png 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/61e93/Shield-insurance.webp 200w,\n/static/12a9f2eabb7e883c4f03074601938551/1f5c5/Shield-insurance.webp 400w,\n/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp 800w,\n/static/12a9f2eabb7e883c4f03074601938551/99238/Shield-insurance.webp 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/7c22d/Shield-insurance.webp 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACR0lEQVQozy2S608aURDFrx8LiFjaqOWVKiCPFVjCc3mW54IgKPIuYgFtSU2NNa1pq239y0/vTPrhZncne39z5pwRWqWGcquNQk2HVzlCMKJCCYfh8XoRjUaRzWZRqVRQKpXQaDSQy+VgNBr5GAwGuFwuBAIB7O/v8xGqloVPjUJNaYhpGcQ1DfFUGslUColEAplMBpqslctlFAoFfifI1tYWzGYzDg4OGOTz+biZKDSasLk98IbC0E86uFiuUNUbSKXTrKperzMsJRvQs9vtotVqIZlMMnw8HmO1WqHX63FDsf3GjhfbVhheWmF+9Rr98QTL64/oyIvD4RD9fh+DwQCdTgfT6RSj0Qiz2QzNZhNnZ2cMm8/nqFar3FAMLhfISB/dSgjugIJSrY6u7KZLv+gn6krjhKWvdIFqaane7/fD7Xbz+KSU6vl8HuLu1xMe/jzj5v4bvj8+YfR+Bl8wiM1Nszyb7A8FIISAyWRin+LxOBwOB5xOJwNDoRBbcnh4COH0+fE2EES6WMLk8gMmF3OEZboBCaVQCEAKrVYrbDYbK278V1+r1dBut9lHsoIsENlqnYGeoxAqzWMMJlP0BkOcyIDo4u7uLjY2NmC32/mbQqJAVFVFLBaDruscFIHJZ3H/+BszGcJx7xzTxRKt01Nkcnm8kwnTHhJoZ2cHkUiEV4hgVKMd3Nvb4x2l1EkxBSVuf/zEw99nrO++4tOXW1x/vsFcgs9lugSxWCw8+mKx4LFITbFYxKlsTOleXV1hvV7zRiiKgn/xCVdoxa/hfwAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/e7519/Shield-insurance.png 113w,\n/static/12a9f2eabb7e883c4f03074601938551/7e7e9/Shield-insurance.png 225w,\n/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png 450w,\n/static/12a9f2eabb7e883c4f03074601938551/e2e7f/Shield-insurance.png 675w,\n/static/12a9f2eabb7e883c4f03074601938551/db955/Shield-insurance.png 900w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/3a3bf/Shield-insurance.webp 113w,\n/static/12a9f2eabb7e883c4f03074601938551/975bf/Shield-insurance.webp 225w,\n/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp 450w,\n/static/12a9f2eabb7e883c4f03074601938551/761da/Shield-insurance.webp 675w,\n/static/12a9f2eabb7e883c4f03074601938551/210c1/Shield-insurance.webp 900w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e68006e7-ad47-5422-b7f1-7966cba61573","title":"Finding active defense opportunities in a pentest report","content":"\n

Pentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.

\n\n\n\n\n\n\n\n

Asking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.

\n\n\n\n

Let me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:

\n\n\n\n
  1. Established a C2 using PowerShell.
  2. Enumerated the Active Directory domain for users and groups, specifically privileged groups.
  3. Enumerated the domain to find computers.
  4. Attempted privilege escalation techniques and compromised the domain admin.
  5. Scanned a subset of computers to identify the customer DB.
  6. Used the domain admin account to login to the database server.
  7. Logged into the Customer DB.
\n\n\n\n

In each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.

\n\n\n\n

Deconstructing the pentest report to find Active Defense plays

\n\n\n\n

The Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.

\n\n\n\n

The foundation of the Active Defense approach rests on three principles:

\n\n\n\n
  1. Beat the human behind the software
  2. Do simple things the adversary does not anticipate to encourage or complicate their operation.
  3. Make sure the things you do allows the corresponding telemetry to stand out i.e. collect more effective telemetry.
\n\n\n\n

So let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities

\n\n\n\n

#1 – C2 using PowerShell

\n\n\n\n

Why PowerShell? 

\n\n\n\n
  1. Sophisticated off the shelf tooling
  2. PowerShell logging & blocking not widely implemented
  3. Great obfuscation capabilities
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Block PowerShell to force the adversary to use non-PowerShell options.

\n\n\n\n

Advantage

\n\n\n\n

Since PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.

\n\n\n\n

MITRE Shield Technique: Security Controls

\n\n\n\n

#2 – Enumerated the domain for users and groups

\n\n\n\n

Why enumerate the users?

\n\n\n\n
  1. Find privileged group members of groups like Domain and Enterprise Admin. Successful compromise of DA / EA will almost certainly result in customer DB access down the line, so it’s important to know who they are.
  2. Run keyword searches across attributes like username, SPN, description, etc. to find accounts that can be used for SQL logins. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out how to login to the database, regardless of whether you have domain admin credentials or not.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Setup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.

\n\n\n\n

Advantage

\n\n\n\n

Gain insight into enumeration activities being conducted against the domain from a user perspective.

\n\n\n\n

(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)

\n\n\n\n

MITRE Shield Technique: Decoy Account

\n\n\n\n

#3 – Enumerated the domain for computers

\n\n\n\n

Why enumerate the computers?

\n\n\n\n
  1. Run keyword searches across attributes like hostname, SPN, description, etc. to find accounts that could be SQL servers. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out where the DB is located.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Setup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.

\n\n\n\n

Advantage

\n\n\n\n

Gain insight into enumeration activities being conducted against the domain from a computer perspective.

\n\n\n\n

MITRE Shield Technique: Decoy System

\n\n\n\n

#4 – Privilege Escalation

\n\n\n\n

Why Privilege Escalation?

\n\n\n\n
  1. Get to a higher level of privilege. In this case, the target privilege level is the database/server administrator on the customer database.
  2. Escalated privileges can allow you admin access to one, few, many, or all systems on the network.
  3. With high privileges, you have the opportunity to log in to more systems and steal credentials.
\n\n\n\n

Let’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.

\n\n\n\n

Why Kerberoasting?

\n\n\n\n
  1. It targets service accounts i.e. accounts that have an SPN attribute configured.
  2. Service account passwords never expire.
  3. Sometimes, service accounts are granted DA privileges. At the very least, they have admin privileges somewhere.
  4. Some service accounts are so old that no one remembers they exist and have weak passwords.
  5. It’s really difficult to detect on the wire.
  6. Logs related to service ticket operations are not logged by default. If they are, it is difficult to tell the difference between legitimate and malicious service ticket operations.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n
  1. Setup a decoy kerberoastable account, assign attractive usernames to databases (e.g. SQLAdmin), add a SQL-related SPN (e.g. MSSQLSvc/custdb.domain.com), and write a rule to capture Event ID 4769 for the decoy account.
  2. Remove the real domain admin service account from being kerberoastable or downgrade its privileges.
\n\n\n\n

Advantage

\n\n\n\n

Makes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.

\n\n\n\n

A similar approach can be used for other popular privilege escalation techniques.

\n\n\n\n
  1. Tomcat Manager exploit – Plan a decoy system with Tomcat manager and monitor for connections and interactions towards this system.
  2. LLMNR poisoning – Use a tool like Conveigh to send decoy broadcasts over the subnet and monitor for responses to these broadcasts.
  3. Credential Dumping – Use Invoke-runas to plant fake domain admin credentials in memory using the /netonly technique.
\n\n\n\n

There are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.

\n\n\n\n

MITRE Shield Technique: Decoy Account, Decoy System, Security Controls

\n\n\n\n

#5 – Scanned a subset of computers to identify the customer DB

\n\n\n\n

Why Scan?

\n\n\n\n
  1. Check if the database server is reachable from the target list compiled in #3.
  2. Check if the database port is open.
  3. Check if any banners reveal which might be the customer database.
  4. Check for default passwords on SQL servers for the ‘sa’ account.
\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Plant a decoy SQL server on the network. Alert when you see port enumeration.
  2. Make the real customer database accessible only from certain machines.
\n\n\n\n

Advantage

\n\n\n\n

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.

\n\n\n\n

MITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation

\n\n\n\n

#6 – Used the domain admin account to login to the customer database server

\n\n\n\n

Why log in to the customer database server?

\n\n\n\n
  1. With domain admin privileges, you can extract credentials from memory from the customer database.
  2. Helps you compromise the logged-on SQL administrator account (whether it’s a user or service doesn’t matter).
\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Implement a standard operating procedure to prevent a domain admin from ever logging into the database server. Implement the corresponding rule for this server alone in your SIEM.
  2. Plant decoy SQL administrator credentials in memory.
\n\n\n\n

Advantage

\n\n\n\n

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database

\n\n\n\n

MITRE Shield Technique: Standard Operating Procedure, Decoy Credentials

\n\n\n\n

#7 – Login to the database itself

\n\n\n\n

Unfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.

\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Setup query auditing on the SQL server for accounts with DB admin rights.
  2. Hunt for non-standard queries in the hope of spotting the adversary running ‘select *’ operations and join operations to fully extract the customer database.
\n\n\n\n

MITRE Shield Technique: Hunting, System Activity Monitoring

\n\n\n\n

Apply Active Defense Approach to any use case

\n\n\n\n

I present an abstracted approach to applying Active Defense use cases. It has 4 pieces:

\n\n\n\n
  1. Deceive – Can I do something to trick the adversary en route to/on the system?
  2. Standardize – Can I define how a particular system must be used/controlled?
  3. Analyze – Can I bubble-up anomalies against the system I am protecting?
  4. Control – Can I make it more difficult to reach and compromise the system?
\n\n\n\n

You can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.

\n\n\n\n

Closing Notes

\n\n\n\n

I would like you to note a few things.

\n\n\n\n
  1. Use of the Active Defense approach covers the kill-chain and encourages you to think about the ‘why’ to build better defenses and how your network, endpoints, and active directory are all interconnected.
  2. It reduces complexity otherwise introduced by large scale data analytics across GBs of logs a day.
  3. The active defense approach is not limited to decoys alone, but it is a significant component.
  4. You don’t have to baseline and standardize operating procedures across everything. Just the stuff that matters to you.
  5. You can tighten your hunt use cases with Active Defense, making hunting a lot more productive.
  6. You can take a targeted approach to apply controls, rather than spray controls all over the network that costs time and requires effort.
\n","excerpt":"Pentest reports tell a story. By asking why a pentester made certain choices, you can find opportunities to influence attacker behavior and actively defend your network.\n","slug":"finding-active-defense-opportunities-in-a-pentest-report","date":"2021-01-24T16:36:47.000Z","status":"publish","modified":"2021-02-01T04:52:23.000Z","wordpress_id":18707,"featured_media":{"id":"c2327fb5-d82c-5803-a242-8195b7731a09","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/01/Finding-active-defense-opportunities.jpeg","alt_text":"active defense opportunities","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHBIYiiwP8A/8QAGBABAQEBAQAAAAAAAAAAAAAAAQIAEBH/2gAIAQEAAQUCzKdm2cvr/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAGBAAAgMAAAAAAAAAAAAAAAAAAAERICH/2gAIAQEABj8Crig//8QAHBABAAEEAwAAAAAAAAAAAAAAAQARITFREEFh/9oACAEBAAE/IQHyAVpbfODudjiEqA0T/9oADAMBAAIAAwAAABB8D//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEUH/2gAIAQIBAT8QE1f/xAAbEAEAAgIDAAAAAAAAAAAAAAABABExcRBBkf/aAAgBAQABPxBml2gBK+Bh5vBi4drZGyruUPZ//9k=","aspectRatio":1.5037593984962405,"src":"/static/7db01658f4566de6549893fda89ba90f/14b42/Finding-active-defense-opportunities.jpg","srcSet":"/static/7db01658f4566de6549893fda89ba90f/f836f/Finding-active-defense-opportunities.jpg 200w,\n/static/7db01658f4566de6549893fda89ba90f/2244e/Finding-active-defense-opportunities.jpg 400w,\n/static/7db01658f4566de6549893fda89ba90f/14b42/Finding-active-defense-opportunities.jpg 800w,\n/static/7db01658f4566de6549893fda89ba90f/47498/Finding-active-defense-opportunities.jpg 1200w,\n/static/7db01658f4566de6549893fda89ba90f/0e329/Finding-active-defense-opportunities.jpg 1600w,\n/static/7db01658f4566de6549893fda89ba90f/eeda9/Finding-active-defense-opportunities.jpg 1650w","srcWebp":"/static/7db01658f4566de6549893fda89ba90f/58556/Finding-active-defense-opportunities.webp","srcSetWebp":"/static/7db01658f4566de6549893fda89ba90f/61e93/Finding-active-defense-opportunities.webp 200w,\n/static/7db01658f4566de6549893fda89ba90f/1f5c5/Finding-active-defense-opportunities.webp 400w,\n/static/7db01658f4566de6549893fda89ba90f/58556/Finding-active-defense-opportunities.webp 800w,\n/static/7db01658f4566de6549893fda89ba90f/99238/Finding-active-defense-opportunities.webp 1200w,\n/static/7db01658f4566de6549893fda89ba90f/7c22d/Finding-active-defense-opportunities.webp 1600w,\n/static/7db01658f4566de6549893fda89ba90f/36d36/Finding-active-defense-opportunities.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHBIYiiwP8A/8QAGBABAQEBAQAAAAAAAAAAAAAAAQIAEBH/2gAIAQEAAQUCzKdm2cvr/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAGBAAAgMAAAAAAAAAAAAAAAAAAAERICH/2gAIAQEABj8Crig//8QAHBABAAEEAwAAAAAAAAAAAAAAAQARITFREEFh/9oACAEBAAE/IQHyAVpbfODudjiEqA0T/9oADAMBAAIAAwAAABB8D//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEUH/2gAIAQIBAT8QE1f/xAAbEAEAAgIDAAAAAAAAAAAAAAABABExcRBBkf/aAAgBAQABPxBml2gBK+Bh5vBi4drZGyruUPZ//9k=","aspectRatio":1.5066666666666666,"src":"/static/7db01658f4566de6549893fda89ba90f/32fd5/Finding-active-defense-opportunities.jpg","srcSet":"/static/7db01658f4566de6549893fda89ba90f/06e94/Finding-active-defense-opportunities.jpg 113w,\n/static/7db01658f4566de6549893fda89ba90f/07ab6/Finding-active-defense-opportunities.jpg 225w,\n/static/7db01658f4566de6549893fda89ba90f/32fd5/Finding-active-defense-opportunities.jpg 450w,\n/static/7db01658f4566de6549893fda89ba90f/4a838/Finding-active-defense-opportunities.jpg 675w,\n/static/7db01658f4566de6549893fda89ba90f/9842e/Finding-active-defense-opportunities.jpg 900w,\n/static/7db01658f4566de6549893fda89ba90f/eeda9/Finding-active-defense-opportunities.jpg 1650w","srcWebp":"/static/7db01658f4566de6549893fda89ba90f/b8a88/Finding-active-defense-opportunities.webp","srcSetWebp":"/static/7db01658f4566de6549893fda89ba90f/3a3bf/Finding-active-defense-opportunities.webp 113w,\n/static/7db01658f4566de6549893fda89ba90f/975bf/Finding-active-defense-opportunities.webp 225w,\n/static/7db01658f4566de6549893fda89ba90f/b8a88/Finding-active-defense-opportunities.webp 450w,\n/static/7db01658f4566de6549893fda89ba90f/761da/Finding-active-defense-opportunities.webp 675w,\n/static/7db01658f4566de6549893fda89ba90f/210c1/Finding-active-defense-opportunities.webp 900w,\n/static/7db01658f4566de6549893fda89ba90f/36d36/Finding-active-defense-opportunities.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e7f2f716-139d-5a7e-b47a-a996bcfc50f1","title":"Four MITRE Shield Techniques You Can Implement in 2021","content":"\n

For free, of course.

\n\n\n\n

At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community has a shared vocabulary and framework for actively defending against attacks instead of reacting to them.

\n\n\n\n

I’ve been having conversations about MITRE Shield and Active Defense with CISOs and customers. While some of the conversations are basic and around what is active defense and why does it matter, what I consistently hear from across the board is – “how do we even begin to implement this stuff?” That’s a fair question, but it’s only one part. What more folks aren’t asking is, where do we implement active defenses for the most impact.

\n\n\n\n

I’ve zeroed down on four active defense techniques from the MITRE Shield matrix that address both the questions – how do I get started with this and where should I be building active defenses first. Think of this as a soft launch guide for your Active Defense journey.

\n\n\n\n

I’ve selected techniques based on two factors:

\n\n\n\n
  1. Should be easy to implement without involving too many teams.
  2. Should have a very high impact on disrupting adversary actions.
\n\n\n\n

As a result, all four defenses are Active Directory exclusive. Active Directory has become an adversary favorite attack vector. By deploying active defenses in Active Directory, you’ll be able to make great strides in disrupting adversary actions.

\n\n\n\n

Are there any prerequisites?

\n\n\n\n

Only two:

\n\n\n\n
  1. You must be able to make some minor changes to your Active Directory server.
  2. You must have access to a test machine. This could be your own machine or one that’s given to you. It would be great if this machine was not network access restricted in any way to maximize engagement.
\n\n\n\n

Let’s dive right in.

\n\n\n\n

MITRE Shield Technique #1 – Decoy Account

\n\n\n\n

MITRE Shield Procedure – DPR002

\n\n\n\n

Plant decoy accounts in your Active Directory. Any interaction with these accounts is a high-confidence indicator of compromise. These accounts will also help you study the adversary’s actions, mislead attackers by putting these accounts in their path during enumeration, and use them to influence the attacker’s actions and next steps.

\n\n\n\n

Step 1 – Use case setup

\n\n\n\n

Set up a decoy account and give it “Domain Admin” privileges. This will make the account interesting to the adversary. 

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

In this video, we focus on detecting the operation. We show how to setup Windows Auditing so that we can capture the appropriate log. We also demonstrate an attack to test if the logs are captured appropriately.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If login_activity observed for decoy_account then raise a high priority alert.
\n\n\n\n

MITRE Shield Technique #2 – Decoy Systems and Decoy Content

\n\n\n\n

MITRE Shield Procedures – DPR0022 and DPR0033

\n\n\n\n

Decoy systems are an excellent active defense tool because they act as a target to lure away attackers from legitimate assets. Decoy content could be anything ranging from fake files to browser shortcuts that act as breadcrumbs to point adversaries to decoy systems.

\n\n\n\n

Step 1 – Use Case Setup

\n\n\n\n

In this video, we set up a webserver on our test machine to channel an adversary towards interacting with it. We create a browser shortcut and place it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

We ensure that our web server is logging connections. If an adversary attempts to conduct reconnaissance against this webserver, we should see a logline in the webserver log.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If REQUEST observed for /admin then raise a high priority alert.
\n\n\n\n

MITRE Shield Technique #3 – Decoy Credentials

\n\n\n\n

MITRE Shield Procedure – DPR0024

\n\n\n\n

Decoy credentials are fake usernames and passwords that can be planted in a variety of places including in the Active Directory. They act as silent alarms when interacted with and also as a means to delay the attacker.

\n\n\n\n

Step 1 – Use Case Setup

\n\n\n\n

In this video, we create a batch file planted with fake credentials and store it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

In this video, we show how to set up auditing on your test machine to capture attempts to use the credentials against your test machine.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If login_event is 4625 AND username is admin
Then raise a high priority alert.
\n\n\n\n

MITRE Shield Technique 4 – Pocket Litter

\n\n\n\n

MITRE Shield Procedure – DPR0052

\n\n\n\n

Pocket litter is an active defense technique used to mislead attackers into thinking that the system and user they’re exploiting are legit. You plant fake documents, browser history, browser sessions, etc. to give adversaries the confidence that they are on the right track.

\n\n\n\n

Step 1 – Use Case Setup

\n\n\n\n

In this video, we will set up a file share on the test machine. We will plant a shortcut to this file share in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

In this video, we show how to set up file share auditing on your test machine to capture attempts to access the file share on your machine.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If login_event is 5140 AND share_name contains shared_folder_name\nThen raise a high priority alert.
\n\n\n\n

Why have you chosen the SYSVOL folder in your videos?

\n\n\n\n

These folders are accessible to all users within your environment. Over time, these folders accrue a lot of files and scripts that are interesting to adversaries. We wish to use these folders to misdirect the attacker, should the attacker go browsing through these folders. It is also uncommon for regular users to require to browse through this folder.

\n\n\n\n

Closing Notes

\n\n\n\n

The focus of this guide was to get your mind thinking about active defense. If there’s one thing I’d like you to walk away with, it’s that if any of these defenses trigger an alarm you will have discovered malicious activity for a couple of hours of effort. And it cost you nothing.

\n\n\n\n

At Smokescreen, we’ve been implementing active defense programs since before it was a thing. No wonder then that Smokescreen covered 95% of MITRE Shield when it launched in Sep 2020. If you’d like to see how we can help, hit us up. Here’s a mapping of Smokescreen to MITRE Shield if it’s helpful.

\n\n\n\n

We’re also running active defense workshops where we deconstruct MITRE Shield and talk about how you can implement it. Feel free to sign up.

\n","excerpt":"For free, of course. At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community […]\n","slug":"four-mitre-shield-techniques-you-can-implement-in-2021","date":"2020-12-30T16:48:39.000Z","status":"publish","modified":"2021-02-03T07:14:04.000Z","wordpress_id":18652,"featured_media":{"id":"3b48d9b0-598d-52ec-92d7-1eef58be5ea8","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-MITRE-Shield-Techniques.png","alt_text":"Smokescreen-MITRE-Shield-Techniques","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACQklEQVQoz0WSSW8TQRCF84s5IXFBHJEQ4g9wQggOkbhEBEEIS4xDMkZeEhzH8SITJ+N4tu4Zz+6xncerceIcamq6W/11Vb23ZU8mULYN33UxUx5mWsHXGjPfRxgECGezh+Ba9gOea8+Dchy4lgXn5gbCsUwTW/IZXHTR6w/RG11jMrV5mRcJiKIIcRw/BNdRGJZggfpKbaAboDkew6hWcWg0YHRGuDQtFFmKPMuQpSmSJEHKSEooH4jC8sHAlypdeLZF4HRT5ZbFn9HlGOOrK5gTEybXJl+8NDkK7SPP8xKWpMzZkrlgXjBWPFshZQ7DpISWwBuWuf3lKz7sf8f23jd8rBxit/obe8c1NLoXmOcZUsLiyIY3rUG755z5KbRlINZt5MEJVrkFz9UEmmvgzo8D7Faq2Cdk5+AXPlWPcNg6RWc4YtsJsjmQWAfQJ0/gd1/Bbz+D138L3XkO1XyE1PoJpWICr9ctN9pnaHXOcdYfoHXRw1/m7ugfivmcs0yR5bdInD8I2k+he68RCHT4Dqr3Brr1GJl7TGC0BopCmkoFVEwsEVNFmVnKEKWlwpSzy/0zJP0XSNw6YqeBePIZyfg90sFLFH4DygvvKmTL1UoFNcPA8dERDOZms4l6vY4Jh1wqTfi8KLBY3qIo5igWQLFkyN5ixVhQbXstijOlOgyXG4rmLk19Z+gsE0HW1pFqg4CmZhc+za/EMuzMEQ+KZe5tI/4Rujg/uIOJee/NLLCNFxmyJ+ez0tyKqrvlfeFIt/8BWgssJrC5KxYAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/69585/Smokescreen-MITRE-Shield-Techniques.png 200w,\n/static/edada2176ce537fff9fc98c912eee812/497c6/Smokescreen-MITRE-Shield-Techniques.png 400w,\n/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png 800w,\n/static/edada2176ce537fff9fc98c912eee812/f3583/Smokescreen-MITRE-Shield-Techniques.png 1200w,\n/static/edada2176ce537fff9fc98c912eee812/5707d/Smokescreen-MITRE-Shield-Techniques.png 1600w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/61e93/Smokescreen-MITRE-Shield-Techniques.webp 200w,\n/static/edada2176ce537fff9fc98c912eee812/1f5c5/Smokescreen-MITRE-Shield-Techniques.webp 400w,\n/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp 800w,\n/static/edada2176ce537fff9fc98c912eee812/99238/Smokescreen-MITRE-Shield-Techniques.webp 1200w,\n/static/edada2176ce537fff9fc98c912eee812/7c22d/Smokescreen-MITRE-Shield-Techniques.webp 1600w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACFUlEQVQoz02SS0/bQBSF83f7A7rprpt22S5bqbtu6KpqEaiKUAuEgAgJIQhC0jyI4zi249f4NbZj0OkZJ0pZXM3Ynvl87rmnZhsGTF2HNp1iPtehGyZc10UoBKIwRBzHSLal9lEUVd+E7yPgOW+1gmNZUBxrsUBttVxWsItGA832LVr9R9iOhyKTyLMMaZruSqYx0oTwKEQkAgSeQ6BFoAnFUdBapZA1nkwxnc0w518WpgndtFgmshfQKF0jTApWDhGvkcgSMnumarlTWXN5aULY96Pf+PHnBAeNJg7OznHcucb+aRO261FpjlSmEF4fwh2w3TGE00UiBpDiDqVcwuM522DLLskTtvztVx37x6c4JHCvfoTD5gXOuj2sFDAv2K5AeP8Wwd17iNs38AafETx8QNB5BWn8hO/HBOobDy3W/fAvxjMNY22O4eMMQ+59mv/8VFJdhkxyIA/v4PUJGX5CMPiIYPQVfvc1pH0C34s2CiszWYamwaR/yk/XtuFzgg4nGIaCPuasFIWxh8w6QhbNkdgt7uvItS8oRYfAcAukhwvCri4vcd1u46rVQu/mBr1eD6PRqIqKlLIaSlECWfGELC+54v+areFQxG7KDqEqU2EQIGbO0iRhi5vYKJgkLOG7iGqVYhGoyDCDzqqKjL3tsgKqMKoHNXYV0sDzqgtVqAlXoJdZVM/qfbQNt7JGWVTNgqx/v9rh65njvVwAAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/e7519/Smokescreen-MITRE-Shield-Techniques.png 113w,\n/static/edada2176ce537fff9fc98c912eee812/7e7e9/Smokescreen-MITRE-Shield-Techniques.png 225w,\n/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png 450w,\n/static/edada2176ce537fff9fc98c912eee812/e2e7f/Smokescreen-MITRE-Shield-Techniques.png 675w,\n/static/edada2176ce537fff9fc98c912eee812/db955/Smokescreen-MITRE-Shield-Techniques.png 900w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/3a3bf/Smokescreen-MITRE-Shield-Techniques.webp 113w,\n/static/edada2176ce537fff9fc98c912eee812/975bf/Smokescreen-MITRE-Shield-Techniques.webp 225w,\n/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp 450w,\n/static/edada2176ce537fff9fc98c912eee812/761da/Smokescreen-MITRE-Shield-Techniques.webp 675w,\n/static/edada2176ce537fff9fc98c912eee812/210c1/Smokescreen-MITRE-Shield-Techniques.webp 900w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"9d8a2f78-f1ee-581e-957c-2092fc5a0b66","title":"Active Defense – Incident Response’s New Best Friend","content":"\n

On Sep 14, 2020, MITRE, the federally funded R&D organization perhaps best known for its popular ATT&CK framework, announced Shield – an Active Defense knowledge base developed to arm cybersecurity defenders with a framework for actively dealing with threats instead of passively reacting to them. As MITRE puts it, Shield has been “derived from over 10 years of adversary engagement experience. It spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders.”

\n\n\n\n

As an industry armed with protecting networks and IT infrastructures, we have been overly reliant on passive defenses. Given the rapid pace of technology development, shortage of skilled cybersecurity professionals, and the vendor community’s ‘assume breach’ schtick, we have become accustomed to dealing with threats on our turf, on the adversary’s terms, instead of actively smoking out the threat. We’re always reacting after the fact. Which is why Shield couldn’t have arrived sooner.

\n\n\n\n

Since then, I’ve had countless conversations with CISOs attempting to understand how Shield can inform their security posture and incident handlers/practitioners on what they can do today that might have an outsized impact on their ability to defend. I’ve also realized that there’s a fundamental conversation to be had about what ‘active defense’ in cybersecurity means, and why teams must adopt it as an integral part of their security program and best practices.

\n\n\n\n

Over the last 10 years, I have been a part of multiple incident response projects. The story usually unfolds in a similar fashion – evidence of compromise is on the network. Jump to the ‘Cotton Eye Joe’ problem – where did it come from, where does it go. And of course, what did it damage.

\n\n\n\n

Perhaps the most high-pressure scenarios are those where the threat is not just active but is actively moving around the network, say something like ransomware. Machine after machine is getting infected, and there is nothing you can do to stop it.

\n\n\n\n

Consider this nightmare scenario for a moment. You work security for a business with 1000 employees. You don’t have an anti-virus (AV) installed (hypothetical). You have been infected by ransomware. You immediately take a call to purchase an AV, the budget gets freed up, and you go to procure it. But it takes days, even weeks if not months to procure it and push it out to every single workstation and server. Your AV has now future proof-ed you in some way, but the adversary has already finished her attack. You are recovering from the disaster in some form. Maybe you are restoring backups. Maybe you just paid up the ransom. The response was required in minutes and hours. That battle was lost.

\n\n\n\n

The fallouts of such incidents can be brutal. There is intense pressure on security teams, and they carry heavy burdens. I have seen security folks stay up 96 hours at a stretch, trying to squeeze in a couple of minutes of sleep in offices amid thousands of messages, texts, and calls. I have seen top management in companies get involved and ask tough questions to which there are no good answers.

\n\n\n\n

If you are involved in any security function in your organization, at any level, this should be relatable. To some, something like this might have happened recently. For some, it’s been a while. And if it hasn’t happened to you yet, chances are, it will happen at some point – sooner rather than later.

\n\n\n\n

And then let’s talk money. It costs a lot of money. I’m talking serious cash. In the order of hundreds of thousands of dollars. All being spent in a matter of days. You are paying your vendors, service providers, advisors, and implementers. You are paying by the hour for everyone involved in the response, IT teams, security teams, and active directory teams. And then people wonder why cybersecurity is a $123 billion industry.

\n\n\n\n

It gets chaotic.

\n\n\n\n

In my experience, you can contain that chaos with an Active Defense mindset.

\n\n\n\n

Active defense isn’t really a new concept. For example, the armed forces and police have active defense protocols. If intelligence picks up an impending threat, the machinery kicks in to reflect the seriousness of the threat. Intensified checking at posts, barricades across high-value locations and roads, enhanced protective measures for ministers and other high-value targets, orders to restrict the movement of people and goods, frequent patrolling – you get the drift.

\n\n\n\n

Now notice this strategy for a moment. It includes a lot of tough calls because the threat has a material impact on the life of civilians. There’s a protocol in place. Also, notice that the strategy doesn’t involve waiting for the bad guy to move around as he pleases. It actively tries to smoke the threat out. The alternative is to play catch up. Always one step behind the threat. Ring any bells? Of course, it does because that’s exactly what we do in cybersecurity. 

\n\n\n\n

What I’m getting to is that when you are in the midst of an incident, you have ways to try to smoke out the threat, make life difficult for the adversary, and minimize the impact of the breach. One that can be measured in days (if not hours), will not be as costly and will reign in panic.

\n\n\n\n

It involves barricades, restriction of movement, enhanced patrolling, and of course, protecting the crown jewels.

\n\n\n\n

Here’s how it might look like in a real-life ‘incident’:

\n\n\n\n\n\n\n\n

This is, of course, a non-exhaustive list but all of these can be really quick to do! The biggest impediment is usually taking the tough calls as this may temporarily and disrupt services. It also happens because of poor team communication across the board. It is because of this that we forgo a defensive advantage and chase the threat for days and months on end.

\n\n\n\n

But hey, if you drill this out before things go wrong, you will already know and understand what the impact is going to be.

\n\n\n\n

Think about it this way. You have an existing set of software defenses. That should make life difficult for the software tactics of the threat. Active defense is you putting additional software defenses to attack the human behind the threat.

\n\n\n\n

This brings me back to why MITRE Shield couldn’t have come sooner. For the first time, defenders have a shared vocabulary and framework for what they can proactively do to defend their networks. It even maps out to MITRE ATT&CK, telling you exactly which defense can disrupt an attack tactic. I strongly urge you to check out Shield.

\n\n\n\n

If you need help with understanding this more, we are running 30 mins workshops to deconstruct MITRE Shield and breakdown how you can get started with active defense. Feel free to sign up here.

\n\n\n\n

We have also released our mapping to MITRE Shield. With Smokescreen, you can achieve 95% coverage of all the active defense techniques included in the framework. You can get the mapping from here. And if you want to see all of this in action, you can always ask for a demo.

\n\n\n\n

I’m very excited about all the conversations that are happening around MITRE Shield. As we help our customers implement Shield and achieve more active defense coverage, I will be sharing what I learn. Feel free to hit me up on LinkedIn or Twitter.

\n","excerpt":"Active defense provides defenders with a shared vocabulary and framework for actively dealing with threats instead of passively reacting to them.\n","slug":"active-defense-for-incident-responders","date":"2020-12-29T01:34:46.000Z","status":"publish","modified":"2021-01-24T16:42:40.000Z","wordpress_id":18639,"featured_media":{"id":"b7c5bd0f-1190-59a5-8777-52cae2404171","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-Active-defense-blog-post-scaled.jpeg","alt_text":"Active defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6644518272425249,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/f836f/Smokescreen-Active-defense-blog-post-scaled.jpg 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/2244e/Smokescreen-Active-defense-blog-post-scaled.jpg 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/47498/Smokescreen-Active-defense-blog-post-scaled.jpg 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/0e329/Smokescreen-Active-defense-blog-post-scaled.jpg 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/61e93/Smokescreen-Active-defense-blog-post-scaled.webp 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/1f5c5/Smokescreen-Active-defense-blog-post-scaled.webp 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/99238/Smokescreen-Active-defense-blog-post-scaled.webp 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/7c22d/Smokescreen-Active-defense-blog-post-scaled.webp 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6647058823529411,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/06e94/Smokescreen-Active-defense-blog-post-scaled.jpg 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/07ab6/Smokescreen-Active-defense-blog-post-scaled.jpg 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4a838/Smokescreen-Active-defense-blog-post-scaled.jpg 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/9842e/Smokescreen-Active-defense-blog-post-scaled.jpg 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/3a3bf/Smokescreen-Active-defense-blog-post-scaled.webp 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/975bf/Smokescreen-Active-defense-blog-post-scaled.webp 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/761da/Smokescreen-Active-defense-blog-post-scaled.webp 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/210c1/Smokescreen-Active-defense-blog-post-scaled.webp 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}}]},"costSectionImage":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADUklEQVQ4yzWSW2gcZRzFzzcze02y273OfWdnZ3dmr9mmSUsiaaJtV+0lNppaGmukTcEHgygWtS8iKAUFRSEvggj6JoJPPha1j74IfREUBC+ICIKgD2K7mfn7n10dOAzfzHy/Od/5H4xGDVzb6aPSaeeyhl2ZdepW2qx5Sd3qirK2JKnWCaHb56HZO9DMZ4Rm3YBm3YRq7kuq8aFQjU8yVv3LGct5F4AEuVyBVCofl8rqT6xfpKr+h6Sa/0iaSUK3SJgOgSVbdUrbLgmjRtBtYiihqk9VqvLa/A7HH/aAQinWCyiWCWV+UeYPVIM3WRFsNxQ1L4TjhTPNzkGx1T3g9QFDxwwdJwx7LFT9LooVgt34Gucv98ELBpbfQ4kfVrS7SaMWJq16lPH8SHJakahPJTfaLD8SthvBqEXsOso5XsTRhBOH9dbneHzXgmyYMfRWDEzxH3Nei3LNNhUGC5T1+wTXJ+EGJPFdbgTEQJIdj7IshaEczRTY7H6KK88VIfKVOT7u95wd5erNcC4IorQXUL6/QIeGiyS1eiS8DkN9Uvgu1RoTKXG2GsdS1SOUVULn8Pt45Z00RKHiMnCc4CHkXT+aZRfJoEf5zgLlh0skMxDsMHYn11sTh1LskqGp+Oj/AwdHb+LWN0qc3ygeiKyaYY6zyrd7UX7+MBXmj9CMP5g44wxJZqjitlj+ZOoZBiZjYEXj7PV7WFi+LhFxcw4Vn50ORL2Xc1vhXKcb5oJeWOwNo1SzG8FpRiJWrRGBh8XZRXIM0u2I2zB1pxp/4djaVcSXUlE/Ev9VRqgWZdwmzbTapLADxL2zG7HiqYYwWLodcnYhqgZLG087aP2G1dEmllaBREV9OuF4d9Kdwbey3/0x3Rv+qjSD36WG/2cq6P2d6Q7HuaMrlPK7pDiNScEli4tu2qRw7txhLrv9Mx58dA3nLgGnYpubO6s4e2kDDz22JU5uXBHrp/dw36mXxfIDr8srJ96SV+7fTyyvf5BcXPlYHix+JnXmv1Da/a+yQf9Ooub+kPL7t3Hm4hE8chkozWUFntwD1jeQeXVf4MbbCl58IyleejOD51+bxe71Ap7Y07B1zcGFXR9bV+ex+dQx3ryGje0Rzm2fwekL2+yuibMX8S+BMBcPGVLWLQAAAABJRU5ErkJggg==","aspectRatio":1.528735632183908,"src":"/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png","srcSet":"/static/739e365bb81f8bf83185927701d2793f/e223a/cost-image-2x.png 133w,\n/static/739e365bb81f8bf83185927701d2793f/66882/cost-image-2x.png 265w,\n/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png 530w,\n/static/739e365bb81f8bf83185927701d2793f/a384c/cost-image-2x.png 795w,\n/static/739e365bb81f8bf83185927701d2793f/c884a/cost-image-2x.png 1056w","srcWebp":"/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp","srcSetWebp":"/static/739e365bb81f8bf83185927701d2793f/a5ef1/cost-image-2x.webp 133w,\n/static/739e365bb81f8bf83185927701d2793f/4dc00/cost-image-2x.webp 265w,\n/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp 530w,\n/static/739e365bb81f8bf83185927701d2793f/5b747/cost-image-2x.webp 795w,\n/static/739e365bb81f8bf83185927701d2793f/950f5/cost-image-2x.webp 1056w","sizes":"(max-width: 530px) 100vw, 530px"}}}},"pageContext":{"id":"b6cfef25-eb71-5b78-b2b3-78990af2fe3b","relatedPostsIDs":[18727,18716,18707,18652,18639]}},"staticQueryHashes":["1478079672"]}