Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Tuesday, 31 January, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

By the time you’ve been compromised, it’s already too late

Analysing the IoC and IoA incident response techniques in cybersecurity

by The Gurus
November 8, 2019
in Featured
Incident Response
Share on FacebookShare on Twitter

By Zeki Turedi, Technology Strategist, EMEA at CrowdStrike

Organisations attempting to protect their data currently face an unprecedented threat level. The World Economic Forum’s Global Risks Report 2019 ranked data theft and cyber attack as two of the top five global risks in terms of likelihood. Even the largest and best-equipped of international organisations have shown they’re susceptible to attack from persistent, skilled adversaries. 

Much like insuring your home against flooding (more information here), you need to protect your digital data.

The tough reality for many organisations is that by the time they have been compromised, it’s already too late. To detect these threats, cybersecurity teams have traditionally relied on Indicators of Compromise (IoCs) which work by detecting signatures, exploits, vulnerabilities and IP addresses to help determine whether a security incident has occurred. This has meant that rather than preventing a breach, security teams have remained focussed on investigating what has already happened. However, in recent years, next-generation security solutions have emerged, allowing security teams to go beyond this to really understand the intent of what an attacker is trying to accomplish – and hence, how better to thwart this.

What are Indicators of Attack (IoAs)?

IoAs allow security teams to develop a more proactive approach to investigations by helping them quickly identify and understand common actions that an adversary must conduct to succeed. These include code execution, persistence, stealth activity, command control, and lateral movement within a network. The key advantage of IoAs is that they allow security teams to stop adversaries in their tracks before they’re able to compromise an organisation’s defences, if they are spotted and acted on. 

For example, a spearfishing campaign, which is designed to probe a system’s defences, could act as a precursor to a cyber attack. This typically kicks off with an email which seeks to persuade a target to open a file that will infect their machine. Once compromised, the attacker will silently execute another process, hide in memory or on disk, and maintain persistence across reboots of the system. Security teams proactively monitoring for IoAs will be able to detect the execution of any of these steps and identify an adversary through inferring what these actions are trying to achieve. This means that security teams are more likely to discover bad actors before they’re able to compromise a network.

A real-world analogy

Let’s put things into context. In many ways, a data breach could be compared to a bank robbery. The attacker needs to overcome the defender’s security systems and successfully exfiltrate their objective – whether that be sensitive data or bars of gold. When a bank is robbed, authorities typically arrive after the crime has taken place and can begin collecting evidence. They may find evidence on the security cameras; the thief drove a red convertible, wore a baseball cap and used liquid nitrogen to break into the vault.

These points of evidence are only discovered after the fact, much like IoCs – they show that there was an attack, but the money is already gone. This same evidence could be used to eventually find the thief but only if they don’t change their methods. If the next time the perpetrator uses a blue hatchback, wears a bucket hat, and uses a drill to break into the vault, they might be successful for a second time. This is because the security team won’t be prepared to look for these new points of evidence. 

However, if the bank was set up to monitor for IoAs, they might be able to prevent a robbery entirely. Just as a data breach is frequently preceded by a phishing attack, a bank robber might ‘case’ the bank before the heist. Like a phishing campaign, this process involves steps that a proactive security team could detect. If the thief attempts to disable the system, move towards the vault or attempts to crack it, the security team can infer they are trying to rob them. Using this information they can then stop the attempt before the perpetrator is able to steal anything at all. 

IoAs in practice

During a cyber attack, these points of evidence may be less obvious than in a bank, but the same principles apply. If a security team can spot IoCs such as an MD5 hash, a C2 domain or a hard-coded IP address, they might be able to use these indicators to prevent future attacks. However, given that IoCs aren’t a constant variable, security teams could be left on the back foot as they struggle to keep up with the evolving threat landscape. 

On the other hand, IoAs allow security teams to monitor for suspicious behaviours, helping them to quickly adapt and take action to prevent a breach. By focusing on the tactics, techniques and procedures of attackers, security teams can determine who the adversary is, what they are trying to access and why, while providing a proactive approach to confronting advanced threats.

FacebookTweetLinkedIn
Share3TweetShare
Previous Post

Technical challenge or business enabler? Seizing the opportunity of PCI DSS compliance

Next Post

26 million stolen cards rescued from “BriansClub” hack

Recent News

JD Sports admits data breach

JD Sports admits data breach

January 30, 2023
Acronis seals cyber protection partnership with Fulham FC

Acronis seals cyber protection partnership with Fulham FC

January 30, 2023
Data Privacy Day: Securing your data with a password manager

Data Privacy Day: Securing your data with a password manager

January 27, 2023
#MIWIC2022: Carole Embling, Metro Bank

#MIWIC2022: Carole Embling, Metro Bank

January 26, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information