Connect with us

Expert Speak

Indicators of Behaviour and the Diminishing Value of IOCs



Written by Hussam Sidani, the Regional Vice President for the Middle East and Turkey at Cybereason

How secure is your organization if you can only stop attacks that have already been detected in other environments based on Indicators of Compromise (IOCs)? Secure enough, if those were the only attacks you needed to be concerned with. But what about targeted attacks with bespoke tactics, techniques, and procedures (TTPs) that have never been documented because they were designed only to be used against your organization?

In today’s threat landscape that’s what’s happening: zero-day exploits, never-before-seen malware strains, and advanced techniques developed specifically for high-value targets are plaguing security teams. Most security solutions do a pretty good job of detecting and preventing known threats, but they continue to struggle with detecting and preventing novel threats. But the issue run even deeper than that — how can security teams detect malicious activity on the network earlier if the actions and activities of the attacker are not outwardly malicious because they are typical of activity we expect to see on a network?

The diminishing value of IOCs
Following a security incident, investigators scour for the evidence and artifacts left behind by the attackers. These can include IP addresses, domain names, file hashes, and more. Once these Indicators of Compromise (IOCs) have been documented, they can be shared so that security teams at other organizations can search their environments for similar threats, and security solutions can be tuned to better detect and prevent them from being used in subsequent attacks. That’s great for everyone, except the initial victims of the attacks, of course — for them, the damage has already been done.

Bur IOCs are constantly changing and more often are unique to a specific target, so leveraging IOCs for proactive defense in another environment is unlikely to result in earlier detections. Even the assumption that IOCs are somehow uniformly applicable in every instance, for a given attack campaign in the same environment, has proven to be demonstrably false.

Furthermore, the more advanced attackers engaged with a high-value target often change their TTPs within the same kill chain when moving from one device to the next in a target environment, making early detection based on already-known IOCs nearly impossible. IOCs are still quite valuable for detecting known TTPs, just as outmoded signature-based detections are still effective for detecting common malware strains, and they will continue to be an important aspect of our security toolkits for the foreseeable future.

But given the limitations of their application in surfacing highly targeted and novel attacks as described above, the question remains as to how we can detect more reliably and earlier in the kill chain. That’s where Indicators of Behavior (IOBs) come into play.

Defining Indicators of Behaviour
IOBs describe the subtle chains of malicious activity derived from correlating enriched telemetry from across all network assets. Unlike backward-looking IOCs, IOBs offer a proactive means to leverage real-time telemetry to identify attack activity earlier, and they offer more longevity value than IOCs have ever been able to deliver.

IOBs describe the approach that malicious actors take over the course of an attack. They are based on chains of behavior that can reveal an attack at its earliest stages, which is why they are so powerful in detecting novel and highly targeted operations. Sooner or later, an attacker’s path diverges from the paths of benign actors.

But IOBs is not about just looking for anomalies or a key indicator of malice at a particular moment in time, although that’s also part of it. IOBs are about highlighting the attacker’s trajectory and intentions through analysing chains of behaviors that, when examined together, are malicious and stand out from the background of benign behaviors on the network.

IOBs can also be leveraged to detect the earliest signs of an attack in progress that are comprised of “normal activity” one would expect to see occurring on a network, such as we see with techniques like living off the land (LotL/LOLBin) attacks where legitimate tools, processes, and binaries native to the network are abused by the attacker.

Operationalising IOBs for Operation-Centric security
Today’s alert-centric approach to security puts too much focus on the generation of uncorrelated alerts and remediating the individual elements of the larger attack campaign; a process that has proven to be inefficient given the typical resource constraints security operations are subject to.

Conversely, an Operation-Centric approach leveraging IOBs can reorient the detection and response cycle by consolidating otherwise disparate alerts into a single, content-rich correlated detection that serves to comprehensively disrupt the attack progression earlier than is possible with our current reliance on IOCs alone.

Leveraging IOBs to achieve an Operation-Centric approach also presents the opportunity to create a repository of detectable behavior chains that can surface even the most novel of attacks earlier, as well as support automated response playbooks that can better disrupt attacks at their onset.

More work to be done
Understanding attacker intentions and likely pathways based on early-stage actions and activities enable defenders to proactively predict and disrupt subsequent stages of an attack, as well as provides an avenue to develop fully autonomous security operations. In order to achieve a truly Operation-Centric posture and move closer to autonomous security operations, a future-ready standard that universally defines and operationalizes IOBs is required.

To be truly useful, there needs to be a common definition, language, and expression of IOBs that is completely independent of any particular security tool or vendor. The wide array of solutions available can provide the raw telemetry as well as the color and context required to collectively interpret observable behaviours.

But, as it stands today, security tools themselves don’t provide a standardized language that can accurately describe and operationalise the chains of behavior that will enable us to detect and respond to attacks faster than the adversary can adapt. Operationalising IOBs will require standardization that will deliver the full potential value of the entire security stack to quickly and autonomously deliver the necessary context and correlations across diverse telemetry sources.

But achieving an Operation-Centric approach that leverages IOBs will ultimately empower security operations to predictively respond to changing TTPs more swiftly than attackers can modify and adjust them to circumvent defenses, which is key to finally reversing the adversary advantage and returning the high ground to the Defenders.

Expert Speak

How Taking a DevSecOps Approach Makes Security an Accelerator Rather Than an Inhibitor of Innovation



Written by James Harvey, CTO Advisor, EMEA, Cisco AppDynamics

Security teams have traditionally operated separately from the rest of the IT department and the prevailing perception is that security is a reactive function, brought in to resolve security breaches and patch up vulnerabilities. But the Achilles heel of this siloed approach is being dramatically exposed as the attack surface expands, as the speed of application development continues to soar and we see accelerated adoption of dynamic, cloud-native technologies.

In response, IT departments need to take a different approach to application security and move to a DevSecOps approach, where security is integrated into the applications lifecycle from the outset, rather than being an afterthought at the end of the development pipeline. DevSecOps requires new tools and technologies but, most of all, it requires cultural change, with closer collaboration between teams. As such, technologists need to change their mindsets around security and recognize that, with the right approach, security can lead to faster and more sustainable innovation, rather than slowing it down.

Siloed approach exposes application security vulnerabilities
As organisations have ramped up their digital transformation plans, in response to changing customer needs and to enable hybrid work, application release velocity has skyrocketed. Unfortunately, however, application security hasn’t kept pace. In the latest research from Cisco AppDynamics, The shift to a security approach for the full application stack’, all surveyed technologists from the United Arab Emirates (UAE) admitted that the rush to rapidly innovate during the pandemic came at the expense of robust application security.

Much of this can be attributed to fragmented structures and working practices, where ITOps and security teams operate in silos. The only time any form of collaboration occurs is often when a potential issue is identified — which is arguably too late. Developers don’t seek out input from security colleagues because they fear it will slow release velocity. Indeed, the research found that 71% of technologists across the Emirates perceived security to be more of an inhibitor than an enabler of innovation within their organisation.

Until now, IT departments have largely been able to get away with this siloed approach. But as organizations have accelerated release velocity and built more dynamic applications using low-code and no-code platforms, technologists suddenly find themselves trying to manage a dramatic expansion in attack surfaces. Widespread adoption of multi-cloud environments means that application components are increasingly running on a mix of platforms and on-premise databases, and this is exposing visibility gaps and increasing the risk of a security event. The potential consequences are catastrophic for both the customer experience and the bottom line.

Minimize risk and accelerate innovation with a DevSecOps approach
Faced with this growing challenge, IT leaders are recognizing the need for much tighter collaboration between teams and a more proactive approach to application security. DevSecOps brings together ITOps and SecOps teams so that application security and compliance testing are incorporated into every stage of the application lifecycle, from planning to shipping. By taking this approach, developers can embed robust security into every line of code, resulting in more secure applications and easier security management, before, during, and after release.

IT departments can avoid the current situation where security vulnerabilities are only addressed at the last minute before launch or identified after the application has already been released. By incorporating security testing from the outset of the development process, security teams can analyze and assess security risks and priorities, during planning phases, to lay the foundation for smooth development.

DevSecOps relies on the implementation of holistic monitoring systems which leverage Artificial Intelligence (AI) and Machine Learning technologies within application security processes, to cope with the spiraling volumes of security threats organizations are facing. This type of automation is vital to identify weaknesses, predicting future vulnerabilities, and remediating issues. Once IT teams can teach AI tools to identify threats and resolve them independent of an admin, benefits, from reduced human error and increased efficiency to greater agility in development, are sure to follow.

There is now a widespread realization that DevSecOps is the best way for organizations to cope with increasing cybersecurity risk, without sacrificing development speeds. This is validated by the research which found that 82% of UAE-based technologists now regard a DevSecOps approach as critical for their organization to effectively protect against a multi-staged security attack on the full application stack. Not surprisingly, 49% of organizations in the UAE have already started taking a DevSecOps approach and a further 48% are considering making the shift.

Ultimately, DevSecOps will see security become an accelerator for innovation, rather than an inhibitor. By taking a proactive approach to security throughout the lifecycle of their applications, technologists in the region will spend less time trying to identify and resolve issues, and more time on strategic activities based on business needs. And this means that IT teams will be able to ship and deploy applications more quickly.

Continue Reading

Expert Speak

How SMBs Can Prepare for Identity-Based Attacks in 2023



Written by Michael Sentonas, CTO at CrowdStrike

The cybersecurity threat to small- and medium-sized businesses (SMBs) continues to grow as cybercriminals recognize both how vulnerable they can be and the potential value of the data they have. It is critical for SMBs to be aware of the threats they’ll face and how to defend against them. SMB breaches don’t often make headlines, which has led many to believe they fly under attackers’ radars.

In reality, they are among the lowest-hanging fruit for threat actors to exploit — and the data shows cybercriminals are taking advantage: 76% of SMBs surveyed in a 2022 study were affected by at least one cyberattack in 2021, an increase from 55% who said the same in 2020. Sixty-three percent of SMBs surveyed in a separate report say they face increasingly advanced cyberthreats, including ransomware and identity-based attacks (2022 CrowdStrike SMB Survey).

These threats arrive in many forms. The 2022 Verizon DBIR found system intrusion, social engineering and privilege misuse represent 98% of breaches affecting small businesses; further, credentials made up 93% of data compromised in SMB attacks. Over time, more organizations fear they’ll be the next target: a CNBC survey of 2,000+ small business owners found 61% of small businesses with 50+ employees are concerned they’ll be hit with a cyberattack within a year.

Cyberattacks can create significant financial pressure on SMBs, which is a huge concern in a tough macroeconomic climate. A recent survey found that 60% of SMB victims closed their doors within 6 months of an attack. While many SMBs are familiar with malware and may have installed what they perceive as “good enough” security such as basic antivirus software to combat these kinds of attacks, the reality is the threat landscape is much more complex and sophisticated than it used to be. Cybercriminals continue to evolve their strategies at a breakneck pace to bypass traditional security tools, making traditional AV systems increasingly less effective in protecting SMBs.

Many adversaries employ human-engineered methods to break into businesses of all sizes. Throughout 2022, there has been an increase in identity-based attacks and the development of sophisticated file-less techniques bypassing traditional multi-factor authentication defences.

Adversaries are going beyond credential theft, instead using techniques like pass-the-cookie, golden SAML and social engineering with MFA fatigue to compromise identities. According to 2022 CrowdStrike threat data, 71% of breaches forgo malware entirely to evade legacy antivirus software searching for known file- and signature-based malware.

The evolution in adversary techniques shows no sign of slowing in 2023, but with limited budgets and staff, it is imperative SMBs make the most of their resources and time to stay toe-to-toe with even the most advanced adversaries.

A good offence is a great defence. SMBs should think beyond threat detection to focus on threat prevention as well. Many SMBs opt for a managed services approach to augment limited time, resources and expertise. In addition, the following best practices can have a tremendous impact on the strength of your defences:

  • Educate your employees: Your entire workforce should be aware of the types of security threats and social engineering attacks they face at work, such as phishing, smishing, honey trapping and more.
  • Enforce multi-factor authentication (MFA): As identity becomes a critical component to cyberattacks, MFA provides an extra layer of defence so you can be sure it’s an employee and not an attacker, gaining access to systems and resources.
  • Perform regular backups of critical data: If a breach hits your small business, you’ll be glad you backed up your data in the cloud. The cloud provides better accessibility and visibility into data backups, along with faster execution that further minimizes downtime. It’s worth noting an attacker may encrypt backups if they gain access to your systems, so it’s critical to create a strong defence.
  • Keep up with software patches: Data breaches often start when an attacker exploits an unpatched vulnerability. Keeping software up-to-date ensures this vector is blocked. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has an updated list of known exploited security flaws.
  • Lock down your cloud environments: Protect your cloud drives (such as Box or Google Drive) by implementing MFA and adhering to the principle of least privilege, which ensures employees only have access to the resources they need for their jobs.
  • Implement and test your threat detection and response: Make time to analyze your environment and user behaviours for malicious or abnormal activities. Stay current on threat actors, tradecraft and indicators of attack. Define, document and test what a successful incident response looks like. Plan for the “when,” not the “if.

Once you’ve covered the basics, consider intel-driven defence to support detection and response. Understanding threat actors does not need to be complex or time-consuming, as long as the right threat intelligence is available. Attribution enables security teams to understand their true risk posture by defining who could come after them and how and adjust their security strategy based on these facts.

Cybersecurity is a big challenge for SMBs, but it is possible to build a strong security posture and protect your environment from today’s threats — even with limited resources. Rethinking your security strategy and upgrading your defences now can make a tremendous difference in getting through a cyberattack if – or when – disaster strikes.

Continue Reading

Cyber Security

ChatGPT is Being Used for Cyber Attacks



Check Point Research (CPR) is seeing the first instances of cybercriminals using ChatGPT to develop malicious tools. In underground hacking forums, threat actors are creating infostealers, encryption tools and facilitating fraud activity. CPR warns of the fast-growing interest in ChatGPT by cybercriminals and shares three recent cases, with screenshots, of the development and sharing of malicious tools using ChatGPT.

Case 1: Threat actor recreates malware strains for an infostealer
Case 2: Threat actor creates multi-layer encryption tool
Case 3: Threat actor shows how to create a Dark Web marketplace script for trading illegal goods using ChatGPT

CPR is sharing three cases of recent observations to warn the public of the growing interest by cybercriminals in ChatGPT to scale and teach the malicious activity.

Case 1: Creating Infostealer

Figure 1. Cybercriminal showing how he created infostealer using ChatGPT

On December 29, 2022, a thread named “ChatGPT – Benefits of Malware” appeared on a popular underground hacking forum. The publisher of the thread disclosed that he was experimenting with ChatGPT to recreate malware strains and techniques described in research publications and write-ups about common malware.

In actuality, whilst this individual could be a tech-oriented threat actor, these posts seemed to be demonstrating less technically capable cybercriminals how to utilise ChatGPT for malicious purposes, with real examples they can immediately use.

Case 2: Creating a Multi-Layered Encryption Tool

Figure 2. Cybercriminal dubbed USDoD posts multi-layer encryption tool

On December 21, 2022, a threat actor dubbed USDoD posted a Python script, which he emphasized was the ‘first script he ever created’. When another cybercriminal commented that the style of the code resembles openAI code, USDoD confirmed that the OpenAI gave him a “nice [helping] hand to finish the script with a nice scope.”

Figure 3. Confirmation that the multi-layer encryption tool was created using Open AI

This could mean that potential cybercriminals who have little to no development skills at all, could leverage ChatGPT to develop malicious tools and become a fully-fledged cybercriminals with technical capabilities.

All of the aforementioned code can of course be used in a benign fashion. However, this script can easily be modified to encrypt someone’s machine completely without any user interaction. For example, it can potentially turn the code into ransomware if the script and syntax problems are fixed.

Case 3: Facilitating ChatGPT for Fraud Activity

Figure 4. Threat actor using ChatGPT to create DarkWeb Market scripts

A cybercriminal shows how to create a Dark Web marketplace scripts using ChatGPT. The marketplace’s main role in the underground illicit economy is to provide a platform for the automated trade of illegal or stolen goods like stolen accounts or payment cards, malware, or even drugs and ammunition, with all payments in cryptocurrencies.

Figure 5. Multiple threads in the underground forums on how to use ChatGPT for fraud activity

Sergey Shykevich, Threat Intelligence Group Manager at Check Point Software, says, “Cybercriminals are finding ChatGPT attractive. In recent weeks, we’re seeing evidence of hackers starting to use it to write malicious code. ChatGPT has the potential to speed up the process for hackers by giving them a good starting point. Just as ChatGPT can be used for good to assist developers in writing code, it can also be used for malicious purposes. Although the tools that we analyze in this report are pretty basic, it’s only a matter of time until more sophisticated threat actors enhance the way they use AI-based tools. CPR will continue to investigate ChatGPT-related cybercrime in the weeks ahead.”

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.