Narrow Indicators Of Compromise Just Are Not Enough For Comprehensive Endpoint Monitoring – Charles Leaver

Presented By Charles Leaver And Written By Dr Al Hartmann Of Ziften Inc.

 

The Breadth Of The Indication – Broad Versus Narrow

A detailed report of a cyber attack will generally offer details of indicators of compromise. Frequently these are slim in their scope, referencing a particular attack group as viewed in a specific attack on an enterprise for a minimal period of time. Normally these slim indicators are particular artifacts of an observed attack that could constitute particular evidence of compromise by themselves. For the particular attack it suggests that they have high uniqueness, however typically at the expense of low level of sensitivity to comparable attacks with various artifacts.

Essentially, narrow indicators offer really minimal scope, and it is the reason that they exist by the billions in huge databases that are constantly broadening of malware signatures, network addresses that are suspicious, destructive pc registry keys, file and packet content snippets, file paths and intrusion detection guidelines etc. The continuous endpoint monitoring solution supplied by Ziften aggregates a few of these third party databases and risk feeds into the Ziften Knowledge Cloud, to take advantage of understood artifact detection. These detection elements can be used in real time in addition to retrospectively. Retrospective application is important with the short term characteristics of these artifacts as hackers continuously render conceal the information about their cyber attacks to annoy this slim IoC detection approach. This is the reason that a constant monitoring service needs to archive tracking results for a long time (in relation to industry reported common hacker dwell times), to supply an adequate lookback horizon.

Narrow IoC’s have substantial detection value but they are mostly inadequate in the detection of new cyber attacks by skilled hackers. New attack code can be pre evaluated against common enterprise security solutions in laboratory environments to verify non-reuse of artifacts that are noticeable. Security solutions that operate simply as black/white classifiers suffer from this weakness, i.e. by providing an explicit decision of destructive or benign. This approach is very easily evaded. The defended company is likely to be thoroughly attacked for months or years before any noticeable artifacts can be determined (after extensive examination) for the particular attack instance.

In contrast to the ease with which cyber attack artifacts can be obscured by typical hacker toolkits, the characteristic methods and strategies – the modus operandi – utilized by hackers have been sustained over numerous years. Typical techniques such as weaponized websites and docs, brand-new service installation, vulnerability exploitation, module injection, sensitive folder and pc registry area modification, brand-new arranged tasks, memory and drive corruption, credentials compromise, malicious scripting and lots of others are broadly common. The right use of system logging and monitoring can find a lot of this characteristic attack activity, when appropriately combined with security analytics to concentrate on the highest risk observations. This entirely eliminates the chance for hackers to pre test the evasiveness of their harmful code, since the quantification of dangers is not black and white, however nuanced shades of gray. In particular, all endpoint risk is differing and relative, across any network/ user environment and time period, and that environment (and its temporal characteristics) can not be duplicated in any lab environment. The fundamental hacker concealment method is foiled.

In future posts we will analyze Ziften endpoint threat analysis in greater detail, as well as the crucial relationship between endpoint security and endpoint management. “You can’t protect what you don’t manage, you can’t manage what you do not measure, you can’t measure what you do not track.” Organizations get breached because they have less oversight and control of their endpoint environment than the cyber assailants have. Watch out for future posts…

Leave a Reply

Your email address will not be published. Required fields are marked *