Active defense: Sweep the leg!

Tired of waiting around for that Friday afternoon phone call every week? Yeah, you know the one. The one that says your organization may still be struggling to shift to a proactive defense posture. The one that indicates your hunt team may also be struggling to prioritize and focus on meaningful hunt missions.

But what more could you do to better prepare? To begin, let’s consider how the enemy operates.

In a way, threat actors are like stools. They need three durable legs — two if they’re good enough — to support their weight and prop up operations. We call these legs the three Cs (C3) of active defense posturing: capability, connections, and credentials. As defenders, we look to kick out as many legs as possible to help minimize the likelihood of threat actors achieving their objectives. Or to stick with the analogy, from taking a seat in your network.

<<< Start >>>

Copyright © 2020 Accenture. All rights reserved.

<<< End >>>

1. Capability: A threat actor’s ability to pull off an attack and cause harm or damage to your organization. A capability is often described as an assessed (i.e., subjective) level of sophistication associated with a particular threat actor.
2. Connections: Remote network connections to/from the threat actor’s target can take many forms: TCP/UDP, encrypted/plain-text, various ports and protocols, APIs, vendor connectivity, data highways, etc.
3. Credentials: Credentials and keys for accessing systems and objects, or data, across a target network include various privilege levels and both domain and non-domain credentials: administrator (domain, local, system), service accounts, user accounts, SSH keys, badges for physical access to sites.

The C3 approach also considers a cyber threat intelligence (CTI) framework, which lets us evaluate an adversary’s capability, opportunity, and hostile intent in order to prioritize a defense strategy that aligns with your organization’s risk. In this blog, we’re assuming we’ve already determined opportunity and hostile intent so we can focus on established or impending threats.

Prioritizing for better results

• In theory, C3 is a relatively simple concept. In practice, it can be quite difficult to execute if you lack positive control of your environment. So, how do you prioritize C3 at a tactical level? By understanding your organization’s ability to address the fundamentals:
• Reduce vulnerabilities, End-of-Life (EOL) systems, and legacy or non-essential items from the network. If you reduce the attack surface, you can deny the threat actor opportunities to thrive while also facilitating technical control deployment and/or management, as well as monitoring, detection, and response.
• Use tools, configurations, and process to help control and limit the success and pervasiveness of threat actor actions.
• Log and analyze everything you cannot eliminate or control. Model your day-to-day baseline and make the threat actor “stand out.”
• Hunt only what you cannot eliminate, control, or model. Start your hunt hypotheses by applying the 3Cs.

Addressing the 3Cs

With the 3Cs prioritized, let’s explore some practical examples from the Cyber Investigation and Forensics Response (CIFR) team’s incident response and threat hunting engagements to illustrate ways to leverage the C3 approach. For example, by throttling control deployment and active defense to “kick out the legs,” we’ve been able to help our clients rapidly take back and/or maintain positive control of their environments.

C1 capability

Threat actors need capability to present a risk to your organization, but because their capability typically falls outside of a defender’s control, it’s critical to work with CTI teams to gain situational awareness and an understanding of potential risks.

1. Based on the evidence available, work with your CTI team on the iterative process of analyzing threat actor behavior, TTPs employed, and tactical indicators.
2. Leverage CTI to develop detections using, for example, YARA rules or hunting queries across available datasets, as well as indicators of compromise (IOCs), which will be more useful during tactical response.

C2 credentials

Remove the opportunity for threat actors to leverage credentials and you’ll make it exceedingly difficult for them to access and/or move laterally across even a moderately defended network.

C3 connections

Take away network connections and remove the human operator from the equation to force threat actors to rely on autonomous tooling and operations to achieve their objectives — a difficult task in any network.

Now that you have a better understanding of the 3Cs and are armed with some real-world examples, try applying these to your own defense capabilities to maintain or take back positive control of your environment. Happy hunting!

If you have an incident or need additional information on ways to detect and respond to cyberthreats, contact a member of our CIFR team 24/7/365 by phone 888-RISK-411 or email CIFR.hotline@accenture.com.

Accenture Security

Accenture Security helps organizations build resilience from the inside out, so they can confidently focus on innovation and growth. Leveraging its global network of cybersecurity labs, deep industry understanding across client value chains and services that span the security lifecycle, Accenture help organizations protect their valuable assets, end-to-end. With services that include strategy and risk management, cyber defense, digital identity, application security and managed security, Accenture enables businesses around the world to defend against known sophisticated threats, and the unknown. Follow us @AccentureSecure on Twitter or visit us at www.accenture.com/security.

Accenture, the Accenture logo, and other trademarks, service marks, and designs are registered or unregistered trademarks of Accenture and its subsidiaries in the United States and in foreign countries. All trademarks are properties of their respective owners. All materials are intended for the original recipient only. The reproduction and distribution of this material is forbidden without express written permission from Accenture. The opinions, statements, and assessments in this report are solely those of the individual author(s) and do not constitute legal advice, nor do they necessarily reflect the views of Accenture, its subsidiaries, or affiliates. Given the inherent nature of threat intelligence, the content contained in this report is based on information gathered and understood at the time of its creation. It is subject to change. Accenture provides the information on an “as-is” basis without representation or warranty and accepts no liability for any action or failure to act taken in response to the information contained or referenced in this report.

This document makes descriptive reference to trademarks that may be owned by others. The use of such trademarks herein is not an assertion of ownership of such trademarks by Accenture and is not intended to represent or imply the existence of an association between Accenture and the lawful owners of such trademark.

Copyright © 2020 Accenture. All rights reserved.

___

[i] Custom content developed by CIFR.
[ii] Custom content developed by CIFR.