Hello and welcome to another lesson
from the module analysis and
production. This lesson is about
another technique of analysis,
which is a combination of the cyber
Caltrain and courses of action
matrix.
For this lesson, we will start
with a quick reminder of something
that we have learned in the previous
video, which is the cyber
little chain.
We will also discovered together the
courses of action matrix, which is
constituted of two types of actions,
passive and active courses of
actions. And we will close this
lesson with an example
in the previous video we introduce
at one of the techniques uses for
intrusion analysis, which is
in reality a combination of two
models, the cyber Caltrain
and the diamond model.
This lesson will focus as well on
the cyber Caltrain.
The seven steps of the cyber
Caltrain go over all the stages
of a single intrusion that, when
completed successfully will lead
to a compromise.
It's important to note that the
cyber Caltrain is a process that
represents steps of intrusion
based on actions taken from
adversaries perspective.
Within each of these stages is
also an opportunity for the vendors
to prevent a successful intrusion.
If we place ourselves from
the network defenders side, then
we would apply what we call courses
of action metrics.
Well, let's see what
all of this means.
Let's start with a basic example.
We are in the delivery phase of
a phishing case.
What kind of information is provided
in this step?
The delivery can tell us which
email and web infrastructure
was used to deliver the malware.
So in the lesson, this phase would
provide Aoki's or indicators
of compromise.
These indicators describe
adversaries by providing details
about their infrastructure,
including their tips or
tactics, techniques and procedures
that were used to attack
the victim.
In other words, all these
indicators should have a role
and it needs to be actionable
to increase your defenses.
Now that we mentioned that the
indicators of compromise should
be actionable, what kind of
actions should we take?
There are essentially two
significant categories of action
that responders can take,
passive or active.
This categorization of actions
is described in another model
from Lockheed Martin.
Call it the courses of action
metrics. The passive actions of the
courses of action metrics have
no direct influence on the
actions of the attacker, which is
not the case for the active actions.
Now, let's move to the main focus of
this lesson, which is the courses of
action metrics, the mapping out
of defensive factors against
the cyber toolchain allowed
for the production of guilt
chain courses of action, metrics for
an intrusion.
The producer set of courses
of action metrics, highlights
of the defensive actions that can be
taken and provides a model for
actionable intelligence as described
in the table displayed on this
slide.
Let's discuss together the 70s
constituting the Colins are this
matrix two oh
the seventies fall under the
category of passive courses
of action which are discover
and detect.
The Discover action is a historical
look at the data.
This action heavily relies on
your capability to sawlogs for
a reasonable amount of time and
have them accessible for searching.
Typically, this type of action
is applied against some solutions
or store network data.
The goal is to determine whether you
have seen a specific indicator
and the best.
The other passive action is setting
up detection rules of an indicator
for a future traffic.
These actions are most
often executed in an
intrusion detection system or
IDs or specific
login rule on your firewall
or application.
It can also be configured as
an alert in your simple solution
when a specific condition is
triggered.
The active phases in the courses of
action metrics vary, however,
in the type of impact that they
have on the attacker or the
intrusion.
It's important to note that these
actions are mutually
exclusive and only one
can be applied at a time.
Let's start with the first action,
which is deny the do
not action prevent the event
from taking place.
Common examples include
firewall block or a proxy folder.
The second action is disrupt.
The selection makes the event feel
as it is occurring.
Examples include quarantining
or memory protection measures.
The third action is degrade.
The greater will not immediately
fail an event, but it will
slow down the further actions of
the attacker.
This tactic allows you to
catch up during an incident response
process, but you have to consider
that the attackers may eventually
succeed in achieving their
objectives.
The fourth action is deceive,
and deception allows you to learn
more. About the intentions of
the attacker by making
them think the action
was successful, one way to
do this is to put a honeypot in
place, redirect traffic
based on an indicator towards
the honeypot.
And the fifth action is
destroy the destroy action
is rarely for usual defenders,
as this is an offensive action
against the attackers.
These actions include physical
destruction actions and
arresting attackers,
which are usually left to law
enforcement agencies.
But they also include takedown
of their infrastructure
here. As you can see, there are
multiple courses of action available
for each of the cyber Caltrain
faces, let's say the
delivery phase.
As an example, you can detect
emails if your employees
are aware of this
threat and will redirect
any suspicious email to a security
team. You can also deny
if you have a proxy
filter or you can block
the senders, you can disrupt
if you quarantine emails
and you can degrade by
stripping attachments and you can
deceive by reporting suspicious
emails.
And fortunately, there is no
single rule that can tell you what
action to apply.
The type of action that you will
choose is partly dependent on
the amount of information that you
still want to acquire on the attack
or intrusion.
For example, denying any
mail delivery from specific domains
can block malicious attachments.
But you wouldn't know what these
attachments actually do.
Analyzing the attachment and
applying passive actions to the
newly found indicators can
reveal additional intrusions that
took place via other
monbulk domains.
If you want to acquire more
information to feed your threat
intelligence process, that it
might be more useful to apply,
deceive or degrade action.
Keep in mind that the actions that
you apply will also depend
heavily on your capabilities
on both technical
and organizational level,
even when some actions
can reveal further capabilities from
the attacker.
If you have a limited incident
response resources, it
may be more appropriate to apply
basic disrupt or deny actions.
And concretely, if you only have
a firewall and no way
to redirect traffic to a honeypot,
then Dinni may be your
only option.
In this lesson, we learn together
how defenders can take more
advantage of the concept of cyber
Kielce. We also discovered
another analyzes technique focused
our response actions.
This method is helpful for
organizations to measure what
capabilities they are missing
and identify what it should take
to better response to security
incidents in the future and
fine-tune their approaches to
monitor and log these incidents.
It's important to consider that some
courses of actions are mutually
exclusive.
Here we are talking about active
or mitigating actions.
In contrast, passive
courses of actions are preferred
to be applied together to
gain more visibility.
This is for this video
and we are close in this
module as well.
In this module, we focus on the
analysis and production phase
and in particular, intrusion
in the lysis.
What about more complex cases?
It's important to see how to analyze
campaigns.
Are the analysis methods that we've
seen in this module still valid
or are there more appropriate
techniques for campaigns?
This is what we're going to discover
in the next module.
Call it campaign analysis.
We will start the next module
with an introduction, including
definition of campaign.