In addition to this, tools need to keep their false positive rate low to be useful, so may disregard real threats in favour of minimizing their FP rate – whereas experienced humans can quickly assess whether suspicious activity is worthy of raising an alert and further investigation.
Although tools can make life difficult for an attacker and can provide preventive value, as of 2016, the most advanced detection and prevention tools in the world are by themselves no match for an intelligent human with the right capabilities and resources at their fingertips.
Therefore the only effective way to detect and respond to attacks is by having the right people, with the right mindset.
But again, we should assume our protections aren’t bullet-proof. What if, somehow, an attacker obtains ‘legitimate’ access? If mail or remote access credentials are obtained, no amount of AV or IDS will detect attacker activity; they are now using the system for what it was designed to do. There is no anomaly in the network traffic or malware on the system.
In an advanced attack, the primary goal for the attacker is often to obtain such legitimate access in order to stay under the radar. When we are faced with detecting this attacker, we must examine logs to monitor for suspicious activity. Much like heuristic detection, we are looking for deviations from the norm. If one of our UK users logs in to the VPN at 3am from another country, it’s not a confirmed attack but it is worthy of further investigation.
This approach to detection can be enhanced when multiple log sources are combined. What if the same user has logged into the VPN from the UK during business hours? That event alone is expected behavior and not worthy of alert. If, however, we are also examining our port authentication logs and can see the same user’s laptop is physically plugged in to the network connection on their desk, the VPN access is now potentially a suspicious event.
Or it may not be! It depends on how your business operates. However, by exploring and simulating attack scenarios, we can verify and extend our existing visibility and practise our response such that if an attack should happen, we can have increased confidence it will be caught and dealt with.
Categories