By Zeki Turedi, Technology Strategist, EMEA at CrowdStrike
Organisations attempting to protect their data currently face an unprecedented threat level. The World Economic Forum’s Global Risks Report 2019 ranked data theft and cyber attack as two of the top five global risks in terms of likelihood. Even the largest and best-equipped of international organisations have shown they’re susceptible to attack from persistent, skilled adversaries.
Much like insuring your home against flooding (more information here), you need to protect your digital data.
The tough reality for many organisations is that by the time they have been compromised, it’s already too late. To detect these threats, cybersecurity teams have traditionally relied on Indicators of Compromise (IoCs) which work by detecting signatures, exploits, vulnerabilities and IP addresses to help determine whether a security incident has occurred. This has meant that rather than preventing a breach, security teams have remained focussed on investigating what has already happened. However, in recent years, next-generation security solutions have emerged, allowing security teams to go beyond this to really understand the intent of what an attacker is trying to accomplish – and hence, how better to thwart this.
What are Indicators of Attack (IoAs)?
IoAs allow security teams to develop a more proactive approach to investigations by helping them quickly identify and understand common actions that an adversary must conduct to succeed. These include code execution, persistence, stealth activity, command control, and lateral movement within a network. The key advantage of IoAs is that they allow security teams to stop adversaries in their tracks before they’re able to compromise an organisation’s defences, if they are spotted and acted on.
For example, a spearfishing campaign, which is designed to probe a system’s defences, could act as a precursor to a cyber attack. This typically kicks off with an email which seeks to persuade a target to open a file that will infect their machine. Once compromised, the attacker will silently execute another process, hide in memory or on disk, and maintain persistence across reboots of the system. Security teams proactively monitoring for IoAs will be able to detect the execution of any of these steps and identify an adversary through inferring what these actions are trying to achieve. This means that security teams are more likely to discover bad actors before they’re able to compromise a network.
A real-world analogy
Let’s put things into context. In many ways, a data breach could be compared to a bank robbery. The attacker needs to overcome the defender’s security systems and successfully exfiltrate their objective – whether that be sensitive data or bars of gold. When a bank is robbed, authorities typically arrive after the crime has taken place and can begin collecting evidence. They may find evidence on the security cameras; the thief drove a red convertible, wore a baseball cap and used liquid nitrogen to break into the vault.
These points of evidence are only discovered after the fact, much like IoCs – they show that there was an attack, but the money is already gone. This same evidence could be used to eventually find the thief but only if they don’t change their methods. If the next time the perpetrator uses a blue hatchback, wears a bucket hat, and uses a drill to break into the vault, they might be successful for a second time. This is because the security team won’t be prepared to look for these new points of evidence.
However, if the bank was set up to monitor for IoAs, they might be able to prevent a robbery entirely. Just as a data breach is frequently preceded by a phishing attack, a bank robber might ‘case’ the bank before the heist. Like a phishing campaign, this process involves steps that a proactive security team could detect. If the thief attempts to disable the system, move towards the vault or attempts to crack it, the security team can infer they are trying to rob them. Using this information they can then stop the attempt before the perpetrator is able to steal anything at all.
IoAs in practice
During a cyber attack, these points of evidence may be less obvious than in a bank, but the same principles apply. If a security team can spot IoCs such as an MD5 hash, a C2 domain or a hard-coded IP address, they might be able to use these indicators to prevent future attacks. However, given that IoCs aren’t a constant variable, security teams could be left on the back foot as they struggle to keep up with the evolving threat landscape.
On the other hand, IoAs allow security teams to monitor for suspicious behaviours, helping them to quickly adapt and take action to prevent a breach. By focusing on the tactics, techniques and procedures of attackers, security teams can determine who the adversary is, what they are trying to access and why, while providing a proactive approach to confronting advanced threats.
