Hello and welcome to the
application of the modern tech
framework discussion.
Today, we're going to be looking at
a case study for the persistence
phase of the framework.
So let's go ahead and jump right in.
So the topic of the case study is
really dwell time and threat
removal. So when we talk about
persistence, we're talking about
a threat actor trying to cement
themselves into the network or
into a system.
And so dwell time is huge
here because the average for that
is well over
six plus months of time.
I think I've seen numbers as high as
three hundred days and some change.
And so dwell time is something that
we want to take seriously.
And then in order to get
that done on time to go away to
remove the threat factor, of course,
there's threat removal.
So let's look at some numbers.
Statistics and things of that nature
are always good.
So the average containment
time in twenty seventeen was
five days.
So the time it took to contain
a bad guy, the bad
guy was five days.
And this containment time was
applicable only
after detection, which
on average was sixty six
days, so it took us
sixty six days to find
the threat actor to detect the
activity that was malicious in
nature.
And then it took another five days
to get that done.
Now, average time it takes
for hackers to get in four
hours and thirty seven
minutes. Depending on the nation
state, it could be much faster.
I think Russia is like some
15 minutes or something like that.
So remember, depending on the
capabilities and tools at the
threat, actors disposal will
determine that. But on average, if
you average out everything, it's
four hours and some change.
A realistic minimum goal is to
stop a breach within
eight to 12 hours.
Organization such as Crowd Strike
Advocate, a full investigation
within ten minutes and complete
removal of the threat actor in 60
Minutes.
But I believe in some of these cases
it is specific to their tool sets.
Now, for those of us that are maybe
not using vendor specific
tools, eight to 12
hours is not a bad
goal for us to try and detect
something. And then from that point,
eight to 12 hours, get it out
of the network.
But that means that there are a
number of things that we
have to consider in this process.
And so what should we be looking
at? What should we be considering?
Well, first off, what capabilities
would an organization need to
implement to at least meet
the minimum eight to 12 hour
cyber response plan, Tom?
OK, so that's something that you
want to do, thinking about your
organization.
If you were compromised today and
you detected it now,
would you have the capability to
know what system that happened on,
know what this reactor was doing,
know what they had touched and
remove that threat
in that eight to 12 hour time?
Now, once the plan is written for
the minimum time, how does an
organization then move either in
increments or all?
It wants to get a 60
minute removal time like ground
strike is talking about?
Right. So the first
thing we're doing here, how do we
get to the minimum?
How do we meet that low bar?
All right. And from there,
how do we get to to what this
organization is indicating is peak
performance, 60 Minutes removal
time? It sounds like there's some
tools and, you know, for
pay services there that we have to
take advantage of to get that done.
Now, do either of these metrics have
feasibility based on your
organization's cost benefit
analysis?
Again, if you're a flower shop,
OK, you're eight to 12 hour
response plan time,
maybe wiping and reloading a system.
But does that wiping
in reloading of the system, meaning
that you're down for a day?
And does that downtime,
you know, really replace
the cost or is the cost
higher than the downtime?
And so really, you
have to do some cost benefit
analysis and understand if
meeting these goals is
worth more than the
squeeze. Is the juice not worth the
squeeze as far as feasibility
of these things? Is 60 Minutes
really where you need to be as
an organization, or can you live
with 12 hours to
get a threat actor out?
Really, we want to try to get a
theater actor out ASAP,
but then that's going to cost
us revenue that we'll have
to put into tools that will have to
put into research that we had to put
into training or a partnership
that cost money to get this response
time met.
Now, imagine that you are a threat
actor looking to steal high value
information from the organization
you work for.
What would you look to steal?
And based on the mechanisms
discussed up to this point, are any
of them feasible?
As far as being able to get to that
data, so, you know,
anything that we've discussed, like
hooking or
account creation, stealing the
service as far as like creating
a new service and doing things of
that nature.
What kind of threat actor do what
could you imagine that they could do
to take advantage of your systems
and so take all of these things
into account and into consideration
and try to come up with a response
plan and what you would be
able to do as an organization
to reduce dwell
time and overall remove
the threat from your network.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.