The Four Types of Threat Detection and Use Cases in Industrial Security
Download as PPTX, PDF1 like1,812 views
The document outlines various threat detection strategies in cybersecurity, emphasizing the importance of comprehensive detection approaches tailored to specific risks and use cases. It categorizes detection methods into four types: configuration-based, modeling-based, indicator-based, and behavior-based, each with distinct benefits and challenges. The authors recommend developing a detection strategy that utilizes multiple methods, supports all use cases, and involves creating detection targets and analytics maps to ensure effective coverage.
The Four Types of Threat Detection and Use Cases in Industrial Security
- 1. DetectionStrategies Understanding and Using the 4Types of ThreatDetection Sergio Caltagirone and Robert M. Lee
- 2. Detection is themost Important thingyoudo. Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. NISTCybersecurityFrameworkv1.1 ASSUMEBREACH MEANS ALL ELSE FAILS. NIST CYBERSECURITY FRAMEWORK IDENTIFY PROTECT DETECTRESPOND RECOVER
- 3. Detection Strategies How &Where Howyoudetectmattersas muchas whereyou detect. Deploying“networkdetection”and“host detection”isnota completedetectionstrategy. Nor doall resourcesrequirethesamedetection! Detection Costs Falsenegativesandfalsepositivesbothleadtolossof control! ASOC inundatedwithlow-qualityalertsis thesame as aSOC lacking alerts. HowandWhere determineyourdetectionquality. Detection is Multi-Use Securityoperationsismorethanrapidresponseand incorporateshunting,investigation,andeachuse caserequiresdifferentdetectionstrategies. A detection strategy matches the appropriate detection approach to risks, resources, and use-case ensuring full detective coverage while minimizingcost.
- 4. A Detection Strategy - How Asset Event Location Use-Case Detection Human-MachineInterface (HMI) NewFiles Host NovelAttack Behavioral OPCServer Enumeration Network SimilarAttack ScanningModels(Anomaly) VPNConcentrator VPN-to-Known-C2 Network Scoping Indicator 01 IdentifyAssets,Events,Location,andUse-CasewithDetectionApproach–Each linebecomesa “DetectionTarget”
- 5. A Detection Strategy Recon Delivery Exploitation Action on Objectives P4 VPN.ID VPN.PWD_REUSE VPN.CONFIG_CHG P3 EW.ID EW.SMB EW.NEW_ACCT P2 HMI.ID HMI.NEW_FILES HMI.CHANGE_VAL P1/0 PLC.ID PLC.CHANGE_VAL * For Some Definition of the Purdue Model and Kill Chain 02 GenerateDetectionMaptoTestandMeasureCoverage–forICS,placeeach detectiontargetonthemap using thePurdueModel &KillChain
- 7. Configuration-Based Detection Configuration-based detection identifies deviations from aknown architecture. Example: Two fielddevices(e.g.,PLCs)communicatingwitheachother,counterarchitectureanddesignexpectations Benefits: • Withperfectvisibilityandcoverage,itcan hypotheticallydetectallmaliciousactivity • Accessible forindividualswithawiderangeofexperience • Easytomaintainin staticenvironments • Addssignificantvaluetootherdetectiontypesin responsesituations Challenges: • Difficulttomaintainindynamicenvironments • Limitedvisibilityandcoveragereduce effectiveness • Assumesa knowledgeofinfrastructureandconfiguration • False-positiveproneduetolikelyconfigurationchanges
- 8. Modeling-Based Detection Modeling-baseddetection uses mathematical models to classify assets andactivity identifying elements inconsistent with the model. Example: AbnormalnumberofWriterequestsinModbusTCPoutsideofnormalgiventhe averageoverthelast30days Benefits: • Canidentifynoveladversaryactivity • Easiertomaintainin verystaticenvironments • Addssignificantvaluetootherdetectiontypesin responsesituations Challenges: • Difficulttomaintainwhenenvironmentschange • Limitedvisibilityandcoveragereducestheeffectiveness • Nocontextofthreatactivitytosupportinvestigations • Assumesanalystshavein-depthknowledgeofinfrastructureandconfiguration • False-positiveprone duetolikelyconfigurationchanges • Potentiallyincorporatesexistingmaliciousactivityintothemodel
- 9. Indicator-Based Detection Indicator-based detection searches for elements of information known about previously andare often seen in the form of Indicators of Compromise (IOCs). Example: A specificIPaddressthatisaccessinganinternalasset Benefits: • Thequickestformofdetectiontocreateand deploy • Containsspecificthreatcontextrelatedtotheindicator • Usefulforenrichingotherdatasourcesandthreatdetections • Highlyeffectiveforscopinganenvironmentpostobservationoftheindicator Challenges: • Thevalueishighlydependentontheadversary’srateofchange • Retroactivein naturegiventheneedtoobservetheindicatorfirst • Doesnotscalewellbetweenvictims • Upperlimitsastohowmanyindicatorscanbe processed • Unknownindicatorexpiryleadstoinaccuratedetection
- 10. Threat Behavior-Based Detection Threat behavior analytics examine activity in environments and compares single actions and aggregate actions against aset of known malicious or suspicious activities. Example: LegitimateVPN accessfollowedbyuseraccount creationandfiledownloadon anengineeringworkstationandfinallyloginfromtheworkstationtoanHMI Benefits: • Excellent durabilityagainstadversarychange • Easytotuneforeachorganizationandenvironment • Lowfalsepositiverates • Immediatetransparencyforanalyststodiagnosethealertagainstexpectedbehavior • Onlyrequiresa fewanalyticstodetectmostknownmaliciousbehaviorusedsomewhere inan intrusion • Integrateswellwithdefensiveplaybooksandautomatedinvestigation/remediation Challenges: • Moderatelydifficulttoimplement • Manyanalyticsrequiredtoprovidecompletecoverage • Onlydetectssimilarthreatbehavioratthelimitofanalyticimagination • Are notfullyreusableacrossallindustries
- 14. Comparing Detection Approaches to Applications
- 15. Detection Strategy Use-Case IT Land SPEARPHISHINGEMAIL KEY LOGGER & RAT ENGINEER CREDENTIALTHEFT
- 16. CONTROLLER CONTROLLER CONTROLLER CONTROLLER Detection Strategy Use-Case VPN ENGINEERING WORKSTATION NEW FILE (S) SCANSSTARTED IT Land SPEARPHISHINGEMAIL KEY LOGGER & RAT ENGINEER CREDENTIALTHEFT
- 17. Detection Strategy Use-Case VPN ENGINEERING WORKSTATION NEW FILE (S) SCANSSTARTED CONTROLLER CONTROLLER CONTROLLER CONTROLLER OPC SERVER OPC SCAN ENUMERATION IT Land SPEARPHISHINGEMAIL KEY LOGGER & RAT ENGINEER CREDENTIALTHEFT
- 18. Detection Strategy Use-Case VPN ENGINEERING WORKSTATION NEW FILE (S) SCANSSTARTED CONTROLLER CONTROLLER CONTROLLER CONTROLLER OPC SERVER OPC SCAN ENUMERATION OPC VALUE OVERWRITE IT Land SPEARPHISHINGEMAIL KEY LOGGER & RAT ENGINEER CREDENTIALTHEFT
- 19. CONTROLLER VALUE OVERWRITE Detection Strategy Use-Case VPN ENGINEERING WORKSTATION NEW FILE (S) SCANSSTARTED CONTROLLER CONTROLLER CONTROLLER CONTROLLER OPC SERVER OPC SCAN ENUMERATION OPC VALUE OVERWRITE IT Land SPEARPHISHINGEMAIL KEY LOGGER & RAT ENGINEER CREDENTIALTHEFT
- 20. Detection Strategy with the 4 Types of Detection Develop a detection strategy! • Utilizeall detection methods • Support all youruse cases • Detection is multi-use • Consider How, Why, Where How do yougeneratea detection strategy? 1. Develop “detection targets” 2. Createyour analytics map 3. Implement using costs & benefits ofeach type 4. Test &measure coverage