This is module for lesson
four, make defensive
recommendations.
If you have three objectives in
this lesson, you're
going to get into some of the
different types of defensive
recommendations.
Talk a little bit about how to
prioritize recommendations.
And we're going to have you go
through an exercise where you're
actually making defensive
recommendations.
So we're now in step five, we're
in the homestretch of
actually making defensive
recommendations,
so it's important to consider
through all of this that
you don't just think about
technical, think about new sensors,
that recommendations can be
strategic, they can be policy
related, operational,
tactical, or even
making a decision to accept
risk.
Who the recommendations are for
is going to vary based on your
organization, so it's very important
to think about who
is your audience for your
recommendations?
Is it management?
Is your security operations center?
Is it information technology?
Or are you the Cyber
Threat Intelligence Shop and you're
making recommendations to all of the
above.
So we've gone through a bunch
of different defensive options
where you're getting them from
ways to to take a look at them,
look at some of the pros and cons.
And so some of the potential
recommendation types that are coming
out of this and, you know, may come
from your own research.
So the sort of obvious is the
technical.
This could be collecting new data
source, radar detection
or an analytic from existing data,
change your config or make an
engineering change or
potentially implement a new tool.
And we've talked about a little bit
of some specific ways
of doing each one of those
over the course of this module.
But there are options definitely
beyond the technical.
So there are things like policy
changes.
Some of the examples we've gone
through in terms of requiring more
training are more
of a policy change, or it could
be policy change on terms of
what's allowed in a given
organization.
There's always the possibility that
the correct answer is accept
risk.
So we've determined that a
technique is a priority for us.
We've looked at the pros
and cons. We've looked at our
options.
We've weighed them.
And our final answer may be
that it is either
undetectable, unmitigated evil,
or it's not worth the tradeoff
that all of the options we have
on the table are beyond
what we're willing to accept and
that we we've decided to accept
the risk of that technique
happening.
So to give some specific examples,
so we've talked about user
execution throughout this, so
maybe where we come down to
a policy recommendation,
so we'll tackle them via
user training, we've we've got this
highly technical workforce.
We'll work with them.
We'll help make them into better
sensors against malicious
emails.
But so there are other types of
techniques in attack or
that may come up in your
prioritization.
So, for example, if if we're
working from Supply-Chain compromise
and process component
firmware, these can
be really hard techniques
of really expensive techniques
to potentially mitigate, detect,
and maybe we have stuff
that is a priority to us.
But after we take a look, it's
beyond our capability or beyond
our resources to stop
or detect. And so we have to
accept the risk that, you
know, we're going to move on with
our lives.
And it it might happen.
So we've given this example
we've gone through and
taken a look at user
execution so we
can now take what we've weighed is
are pros and cons, what we've come
up with of how
it works with our given
organization.
And so these are some of the
defensive recommendations we might
make from what we've
worked through the rest of the
module.
So everything we said around
having a technical workforce
is that one
new user training geared around, not
clicking on attachments and how to
identify social engineering.
There are some downsides in terms of
training fatigue, but it
looks like this may be very well
matched with our organization,
our continued use of antivirus.
Why not?
We already have it.
It's already there, no additional
resource requirements.
And so there's no reason to stop
using antivirus.
And lastly, so we've got this
email detonation appliance.
Maybe we try to make sure that our
email is taking an unencrypted
path past it so that we
can make use of our existing tools.
These example recommendations
coming out of the pros and
cons we've worked through and the
options we've worked through up
to this point.
So now it's your turn
in the resources tab
on your exercise, for there should
be a text file called
Making Defensive Recommendations,
Guided Exercise,
download this worksheet and
it will walk you through the
same recommendation process we've
just done with some
guidance. So instead of asking you
to fill in your own
organization, it's
going to give you some different
decision points and suggests some
particular places to look
rather than just having sort
of full open scope.
So you're going to be working
through this process of
determining priority techniques,
researching how the techniques are
being used, research defensive
options related to those techniques,
research organizational capabilities
and constraints determine
what trade offs are for your
national organization on specific
options and then make
recommendations based on
what you've gathered in that
process.
So please post the video now.
And we are just giving yourself 15
minutes for this exercise and
when you come back and unpause, will
go over the exercise.
OK, so as you went through
this exercise,
what resources did you end up using?
So we gave some particular
suggestions, but were there
others that you decided to pull
in, other things that you found
useful?
What kinds of recommendations did
you end up making?
Were they technical?
Were they policy?
Were they risk acceptance?
And did you consider doing nothing
and just accepting the risk?
Were there any options that came up
as you gathered options
here that looked like they would
be completely inappropriate for
you?
So to start with step
zero, determine priority techniques,
we gave you scheduled task
job as the priority technique.
So coming from the same list
that we're working with from our
threat reporting.
Step one, how is
that technique being used
in the reporting we gave you?
So let's take a look at the
core Kitty report.
So we're seeing it being used
coming from a Spearfish.
We're seeing being used from a
word macro.
And so it's being run on the command
line in both cases.
Had you take a look at data sources,
so take a look at some of the
defensive options related to
the technique or some technique,
so you should have come up with data
sources, file monitoring process,
command line parameters, process
monitoring when windows event logs.
I said, you take a look at
detection, so this
gives you a couple different options
of things you might be able to do,
taking a look at
scheduled tasks being run.
We gave you some of the
organizational capabilities and
constraints just so
that you aren't having to take
this from your own organization,
give you something notional to work
with. So for this exercise we
had you assume that you have a
Windows event log collection going
to Assim, but no ability
to collect processed execution
logging, which will narrow your
ability a little bit.
So given where we had
to go through and take a look,
these are some of the specific
trade offs you might have come up
with for your enterprise.
So monitor schedule task creation
from common utilities is in command
line invocation.
Pros might have been would
allow us to collect detailed
information on how the test is
added. It would give us some great
visibility, but
we said the organization has no
ability to collect process
execution. Logging is probably
off the table.
Configure event logging for
scheduled task creation and changes
fits well into our Windows event.
Log collection will get it up to our
Aasim.
Probably be the easiest to implement
enterprise wide.
This will increase collected log
volumes.
There are other tools that are
suggested along the course, the way
that it may be able to use assist
internals, auto runs, we'll
see these scheduled tasks being
used.
Some of the pros this would love to
see other persistence techniques
as well. So other ways
that things are being added to the
system to run at bood
auto runs free,
but it free is not necessarily
free. It's not currently installed.
It would need to be pushed out to
all systems and we need to build up
the data collection in analytics
around it for it to actually be
useful.
Another defense option that came
up was to monitor processing
command line arguments
again, this would allow us to
collect detailed information,
but we gave as a
constraint that the organization has
no ability to collect this
information.
So we've guided your paths and your
steps a little bit where we
think you might have come up with
a couple of different options that
look like this, but your
answers may differ depending on how
you actually are reading and
processing the information that
you're going through.
So we think you might have come up
with an option of
enabling Microsoft Windows Test
scheduler operational
setting within the event, logging
service and creating analytics
around event ID 106,
an event ID 140.
So these are things that come from
the defensive options and the
detection options that are within
the technique and some technique.
Another option might have come up
with is to use Waterfront's to
watch for changes that
could be attempts at protests.
Maybe you decided that the
additional logging infrastructure
and pulling it together would be
worth it based on the constraints
that we gave.
So in this final lesson,
we've examined the different types
of defensive recommendations,
you've looked at how to prioritize
recommendations when you might need
to accept risk, and we've given
you some practice making customized
defensive recommendations and
considering the elements
contributing to your individual
approach.
This is now the end
of our attack for cyber threat
intelligence journey
now worked through five different
modules, getting into different
aspects of first
understanding how attack is useful
for cyber threat intelligence, how
to map narrative and raw data to
attack, how to work with that
intelligence, and then how to do
something with that intelligence.
And this is the end of module four.
And thank you for joining us for
this training.