The Tangled Web of IR Strategies

It may not be fair to say that incident response (IR) is the essence of an enterprise's cybersecurity strategy, but it is what everything else is building toward. However, the biggest opponent of IR is not as much attackers as it is time.

The bad guys, often aided by machine learning (especially in state-actor attacks), are ultrafocused. Cyberattackers today have a precise attack plan. Typically, they will be prepared to steal what they are looking for — or to damage systems — in a few minutes and then quickly exit the system.

Although some attackers prefer a stealthy means that installs malware and watches network activity for potentially months, many of the nastiest criminals today use a hit-and-run approach. That means an IR plan must identify what is going on, lock down ultrasensitive systems, and trap the attacker in moments. Speed may not be everything, but it's close.

Complicating the current IR environment is the fact that enterprise threat landscapes have gotten exponentially more complex in recent years, especially in terms of being porous as well as giving bad guys far more places to hide. Beyond the WAN and company systems, there are the shrinking — but still relevant — on-premises systems, a large number of cloud environments (both known and unknown), IoT/IIoT, partners with far greater access, home offices with insecure LANs, vehicle fleets with their own data retention and IP addresses, mobile devices with full credentials (often owned by employees, raising more security concerns), and SaaS apps that are hosted in systems with unknown holes of their own.

With all of that happening, the security operations center (SOC) may have mere minutes to identify and deal with a breach.

The biggest CISO problem with IR is a lack of preparation, and the biggest IR enterprise weakness today is foundational. The best processes for IR begin with readiness via building a solid organizational threat model and reconciling the threat library of things that could adversely affect the company with an alignment to what preventative, detective, and reactive controls are present against the attack surface of that threat model. Employing automation via security orchestration, automation, and response (SOAR) technologies has become highly useful in reducing response times and being able to leverage playbooks that get triggered upon certain defined conditions being met in the technical environment.

Check the Map

One of the most critical foundational elements is working from a current, accurate, and comprehensive data map. The problem is that today's environments make having a truly complete data map impossible.

Consider the mobile factor alone. Employees and contractors are constantly creating new intellectual property (a series of emails or texts, for example, between a sales rep and a customer or prospect) via mobile devices and then not syncing that information with centralized systems controlled by IT.

Because it's impossible to protect that which you don't know exists, generating as accurate a data map as possible is critical. It wouldn't hurt to also increase the visibility of all tools, platforms, hardware/devices (especially IoT), and anything else that an attacker could subvert.

Continuous attack surface management (CASM) has been an evolving area of security activities that companies need to mature to ensure that edge devices, particularly those that are IoT devices that may have direct access to the edge gateway, are adequately protected with detective controls.

You need to start with traditional asset management strategies, identifying all components and tracing all assets, regardless of whether they're in a rack somewhere or in a colocation. For too many enterprises, there is no comprehensiveness, no proper governance. They need to match assets and data with each line of business to plot out sustainability for that LOB. They need to figure out everything from IoT devices to third-party vendor software. There are so many things that often exist below the radar. What is the ecosystem for each and every product line?

The Vertical Dimension

Beyond that one enterprise, attack surface and the threat landscape must be identified for any verticals where the machine operates and often it has to drill into any and all subindustries. That forces a strict evaluation of what threat intelligence is being used.

For industry/vertical data, that means integrating information sharing and analysis centers (ISACs) along with open source alerts, vendor notifications, the Cybersecurity and Infrastructure Security Agency (CISA) and the (National Vulnerability Database (NVD) and many others, song with internal SIEM data.

But all of that threat intel is powerful before an incident. Once an attack begins and the SOC staff is actively defending itself, threat intel can sometimes prove more of a distraction than a help. It's great before as well as after the attack, but not during.

Companies often undermine their IR speed and effectiveness by not giving the SOC team sufficient access as well as information. For example, audit logs often include the IP addresses of affected devices, but some logs only display an internal NAT address and SOC staff couldn't easily and quickly map public IP addresses to NAT IP addresses. That forced the SOC team — during an emergency — to reach out to the network infrastructure team.

Does the SOC team have access to all cloud environments? Are they listed as contacts for all colocation and cloud support staff?

It is common for security people to use military analogies — especially war references — when describing incident response strategies. Sadly, those analogies are more apt than I'd wish. Attackers today are using top-end machine learning systems and are sometimes financially backed by nation-states. Their systems are often more robust and modern than what enterprises use for defense. That means that today's IR strategies must use the ML tools to keep up. The attackers have their methods timed to the second, and they know they have to get in, do their damage, exfiltrate their files, and get out quickly. CISOs today must detect and block in even less time.