Hi everyone.
I'm Chris.
And welcome back to my course on Enterprise Security fundamentals.
In this lesson we are going to talk about the blue team's Kill Chain.
So to get an overview of all of this in the Information Security lexicon a kill chain.
As I've mentioned in the previous section describes the structure of an attack against an objective
well usually used to describe the phases of a red team's operation.
It's also common in the Information Security literature for blue teams to have their own kill chain
rather than describing the structure of an attack against an objective.
The Blue Teams Kill Chain describes the phases of detecting and responding to an organizational attack.
Although there are a variety of different Kill Chain phases discussed in the across the Information
Security literature the Blue Teams kill change generally include the following phases gather baseline
data detect alert investigate planner response and execute and usually they are performed in this order
so let's let's have a little discussion about each and one of the phases in detail Sue.
The first one gather baseline data having adequate time on amounts of baseline data allows you to understand
what your environment looks like when it is not under attack.
It is difficult to know what is the usual or what is the unusual for your network.
Unless you have a good idea of what the usual looks like to analogize it's easier to find needles in
a haystack.
If you have an extremely good understanding of the characteristics of a haystack that has no needles
in it gathering a good baseline data means configuring effective logging monitoring and auditing for
your organization.
When configuring how you will collect baseline data consider enabled.
Consider enabling all auditing and logging options.
The more telemetry that you have the better picture you'll be able to generate of what normality looks
like in your organization's environment.
If you haven't configured all telemetry options it is possible that you won't have a clear enough picture
that will allow you to accurately distinguish normal from abnormal activity collect telemetry over a
sustained period that let's say represents your organization's normal operations baseline data should
also be regenerated as changes are made to information systems on your network.
So it will reflect the current operation of the network rather than only representing the organization's
information systems as they existed at a fixed point in the past
the next phase would be the detect phase detecting an intruder is often a case of noticing abnormal
activity on your organization's information systems.
For example one may notice that a server where for the last few months connections via remote desktop
protocol RTP have only been made during business hours is suddenly servicing RTP requests late at night
or on weekends for example or where a computer is transmitting unusually large amounts of data to hosts
on the Internet where previously amount of traffic it transmitted was negligible.
Detection can be difficult as competent intruders will attempt to leave minimal trace of their activities
in the telemetry logs of your organization's information systems rather than detecting abnormalities
by manually examining event logs.
Many organizations today rely upon intrusion detection systems or shortly ideas and of course security
information and event management systems.
Those would be the CRM tools and they rely upon this kind of tools to identify suspicious anomalies
in the telemetry generated by the information systems.
The next one would be the alert phase.
Well let's put it this way.
When does a series of unusual events correlated across multiple logs reached the stage of being worthy
of further investigation.
Correlation with other events is very very important.
A series of failed attempts at remote RTP access by themselves are suspicious but don't indicate a problem.
Privacy.
A series of failed attempts at remote RTP access.
Successful remote log in via RTP and then suspicious failures of the let's say LSA assess that EMC service
securing in the same session that would be worthy of investigation alerting is the process of bringing
such be suspicious anomalies in the telemetry generated by the information systems to the attention
of the blue team.
It is important though that members of the blue team tune their ideas or seem solutions to provide an
appropriate level of alerting if an alert system provides too many false positives then that is triggered.
That is it triggered too many alerts that aren't associated with an attacker or red team activity.
Then the blue team may miss an alert that is indeed associated with the red team activity through the
alert fatigue.
For example during a recent breach at a famous retailer alerts were generated by the retailer's internal
monitoring about the attackers activity but were discounted at the time as false positives because the
internal systems generated so many alerts for innocuous activity that it wasn't clear to the security
team whether any individual alert indicated a problem or misclassified routine events.
Some ideas were similar systems will provide recommendations as to which activity requires further investigation
and may even suggest further ways to find evidence to validate the hypothesis that an intruder is present
within the organizational systems.
And of course that the organization is under attack the next phase is the investigate phase.
Once the blue team has verified the presence of an intruder on the network they need to determine the
degree to which the intruder has infiltrated the network.
A detailed and thoroughly investigation should determine which systems the intruder has compromised
when those systems were compromised and how those systems were compromised.
These steps are important because the scope of many intrusions often exceeds the initial assessment
of the severity of the intrusion.
Only by understanding where how and when systems were compromised is it possible to begin to effectively
remediate vulnerabilities that led to the compromise and to achieve the goal of ejecting the intruder
from the organizational network.
The next phase and in my opinion the most or a very very important phase is to plan a response and I
am going to detail this just now.
So organizations should not attempt to evict the intruder until they have a good working understanding
of the topology of the intrusion.
Similarly the method through which an intruder is evicted and vulnerability is remediated should be
planned rather than executed in LA in an ad hoc manner.
The red team most likely has fallback strategies are a well planned response counters the attacker fallback
strategy a purely reactive response can turn into let's say whack a mole where the attacker has a counter
move up their sleeve and including becoming stealth here to make it seem as though they have been evicted
to the network when what they've done in reality is moved laterally to a new compromised host and temporarily
ceased activities while they wait out for the blue team's countermeasures from an organizational perspective
while time is of the essence in terms of evicting the intruder in most real world the situations the
intruder is only detected long after they have infiltrated the network.
Now this means that of course it's unlikely that substantially more harm will come in the time it takes
for the blue team to formulate an effective response than would occur if the blue team responded in
an immediate and ad hoc manner.
And now if we are on this if if we're talking about planning a response I want to talk to you about
another concept in the next slide.
And that is
what does the concept of measured response means and how would we translate it so I will quickly go
through the bullets here and then I will get into details about them.
So plan and executed response.
These are basically what should a measured response be.
Don't play whack a mole with the intruder.
The real intruders are likely to have been present for some time before the detection.
They have likely built in safe strategies to retain access if discovered the first time the intruder
is aware that they have been detected should be after they have been ejected.
This is quite an important one.
If they are aware their activity is detected they may institute countermeasures.
This would be the.
Let's see highlights and bullet points for a measured response.
So the need for a measured response.
Your organization should plan and execute a response but it shouldn't be doing what it shouldn't be
doing is playing whack a mole with the intruder intruders have usually been present for a long time
so they have likely built in fail safes that won't that won't be the case in a red team exercise.
Because obviously the red team won't won't have been present for that long but when you're thinking
about the real exercise the reality is that intruders probably have been there for some time before
you've detected them.
And that's a known fact.
So what you want to make sure is getting rid of the intruder.
But you don't want to trigger something worse.
So it's sort of picking up a snake.
You've got to be very careful in how you pick up the snake right.
Otherwise of course you will get bitten the first time that the intruder should know that you're aware
of them is when they've already been ejected from the network because if they're aware that you're aware
of them they're going to start putting in place countermeasures and they're going to be a lot lot harder
to clean out of your infrastructure.
Whereas if you get rid of them in one fell swoop because you've got a measured response and you've figured
out the scope of their intrusion and you deal with that all at once then it might be you know even involve
cutting yourself off the Internet right.
So this would be effective at a certain point in time.
So just so you can clean them out and fix the problems and then bring yourself back online and bring
yourself reports back on to full functionality
the next phase of our blue team's skill chain is of course to execute right.
And when we are talking about execute we are talking about the phase ofter you have planned a proper
measured response and you are about to execute that plan.
So during the execution phase the blue team enacts the response plan to evict the intruder from the
organization's information systems and to remediate the vulnerabilities in the security configuration
that the intruder leverage in the first place.
When infiltrating the network if completed successfully the intruder will no longer be present within
the organization's information systems and the process of performing a more detailed post incident analysis
can occur.
So this would be the phases of the of the blue team's kill gene.
But I want to talk to you about another very very important aspect.
After the exercise or after a real attack and that is the post incident analysis.
In other words in the interest in in the industry slang also cold as the Blue Team postmortem.
Right.
And as we see here in the slide after Red Team attack the blue team should be doing the following.
And I've highlighted the few bullet points here of what the blue team should be doing.
So the first one is determine why vulnerabilities the red team exploited were present
determine what the blue team could have done better
and where are the detection mechanisms lacking.
And this is what needs to be done after each exercise or off to reach a security incident that occurred
within your organization.
The first bullet point is very valuable because once you determine what what vulnerabilities have been
exploited and why the vulnerabilities the vulnerabilities were present you can take appropriate measures
in remediating those vulnerabilities.
And of course implement policies in place so you won't have those vulnerabilities or other ones in the
future like why a vulnerability was there because for example on a Windows server it might be that a
patch was not installed at the proper time to determine what the blue team could have done better.
Now this of course means that you would do a proper assessment of the blue team's response and basically
you would do a proper assessment of the entire Blue Team skill chain with all its phases and then sit
down and see what could have done what could have been done better.
For example you might have responded more quickly to an alert you might have.
I don't know.
Executed the response plan in a more timely fashion and things like that of course.
And the last bullet here.
Where are the detection mechanisms lacking now.
If a red team or a real attacker manages to get to beachhead on the network to infiltrate the network
that means that some of the detection mechanisms are lacking somewhere.
Maybe it's maybe it's the fact they're not properly configured and are spitting out so many alerts that
are false positives and your security team basically does and doesn't have a way to to tell what's a
false positive from the real intrusion because there are so many alerts and there's a large volume of
alerts and things like that you know.
So you have to check out and see exactly where are the detection mechanism lacking and try to properly
remediate that.
Meaning that you could do some configuration settings on your ideas and ideals or seem solutions that
you have in place in your organization.
I will see you guys in the next lesson.
I hope this has been informative for you.
Thank you for watching.