Intelligence-Driven Incident Response by Scott J Roberts

Author:Scott J Roberts
Language: eng
Format: epub
Publisher: O'Reilly Media
Published: 2017-09-07T04:00:00+00:00

What to Exploit?

When F3EAD is not properly implemented or is not carried out completely, you likely will find yourself dealing with the same intrusions or types of incidents not too far down the road. In the Find, Fix, and Finish stages of the cycle, we focused on a specific attack, a specific adversary, and the specific actions needed to deal with that particular incident. By the end of the Finish phase of the GLASS WIZARD intrusion, we had identified a large amount of information around the intrusion, the actors behind it, and how they operated. But even though that information is organized in a way that facilitated incident response, that doesn’t necessarily mean it is in the right format for follow-up intelligence analysis.

In the Exploit phase, we begin the process that ensures that we learn from the incident. We focus on the threat, and not just the enemy. Because of this, it is important that we not only extract technical indicators related to the particular attack, such as malware samples and command-and-control IP addresses, but also the overarching aspects that led to the intrusion and allowed the attackers to be, at least to some degree, successful. This includes information about the vulnerabilities or weaknesses that were targeted in the attack and the information or systems that were targeted. We are not just trying to protect the network from a replay of the exact same attack, but to understand the various factors such as policies, technical vulnerabilities, or visibility gaps that led to the successful intrusion and to develop protections or detections for them as well. Because of this, we believe that there is very little information that should not be exploited and analyzed—but this, of course, makes managing that information complex.

After deciding what information will be exploited, it is necessary to extract that information from incident data, standardize it, and store it for future analysis and reference.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.