Security operations centers (SOC)

Risk Responses
Risk management principles

The response of reducing risk to fit within an organization's willingness to accept risk.

By implementing effective mitigating controls, we can reduce the overall risk. We implement mitigating controls until risk levels are reduced to a level deemed "acceptable" by risk managers and governance teams.

In risk mitigation, the response of moving or sharing the responsibility of risk to another entity, such as by purchasing cybersecurity insurance.

Risk transference (or sharing) means assigning risk to a third party, which is most typically accomplished through insurance policies

Risk Management Exceptions

The process of identifying and assessing the possible threat actors and attack vectors that pose a risk to the security of an app, network, or other system.

Threat modeling is designed to identify the principal risks and tactics, techniques and procedures (TTPs) that a system may be subject to by evaluating the system both from an attacker's point of view and from the defender's point of view.

§  The control is implemented as a system (hardware, software, or firmware). For example, firewalls, antivirus software, and OS access control models are technical controls. Technical controls may also be described as logical controls.

A type of security control that acts before an incident to eliminate or reduce the likelihood that an attack can succeed.

§  A preventative control operates before an attack can take place. Access control lists (ACL) configured on firewalls and file system objects are preventative-type controls. Antimalware software also acts as a preventative control, by blocking processes identified as malicious from executing. Directives and standard operating procedures (SOPs) can be thought of as administrative versions of preventative controls.

A type of security control that acts during an incident to identify or record that it is happening.

§  The control may not prevent or deter access, but it will identify and record any attempted or successful intrusion. A detective control operates during the progress of an attack. Logs provide one of the best examples of detective-type controls.

A type of security control that acts after an incident to eliminate or minimize its impact

The control acts to eliminate or reduce the impact of an intrusion event. A corrective control is used after an attack. A good example is a backup system that can restore data that was damaged during an intrusion. Another example is a patch management system that acts to eliminate the vulnerability exploited during the attack.

A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.

The control serves as a substitute for a principal control, as recommended by a security standard, and affords the same (or better) level of protection but uses a different methodology or technology.

A type of security control that serves to direct corrective actions after an incident has been confirmed.

 In a Security Operations Center (SOC), responsive controls might include several very well-defined actions to be taken by an analyst after identifying a specific issue. These actions are often documented in a playbook.

Prioritization & Escalation

The points at which a network or application receive external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.

Each piece of software, service, and every enabled protocol on an endpoint offers a unique opportunity for attack. Removing or disabling as many of these as possible can significantly reduce the number of (potentially) exploitable pathways into a system. Additionally, default configurations typically favor functionality and compatibility over security, so it is essential to understand how to customize a system to allow for the most secure type of operation, not necessarily the most convenient.

Passive discovery can be a practical approach to managing the attack surface. Passive discovery describes the methods used to identify systems, services, and protocols indirectly. Passive discovery, such as network packet capture, can reveal information about network-connected hosts, communications channels, protocols in use, and activity patterns. Passive discovery is beneficial as it leverages careful observation to show characteristics of network-connected software and devices.

Edge discovery 

(Attack Surface)

For these reasons, a testing plan must be in place and designed to validate controls are functioning as intended. For example, validating that firewalls only allow the right traffic to pass, that endpoint protection is operating properly on employee workstations, and that web application firewalls correctly identify and block injection attacks to name just a few.

involves offering rewards for responsible disclosure of vulnerabilities

Bug bounties allow organizations to define areas of their environment they would like help protecting. The bug bounty identifies elements of the environment that are in scope for testing and the rewards available for reporting issues. This approach incentivizes offensive security professionals to assess controls on an ongoing basis and can also help identify unknown and undocumented vulnerabilities.

§  Conducting an inventory of all hardware and software assets and user accounts in the environment. Once identified, the team must determine which assets are essential for business operations and which can be removed.

ATTACK SURFACE REDUCTION

Access control 

Patching and updating

ATTACK SURFACE REDUCTION

Network segmentation

ATTACK SURFACE REDUCTION

Removing unnecessary components

ATTACK SURFACE REDUCTION

§  Removing hardware or software components reduces the attack surface. By removing software, the organization eliminates a pathway that attackers can exploit.

Employee training

ATTACK SURFACE REDUCTION

A threat actor that is motivated by a social issue or political cause

A hacktivist group, such as Anonymous, WikiLeaks, or LulzSec, uses cyber weapons to promote a political agenda.

An inexperienced, unskilled attacker that typically uses tools or scripts created by other

A script kiddie is someone who uses hacker tools without necessarily understanding how they work or having the ability to craft new attacks. Script kiddie attacks might have no specific target or reasonable goal other than gaining attention or proving technical abilities. They can still cause significant harm and/or damage without proper safeguards and preparations.

Supply Chain Access

. These outside sources form the supply chain and can be exploited to gain access to an otherwise secured environment. For example, a vendor may supply software products so an attacker can work to gain access to the software supplier, whose security practices may be lackluster, to insert malicious code into the vendor software prior to delivery to the target organization. Similarly, an attacker can target a managed services organization that may have VPN access to several valuable targets. Lastly, an attacker may target an equipment supplier in order to insert malware, vulnerable hardware/software, or rogue components that are assembled into the final product

An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.

APTs typically target large organizations, such as financial institutions, companies in healthcare, and other organizations that store large volumes of personally identifiable information (PII), especially when the PII describes important government and political figures.

Government bulletins

(Defensive OSINST)

• The government is responsible for protecting the country's constituents and the national infrastructure and publishing a wide variety of information and advice regarding observed threats. For example, the Department of Homeland Security and the Cybersecurity and Infrastructure Agency publish several types of cybersecurity guidance, including basic informational content and binding operational directives that federal agencies must implement.

Resources on the Internet that are distributed between anonymized nodes and protected from general access by multiple layers of encryption and routing

• The dark web serves as an operating platform for many cybercrimes. Threat actors utilize the dark web to organize their efforts and sell products such as credit card numbers, drugs, weapons, and malware. Observing this activity can provide insight to threat actor activities, future attacks, information regarding current tactics, and evidence of previously undiscovered breaches.

A not-for-profit group set up to share sector-specific threat intelligence and security best practices among its members.

Information Sharing and Analysis Centers (ISACs) provide critical infrastructure owners and operators with cybersecurity information and services. They facilitate the sharing of threat information and best practices between the public and private sectors, allowing for the protection of vital assets. ISACs also provide advice on current and emerging cyber threats, helping to ensure a more secure cyber landscape.

Vulnerability Management

(Threat Intelligence Sharing)

A cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring

The purpose of threat hunting is to analyze routine activities and network traffic to identify potential anomalies indicative of malicious actions which may result in a complete breach. Threat hunting describes the methods used to identify malicious cyber activities within an organization's network in a systematic way. Threat hunting subscribes to an "assume breach" mentality; a crucial strategy designed to help protect against advanced cyberattacks, mitigate any intrusion's impact, and develop a procedural approach to cyber resilience.

A sign that an asset or network has been attacked or is currently under attack.

Indicators of compromise (IoCs) are essentially pieces of forensic data providing evidence of a potential intrusion into a system or network. An IoC indicates a high likelihood of unauthorized access to a system or that a successful attack has occurred.

Indicators of compromise (IoCs) can be identified using digital forensics techniques, which analyze digital artifacts left behind on a compromised system or network. These artifacts include log files, memory dumps, network traffic, and file system information.

Some common IoCs include unusual outbound network traffic (such as large volumes of outbound DNS traffic), logins occurring from unexpected geographic locations, suspicious privileged user account behavior, unusual changes in log files, protocols associated with command-and-control activities, traffic to known questionable URLs or IP addresses, and distributed denial-of-service (DDoS) attacks.

Active Defense

SAM
Windows Registry Files stored in C:\Windows\System32\Config

SECURITY

Windows Registry Files stored in C:\Windows\System32\Config

SOFTWARE
Windows Registry Files stored in C:\Windows\System32\Config

SYSTEM

Windows Registry Files stored in C:\Windows\System32\Config

DEFAULT

Windows Registry Files stored in C:\Windows\System32\Config

System Processes

System processes are background tasks that run on a computer without user interaction and often without the user's knowledge. System processes, such as the operating system kernel and other system services, are essential for the operating system to manage system resources, such as memory, network connections, and hardware devices. System processes can also be used to launch applications and perform other tasks. Examples of system processes include antivirus scans, disk defragmentation, user authentication, printing, and system updates.

Hardware Architecture

Hardware architecture describes the underlying technology used by a device to perform computational tasks. Operating systems and applications are designed to run on a specific hardware architecture. Different architectures emphasize different characteristics, such as scalability, raw processing power, power management, and other features. ARM and x86 architectures are common, with x86 dominating desktops, laptops, and server computers, and ARM architectures dominant in smartphones, tablets, and single-board computers like the Raspberry Pi. Software designed to run on one architecture cannot run on another without the use of an emulator.

Application cell/container virtualization dispenses with the idea of a hypervisor and instead enforces resource separation at the operating system level. The OS defines isolated "cells" for each user instance to run in. Each cell or container is allocated CPU and memory resources, but the processes all run through the native OS kernel. These containers may run slightly different OS distributions but cannot run guest OSs of different types (you could not run Windows or Ubuntu in a Red Hat Linux container, for instance). Alternatively, the containers might run separate application processes, in which case the variables and libraries required by the application process are added to the container.

One of the best-known container virtualization products is Docker (docker.com)

[image]

Classifying the ownership and management of a cloud as public, private, community, or hybrid.

A cloud deployment model is a specific model or style of cloud computing. A cloud deployment model defines how an organization distributes applications and services and where data is stored. It also helps to determine how many resources are available for specific applications.

Cloud that is deployed for shared use by multiple independent tenants.

Public cloud is designed for public access and geared toward those without the budget, resources, or desire to build and manage a private cloud or data center. Services are hosted on a third-party infrastructure and accessed via the Internet. Examples include Amazon AWS, Microsoft Azure, Google Cloud, Linode, IBM Cloud, Oracle Cloud, and many others.

Private cloud

Cloud that is deployed for use by a single entity.

Private cloud is designed, built, and managed in-house using hardware provided by a cloud provider service. Private clouds provide high levels of control over the infrastructure, but they typically require more up-front capital and ongoing maintenance than a public cloud.

Cloud deployment that uses both private and public elements.

A hybrid cloud generally refers to the combination of resources in both a public and private cloud. It is a type of cloud computing that combines on-premises infrastructure—or a private cloud—with a public cloud. By doing this, organizations can benefit from the scalability and cost-effectiveness of the public cloud while maintaining the security and control of their private cloud.

A software architecture that runs functions within virtualized runtime containers in a cloud rather than on dedicated server instances

offerings, services such as authentication, web applications, and communications aren't developed and managed as applications running on VM instances within the cloud. Instead, the applications are developed as functions and microservices, each interacting with other functions to facilitate client requests. When the client requires some operation to be processed, the cloud spins up a container to run the code, performs the processing, and then destroys the container. Billing is based on execution time rather than hourly charges.

APIs and compatible hardware/virtual appliances allowing for programmable network appliances and systems.

abstracts physical network devices, like routers and switches, replacing them with a virtual control plane that makes all decisions regarding traffic management. SDN allows for building cloud-based networks using virtualized equivalents of physical routers, firewalls, and other network devices used in on-premises networks. SDN architectures support security applications because the central controller allows data planes to be rapidly reprogrammed using automated provisioning and policy-based controls. 

Zero Trust architectures assume that nothing should be taken for granted and that all network access must be continuously verified and authorized. Any user, device, or application seeking access must be authenticated and verified. Zero Trust differs from traditional security models based on simply granting access to all users, devices, and applications contained within an organization's trusted network.

§  Greater security—All users, devices, and applications authenticated and verified before network access. 

§  Better access controls—More stringent limits regarding who or what can access resources and from what locations resources can be accessed.

§  Improved governance and compliance—Limits on data access and greater operational visibility on user and device activity. 

§  Increased granularity—Users granted access to what they need when they need it. 

Authentication Factors

Use of a communication channel that is different than the one currently being used

out-of-band mechanism, generates a software token on a server and sends it to a resource assumed to be safely controlled by the user. 

Use of a communication channel that is the same as the one currently being used.

In-band authentication describes the use of authentication factors that rely on the same system requesting the authentication; for example, providing username and password credentials on a standalone server.

Passwordless Authentication

Passwordless authentication is a method by which users can access an account without entering a password. This type of authentication relies on biometric authentication, such as facial recognition, fingerprint scanning, voice recognition, or a one-time code sent to a user's email address or phone number. Passwordless authentication methods are gaining popularity as organizations look for methods to improve the quality, reliability, and rigor of authentication. Passwordless authentication offers a method of authentication that cannot be easily shared (unlike a password) and removes the burden of remembering passwords from employees. Passwordless authentication allows devices to recognize authorized users by using their unique physical characteristics instead of their memory of a password.

Policies, procedures, and support software for managing accounts and credentials with administrative permissions.

PAM solutions can store the login credentials of privileged accounts in a secure repository and require additional authentication measures for any entity wishing to use them. Doing so tracks and logs who accessed and used privileged credentials at any time, allowing for greater awareness and visibility into their use.

A process that provides a shared login capability across multiple systems and enterprises. It essentially connects the identity management services of multiple systems

Federation means that the company trusts accounts created and managed by a different network. As another example, a person might want to use both Google Apps and Twitter. If Google and Twitter establish a federated network for the purpose of authentication and authorization, then the user can log on to Twitter using his or her Google credentials or vice versa.

An identity federation method that enables users to be authenticated on cooperating websites by a third-party authentication service

OpenID is a method of authenticating users with certain sites that participate in an OpenID system. This enables them to retain a single account for all participating sites. A user will register with an OpenID system in a given domain like they would with any other account. A site under this OpenID domain will then give the user the option to sign in using this system. Then the site contacts its external OpenID provider in order to verify that the login credentials supplied by the user are correct. Large companies, such as Google and Amazon, use their own OpenID systems. OpenID Direct adds a layer of authentication to OAuth 2.0, the latest version of the protocol.

An identity federation method that provides single sign-on capabilities and enables websites to make informed authorization decisions for access to protected online resources.

Shibboleth is a federated identity method based on SAML and is often used by universities and public service organizations. In a Shibboleth implementation, a user attempts to retrieve resources from a Shibboleth-enabled website, which then sends SAML authentication information over URL queries. The user is then redirected to an identity provider with which they can authenticate using this SAML information. The identity provider then responds to the service provider (the Shibboleth-enabled website) with the proper authentication information. The site validates this response and grants the user access to certain resources based on their SAML information.

CASBs are implemented in one of three ways

Forward proxy

CASBs are implemented in one of three ways

Reverse proxy

• This is positioned at the cloud network edge and directs traffic to cloud services if the contents of that traffic comply with policy. This does not require configuration of the users' devices. This approach is only possible if the cloud application has proxy support.

A software solution that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks.

. Data loss prevention (DLP) products automate the discovery and classification of data types and enforce rules so that data is not viewed or transferred without a proper authorization

Any type of personally identifiable information (PII) associated with a person who has a payment card, such as a credit or debit card

Cardholder data (CHD) is information related to the owner of a payment card, such as a credit or debit card. This data includes the cardholder's name, card number, expiration date, billing address, and security code (CVV). Protections for cardholder data are provided in industry standards and privacy regulations such as Payment Card Industry Data Security Standard (PCIDSS), the General Data Protection Regulation (GDPR), Gramm-Leach-Bliley Act (GLBA), and others.

Data that is of commercial value and can be granted rights of ownership, such as copyrights, patents, and trademarks

Intellectual property (IP) describes intangible products of human thought and ingenuity. Intellectual property is protected by various laws such as copyrights, patents, trademarks, and trade secrets. Intellectual property often represents vast sums of investment money and research time and provides significant competitive or military advantage.

Secure Sockets Layer (SSL) Inspection 

Log Ingestion

Log ingestion describes collecting log data from multiple sources, such as authentication servers, application servers, web servers, and databases, and storing it in a centralized location for analysis. It often involves using logging tools like Splunk and Logstash to collect and process log data from these systems to provide a comprehensive view of the infrastructure and the activities taking place within it.

Time Synchronization

Time synchronization ensures that computer systems have accurate system time and time-related information by synchronizing the system time with a reference time source, using Network Time Protocol (NTP), an atomic clock, or a global positioning system (GPS). Time synchronization is essential to establish a clear event order.

Logging Levels

Logging levels refer to the severity or importance of a log message. Common logging levels include the following: 

§  DEBUG: used for debugging purposes

§  INFO: used for informative messages

§  WARNING: used to indicate a potential problem

§  ERROR: used to indicate a serious problem

§  CRITICAL: used to indicate a critical problem

Syslog uses eight logging levels, starting from the most severe (level 0) to the least severe (level 7). 

§  0 Emergency (emerg): system is unusable.

§  1 Alert (alert): immediate action required.

§  2 Critical (crit): critical conditions.

§  3 Error (error): error conditions.

§  4 Warning (warn): warning conditions.

§  5 Notice (notice): normal but significant conditions.

§  6 Informational (info): informational messages.

§  7 Debug (debug): messages helpful for debugging.

A solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications.

Security information and event management (SIEM) automates the collection, analysis, and response to security-related data. This automation helps simplify identifying, analyzing, and responding to security threats, especially for events contained within log data.

A class of security tools that facilitates incident response, threat hunting, and security configuration by orchestrating automated runbooks and delivering data enrichment

Security orchestration, automation, and response (SOAR) describes the process of using technology to automate the work of identifying, analyzing, and responding to security threats often flagged by a SIEM. SOAR tools frequently "bolt on" to a SIEM and trigger after an alert is generated. Instead of sending the alert to a security analyst for manual review, the alert is instead forwarded to a SOAR platform. The SOAR performs a series of tasks grouped within preestablished playbooks in response to the alert.

The SOAR extracts relevant fields from the alert and, using scripts or API integrations with other security tools, can evaluate events and data contained within the alert and respond to them accordingly. For well-defined event types, the SOAR can resolve the issue fully. For more complicated events, the SOAR will perform specific automated analyses and include them in a new alert for manual review. The SOAR, when properly implemented, can significantly reduce the number of false positives and the number of mundane tasks performed by security personnel and can also help to reduce the amount of time and manual labor required to monitor and respond to security threats. Additionally, SOAR tools help ensure that security threats are promptly identified and addressed, resulting in more effective mitigations and improved security.

Analyze workflows
Identifying Tasks Suitable for Automation

Evaluate time-to-detection
Identifying Tasks Suitable for Automation

Identify high-risk areas

Identifying Tasks Suitable for Automation

Identifying Tasks Suitable for Automation

Evaluate the benefits of automation

Identifying Tasks Suitable for Automation

Orchestrating Threat Intelligence Data

Data enrichment combines and analyzes data from disparate sources to gain a greater understanding of the threat landscape. This can involve combining different threat feeds to get a complete picture of the malicious actors, tools, and tactics that attackers use. It can also involve correlating data from multiple sources, such as network logs, endpoint data, and threat intelligence feeds, to identify and prioritize threats. By orchestrating threat intelligence data, organizations can better understand the threats they are facing and take preemptive action to protect their networks. With the right processes in place, organizations can effectively create a complete picture of the threat landscape and ensure they take the proper steps to stay ahead of cyber adversaries.

National Institute of Standards and Technology (NIST)

The Center for Internet Security (CIS) benchmarks are a set of security configuration best practices developed by a consensus community of experts. They provide a secure baseline configuration for various operating systems, applications, and hardware devices. The benchmarks define best practice approaches to patching, hardening, and system logging and are the industry standard for secure configuration.

Several vulnerability scanners, such as the licensed version of Tenable's Nessus scanner, include configuration scanning options to compare an endpoint's active configuration to the settings detailed in a CIS benchmark.

internal scans focus on the view from the "inside."

Internal scans are also important to protect systems from abuse from internal threats and to provide layered security. For example, if an attacker makes it past external protections, their job should still be difficult even if they have made it to the "inside." Internal scans should include detailed, comprehensive vulnerability information

Hardware or software configured with a list of known weaknesses and exploits and can scan for their presence in a host OS or particular application.

An infrastructure vulnerability scanner is a type of software that scans network hosts (client and servers) and intermediate systems (routers, switches, access points, and firewalls) for data such as patch level, security configuration and policies, network shares, unused accounts, weak passwords, rogue devices, antivirus configuration, and so on. A scanner can be implemented purely as software or as a security appliance connected to the network.

Noncredentialed scans are simple to implement, produce a relatively low impact on the device, and provide insight regarding what vulnerabilities are discoverable to non-authenticated users, for example, someone with access to the network only

Credentialed scans provide the most comprehensive evaluation of devices. By authenticating to the device, the scanner can enumerate all installed software, the file system, configuration data, user accounts, and many other attributes. Special care is needed when using credentialed scans, as the most effective scanner credentials also have privileged access. If the scanner does not correctly protect the credentials, or if staff are not careful to protect the credentials, they can be abused or potentially exposed and stolen. Accounts such as root, Domain Administrator, or Administrator are inappropriate for vulnerability scanning. Scanning endpoints should be done with purpose-specific and carefully provisioned credentials, granting only the necessary access.

Agentless Scan 

Map/Discovery Scan

Identifying the type and version of an operating system (or server application) by analyzing its responses to network scans.

Fingerprinting describes the effort taken to more specifically identify details about a device. Whereas a map or discovery scan looks for connected devices, a fingerprint scan looks to focus attention on an individual device to better understand its purpose, vendor, software versions, configuration details, and the existence of vulnerabilities.

The process of reviewing uncompiled source code either manually or using automated tools.

Static analysis can be performed in a variety of ways. One method involves manual inspection of source code in order to identify vulnerabilities in programming techniques. Another approach uses specialty applications or add-ons to development tools that are designed to look for well-known programming methods and constructs that are known to be problematic.

The process of analyzing the structure of hardware or software to reveal more about how it functions

Reverse engineering describes deconstructing software and/or hardware to determine how it is crafted. Reverse engineering's objective is to determine how much information can be extracted from delivered software

Reverse engineering is not limited to software. Hardware can be reverse engineered to better understand how it operates in order to insert malicious components, for the theft of intellectual property, and/or to carefully inspect how a device operates in order to confirm it meets security requirements or to determine if it has been tampered with. Reversing can be performed on all nature of devices, and some examples might include security tokens, computer equipment, network and wireless equipment, cars, wearables, IoT devices, and many others.

Legal and regulatory environments will usually be accompanied by a security framework or checklist of the controls and configuration settings that must be in place. Security software products such as IDS, SIEM, and vulnerability scanners can often be programmed with compliance templates and scanned for deviations from the template.

Some sources of external compliance may dictate a scanning frequency that your organization must follow; others take a more hands-off approach and simply require that you have a plan in place to scan at certain intervals. 

Center for Internet Security

(CIS) benchmarks

This segmentation has a performance benefit and a security benefit because traffic flows between zones are more predictable and easier to monitor and filter. When you perform vulnerability scanning across a segmented network, you need to consider the requirements and limitations:

§  A server-based scanner must be able to communicate with remote subnets, possibly including multiple VLANs, and through one or more firewalls. Alternatively, multiple scanning host nodes can be deployed in multiple segments and configured to report back to a central management server.

§  An agent-based scanner must be able to communicate reports to the management server.

§  Identification of Operating System - Identifying the operating system of the target system is essential to ensure that the correct vulnerability scans used and to identify any unsupported or non-compliant operating system versions.

§  Scanning Interval - Scanning should be done regularly to identify new vulnerabilities. Scans should agree on an automated schedule or use specialized agents that support near real-time vulnerability identification.

§  Scan Speed - The scan speed is important as it can affect the accuracy of scan results. If a scan is too slow or too fast, it may miss important vulnerabilities and produce inaccurate results or overwhelm the target system resulting in negative performance impacts and downtime.

§  Vulnerability Database - The accuracy of the scan results depends on the quality of the vulnerability database used. It is essential to use a comprehensive and up-to-date vulnerability database prior to performing a vulnerability scan.

§  Scanning Type - Different types of scans can be performed to identify vulnerabilities in the target system. These include port scans, vulnerability scans, and comprehensive security configuration scans. 

§  Authentication - Authenticated scans are more comprehensive as they identify vulnerabilities using an authenticated session and have greater access to the host and software for deeper inspection. Unauthenticated scans have less performance impact on the target system but produce limited results compared to authenticated scans.

§  False Positives  -False positives are sometimes generated when vulnerability scans are performed. False positives represent invalid warnings generated by a scanner and waste the analyst's time researching and verifying the results.

Communications network designed to implement an industrial control system rather than data networking.

Operational technology (OT) is a term used to describe the hardware and software technologies used to manage physical devices, processes, and events within an organization. It is the type of technology used to monitor and control actual physical systems, processes, and events in the environment. Examples of OT include industrial control systems, robotics, sensors, Programmable Logic Controllers (PLCs), and SCADA systems, as well as the networks and devices used to operate them.

Type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographically large areas from a host computer

A supervisory control and data acquisition (SCADA) system takes the place of a control server in large-scale, multiple-site ICSs. SCADA typically run as software on ordinary computers, gathering data from and managing plant devices and equipment with embedded PLCs, referred to as field devices. SCADA typically use WAN communications, such as cellular or satellite, to link the SCADA server to field devices.

Scheme for identifying hardware devices, operating systems, and applications developed by MITRE.

Uses a syntax similar to Uniform Resource Identifiers (URI). CPE is a standardized naming format used to identify systems and software.

Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST

A list of records where each item contains a unique identifier used to describe publicly known vulnerabilities. Unique identifiers begin with CVE, followed by the year of identification, and a unique number - CVE-YEAR-#####.

Scheme for provisioning secure configuration checks across multiple sources developed by MITRE and adopted by NIST.

Similar to CVE, except focused on configuration issues which may result in a vulnerability.

Vulnerability Scans

A zero-day represents an exploitable vulnerability with no available patch.

The lack of available patch is caused either because the vulnerability is new, and a patch is not yet available, or because the vulnerability is entirely unknown to the software provider.

These vulnerabilities are highly valuable to attackers. Standard vulnerability scanning techniques cannot detect unknown zero-day exploits because the scanner depends upon a vulnerability database of known vulnerabilities. 

CVSS Score Calculations

Categories

§  Impact—The potential damage or harm caused by the vulnerability.

§  Exploitability—The ease and likelihood of exploiting a vulnerability.

§  Remediation—The cost and effort required to fix the vulnerability. 

CVSS Score Calculations

Metrics:

§  Scope—The number of systems and people affected by the vulnerability. 

§  Confidentiality—The extent to which data is disclosed.

§  Integrity—The extent to which the system's functionality is changed or impaired. 

§  Availability—The extent to which a system is unavailable.

§  Privacy—The extent to which the system's privacy is impacted.

§  Operations—The extent to which the system's security is affected. 

§  Other—Any other relevant or important factors.

Vulnerability Management Reporting Benefits 

Improved response

Vulnerability Management Reporting Benefits 

Improved security posture

Vulnerability Management Reporting Benefits 

Better compliance

Top 10 Lists

Compliance Reports 

KPIs help organizations measure progress toward goals and identify areas for improvement in operations. Any stage of the cybersecurity lifecycle can use KPIs—prevention, detection, or response. KPIs are essential for organizations to understand how their cybersecurity efforts are performing, and they can also use them to determine areas where the organization needs to improve.

KPIs provide this data by tracking metrics, such as the number of security incidents and the time it takes to detect them. KPIs also allow organizations to compare their cybersecurity efforts against other organizations and industry averages. This comparison can help identify where cybersecurity efforts are exceeding expectations and areas where they need to catch up. By tracking KPIs, organizations can determine if additional cybersecurity staff or equipment resources are required or if existing resources are working sufficiently.

Examples of KPIs

Incidents

Examples of KPIs

Detection Time

Examples of KPIs

Indicators of Compromise (IoCs)

Examples of KPIs

Threats

Examples of KPIs

Risk Assessment

Examples of KPIs

Resource Allocation

Service Level Objectives (SLOs)

Action Plans 

Action plans provide direction and focus, enabling organizations to achieve strategic goals and objectives. Action plans help frame how to measure progress because they outline the steps, resources, and timelines required to achieve specific goals. Action plans should be tailored to each organization's unique needs and regularly updated to reflect changes in the business environment.

An action plan should begin with a clear statement of the desired outcome followed by a detailed description of the steps and resources needed to reach the desired result. Including measurable goals and objectives in the action plan ensures that leadership can track progress.

Once the action plan is in place, leadership must track progress and adjust the plan as warranted to ensure goals are realistic and achievable. Sometimes tasks progress differently than the original plan. When this happens, it may indicate that the plans need to be adjusted, the time frames are unrealistic, or that additional resources are needed to stay on track.

Action plans are a critical component in response to a vulnerability report. When a vulnerability report identifies that problems exist in the environment, the race is on to implement fixes!

Leadership teams use several approaches to reduce risks, like investing in new security software, making configuration changes, updating policies within an organization, and many other options. 

§  Unpatched software—Applying the most recent security patches released by the software vendor can mitigate most vulnerabilities. 

§  Weak passwords—Passwords are often the first line of defense in protecting systems and data. When passwords are easy to guess or crack, they expose systems to unauthorized access. 

§  Outdated operating systems—Legacy operating systems do not receive security patches and often have many easily exploitable vulnerabilities. Replacing or upgrading operating systems can be difficult, and it is not uncommon to find legacy operating systems still in use by many organizations despite the risks they pose. 

§  Inadequate infrastructure protection—When firewalls, antimalware tools, and access controls are not correctly configured or maintained, they leave networks vulnerable.

§  Misconfigurations—Working under time constraints, staff frequently provision services using default settings, guessing, or using Google for help. Additionally, staff often disable secure settings to resolve problems in response to trouble tickets.

§  Regularly testing systems—It is essential to regularly test systems to ensure they operate correctly and identify potential weaknesses. Testing should include internal and external systems maintained by providers that the organization is dependent on. 

§  Limiting access—Limiting who has access to systems and networks that store or process sensitive data is an effective way to protect it.  

§  Monitoring—This includes monitoring internal systems, such as servers, and externally accessible systems, such as web servers. Regularly scanning systems for vulnerabilities and quickly repairing issues is an effective way to guard against data breaches.

Establishing Security Policies 

An essential method to improve security is establishing robust security policies and procedures within an organization. Writing down requirements and expectations in policies and procedures leaves little doubt for staff trying to understand expectations. Additionally, leadership teams can effectively enforce expectations when they are properly documented. Policies and procedures should include everything from the requirement for strong passwords, limiting access to sensitive data, change management, provisioning or de-provisioning software and services, managing user accounts, patching scanning, incident response, and many other areas. It is also critical to regularly evaluate the effectiveness of policies and procedures to ensure that they are working as intended.

Training Staff

It has been well established that one of the best ways to protect against attacks is to train employees to recognize security issues and know how to respond to them. Awareness and skills development training are essential, but training on existing organizational policies and procedures is also critical. It is also necessary to regularly test employees to ensure they have retained the information or developed the skills addressed in their training.

Software Patching 

Security patches released by developers are often the first line of defense against successfully exploiting software vulnerabilities. It is essential to keep track of patch releases and regularly scan the environment to identify any missing patches. Timely application of patches ensures that software remains secure and up to date. Patches are applied to software using many approaches, including automatic updates, manual installation, and centrally administered patch deployment systems. Automatic updates are highly effective because they ensure that patches are applied as soon as they are released. Despite this, organizations must test most patches before deployment to ensure they do not cause problems or introduce bugs. Manual installation is less effective because patches may not be promptly applied, but this approach offers the highest amount of control. 

Compensating Controls

Compensating controls address security risks when traditional measures, such as software upgrades, multifactor authentication, encryption, and other similar controls, are not viable. This can happen when systems do not support modern security features or when these changes break business-critical operations. Many organizations use complicated and highly integrated systems that are extremely difficult to change, upgrade, and maintain. Compensating controls provide additional layers of security to protect against malicious or accidental breaches.

Compensating controls are typically used when an organization cannot implement a more traditional security measure due to cost, complexity, or other factors. For example, if an organization cannot afford to implement a biometric authentication system, they may instead use compensating controls such as two-factor authentication. Compensating controls can also be used when a security measure is not available, such as in the case of legacy systems.

Compensating controls provide protection when circumstances prevent the use of primary security measures. Compensating controls act as an alternative method of protection. That is not to say that compensating controls cannot, or should not, be used together with primary controls. Compensating controls offer layered protections and keep systems and software safe by providing redundancy. If one control fails, there is another still providing protection.

Compensating controls should be tailored to the organization's specific security needs and should be regularly reviewed and updated to ensure they remain effective. Because they address specific risks, compensating controls should be evaluated individually and implemented with the same level of care and diligence as any other security measure.

Configuration Management

Configuration management tracks and controls changes in a system's configuration. It is a critical component of security governance and often works as the cornerstone of systems management. Configuration management assists with planning, organizing, and controlling the development and maintenance of systems and services.

Configuration management helps security teams ensure that systems remain consistent, compliant, and secure. Organizations can ensure that their systems are up to date, reliable, and secure by implementing proper configuration management processes and tools. Configuration management also helps organizations maintain compliance with industry standards.

Leadership and Management

Organizations are constantly growing, changing, and adapting, so leaders must be mindful of how this evolution impacts the cybersecurity program. Generally, as the organization changes, so must its security approaches and capabilities. Often, security teams and organizational leaders work independently from each other. This is a risk because the leadership teams may make decisions about operations that severely impact the environment's security. Likewise, when security teams work independently of operations teams, they may not fully comprehend the impacts their security-focused decisions have on staff productivity. 

A classic example is merger and acquisition activity. When one organization acquires another, each organization may have different approaches to security. Leadership teams will be eager to integrate systems to streamline operations and reduce operating costs. 

In contrast, security teams may push back on integration efforts until after security assessments and issues remediation activities are complete. Another example is changing business requirements stemming from new partnerships. A security team that has successfully managed security operations for many years may discover that they are subject to many new rules when the organization starts working with a defense contractor with stringent supply chain controls.  

Usually a preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve the exchange of money.

A memorandum of understanding (MoU) is a legal document that outlines the terms and conditions of an agreement between two or more parties. It is an agreement that is not legally binding but serves as a document of understanding and good faith among the parties involved. A memorandum of understanding usually outlines the agreement's objectives and each party's duties and responsibilities. 

The main purpose of a memorandum of understanding is to ensure that all parties involved in the agreement understand each other's expectations and obligations. It serves as a clear guide to the parties involved and helps ensure everyone is on the same page. It also serves as a reference point for the parties to use in a dispute. 

Once the memorandum of understanding is signed, it is considered a binding document. Both parties must understand the terms and conditions of the agreement and make sure to adhere to its provisions. The memorandum of understanding should also be reviewed and updated regularly to ensure that everyone is still in agreement with the terms of the agreement. 

An MoU might outline uptime, data access, response times, and other performance or access characteristics that conflict with the changes or maintenance tasks identified in response to mitigating vulnerabilities.

Operating procedures and standards for a service contract.

A service-level agreement (SLA) is a legally binding contract between two or more parties that defines the level of service to be provided by one party to another. It often governs the relationship with a third-party service provider. It outlines the services provided, the terms of service, the responsibilities of each party, and the penalties for failing to meet them. It is essential to have a service-level agreement in place when providing any service, as it serves to protect both parties and helps to manage expectations.

The service-level agreement should detail the services to be provided, including the quality of service, the response time, the cost, and other relevant information. It should also specify the time frame for the service delivery, the contact information for both parties, and the payment terms. It should also define the performance metrics used to measure the quality of the service. 

Organizational Governance

Organizational governance is the system of rules, practices, and processes an organization uses to control its operations and the strategic direction it pursues. It defines the roles and responsibilities of the board of directors, management, and other stakeholders in achieving the organization's objectives. Organizational governance aims to ensure that the organization is well managed, accountable, and compliant with applicable regulatory requirements. It also helps to ensure that the organization is guided by a set of values and principles consistent with its mission and objectives.

Organizational governance begins with the board of directors. The board of directors is responsible for setting the organization's overall direction, setting policies and procedures, and overseeing the organization's management. The board of directors is also responsible for setting the prevailing standards for organizational governance, such as selecting leaders, creating ethics policies, establishing a code of conduct, and monitoring operational performance.

In addition to the board of directors, other stakeholders, including shareholders, regulators, and the public, are involved in organizational governance. Shareholders are responsible for ensuring that the organization is accountable to them and that their investments are responsibly managed. Regulators ensure that the organization complies with applicable laws and regulations. The public is responsible for holding the organization accountable for its actions and ensuring that it follows its mission and objectives.

The dynamics and pressures of organizational governance often overshadow security initiatives. When new investments in security tools and software have high costs or security teams want to slow down operations to perform security evaluations and other similar activities, the board of directors may push back and override these plans. Security initiatives can often disrupt existing strategic plans, cause conflicts in the governance board, and upset stakeholders.

Business Process Interruption 

A business process interruption describes a disruption in an organization's normal operations. Disruptions can cause minor or significant impacts. Events such as natural disasters, power outages, technical glitches, human error, breaches, or cyberattacks, can cause business process interruptions. The interruption can affect any aspect of an organization's operations, from product and service delivery to internal operations and customer service. 

Business process interruptions can significantly impact a business's bottom line. Financial losses can occur due to lost revenue, increased costs, and missed opportunities. Furthermore, interruptions can negatively impact customer service, employee morale, and brand reputation. The costs of a business process interruption can be far-reaching, with the potential to cause long-term damage to a company's reputation and profitability. 

Degraded Functionality 

Degraded functionality is an issue that often arises in software and hardware. It occurs when system performance decreases due to various factors, such as environmental changes, age, lack of maintenance, and sometimes from applying security patches. It can also result from a design flaw, lack of resources, or inadequate testing.

Degraded functionality causes employee frustration, decreased efficiency, reduced performance, and increased costs due to repairs and replacements. Furthermore, it can cause safety issues due to the system's inability to perform as required.

Legacy Systems 

Legacy systems are outdated systems or software applications that have been in use for an extended period. Legacy systems are built on obsolete technologies and struggle to keep up with changing technological trends. As such, these systems often need significant help to meet modern security requirements, if that is even possible. Despite this, many organizations still rely on legacy systems and are reluctant to replace them due to the cost and complexity associated with the transition.

Legacy systems are rarely updated and often contain code that is difficult to maintain. As such, they are often vulnerable to security threats. Moreover, these systems often lack the ability to integrate with newer platforms, which is a significant problem for organizations that need to grow and adapt their capabilities to changing operating requirements.

Modernizing legacy systems is frequently daunting, and upgrades require significant time, money, and resources to migrate data and make changes to the code. 

Proprietary Systems

Proprietary systems are specialized systems designed to serve a specific purpose and are tailored to an organization's needs. Proprietary systems can range from simple software programs to complex networks and databases. A company or organization often develops proprietary systems to provide a unique solution to a specific problem or challenge. They are often developed in-house, with the organization's staff, rather than using outside vendors. This allows the organization to control the system and ensure it meets its specific needs. In-house developed software depends on the skill and productivity of its own developers.

When security vulnerabilities are identified in these systems, they often create overwhelming trouble for in-house teams. Security changes are often complicated and depend on the application's architectural structure. Poor architectural design choices made early in development can create huge problems when security changes are needed

1.    Make the system resilient to attack in the first place. This includes hardening systems, writing policies and procedures, and setting up confidential lines of communication. It also implies the creation of incident response resources and procedures.

1.    Once the incident is contained, the cause can be removed and the system brought back to a secure state. The response process may have to iterate through multiple phases of detection, containment, and eradication to effect a complete resolution.

1.    Analyze the incident and responses to identify whether procedures or systems could be improved. It is imperative to document the incident. This phase is very commonly referred to as lessons learned. The outputs from this phase feed back into a new preparation phase in the cycle.

§  Statements of the organization's expectations and procedures for responding to security incidents. These policies typically describe which incident types must be reported and should provide detailed descriptions of the steps to be taken in the event of an incident, the roles and responsibilities of those involved, and the communication protocols to be followed. The organization should also develop a timeline for responding to incidents, including the timeline for reporting and responding to them. It should also include a timeline for determining the cause of the incident, the recovery process, and the steps to prevent similar incidents in the future.

These describe the wide range of specialized tools needed during an incident response.

• Security Information and Event Management (SIEM)—Collect and analyze log data, provide a single viewpoint for logs collected from many sources. Help to locate specific events or event sequences.
• Intrusion Detection Systems (IDS)—Provides alerts when suspicious events occur based on established signatures or customcrafted signatures developed to locate events specific to an incident.
•  Vulnerability Scanners—Identify the presence of a vulnerability, especially one under active attack; can also provide assurance that a previously identified vulnerability has been remediated.
•   Netflow Analyzers—Provide high-level visibility into the volumes of traffic and protocols in use in the environment.
• Infrastructure Monitoring—Tools used to monitor availability, latency, capacity, and other elements. Typically associated with engineering teams and used to ensure the health and uptime of infrastructure components such as servers, storage environments, and network equipment.
• Proxies and Gateways—Firewalls, routers, and forward proxies (Internet traffic) provide valuable insight into traffic leaving and entering the network. These can be used to alert on specific traffic or analyzed to locate historical events.
  

Threat modeling, risk analysis, and other threat identification activities can help organizations identify potential threats and incidents that could impact the organization. Incident types include cyberattacks, natural disasters, and other events that could disrupt normal operations. Threat modeling tools can help organizations create threat models and analyze identified threats and incidents comprehensively by creating detailed diagrams that support team collaboration. 

Scenario-based simulations that organizations create to test how the incident response plan actually works in practice. Mock incidents can include simulations of different types of incidents that might occur, such as earthquakes or malicious cyberattacks. 

Antimalware software

Indicators of compromise (IoCs)

Network intrusion detection system/network intrusion prevention system (NIDS/NIPS)

Indicators of compromise (IoCs)

Host intrusion detection system/host intrusion prevention system (HIDS/HIPS)

Indicators of compromise (IoCs)

System logs

Indicators of compromise (IoCs)

Network device logs

Indicators of compromise (IoCs)

Security information and event management (SIEM)

Indicators of compromise (IoCs)

Flow control device

Indicators of compromise (IoCs)

Internal personnel

Indicators of compromise (IoCs)

People outside the organization

Indicators of compromise (IoCs)

Cyber-threat intelligence (CTI)

Indicators of compromise (IoCs)

Triage Event 

Properly determining the scope of a security incident occurs during triage. Triage work is dependent upon the skills and knowledge of the individuals performing the work and includes careful curation of the data and tools useful in locating any indicators of compromise. Individuals performing this work should have specialized training and experience in a live system and digital forensics as well as memory and malware analysis.

Triage work is often performed on endpoints, within executable and binary files, and using enterprise security infrastructure tools such as SIEM. Ultimately, triage work is focused on determining a timeline of what, where, how, and when events occurred.

Having clearly defined processes, thresholds, and notification procedures in place as part of a security incident pre-escalation plan is imperative to rapid response. The lack of a clear plan regarding what constitutes an urgent situation or knowledge of what to do when a situation is identified will result in problems being stuck in ticket queues or bogged down in bureaucracy while an adversary furthers the impacts of their attack.

A checklist of actions to perform to detect and respond to a specific type of incident.

Incident response playbooks are an invaluable tool for organizations to quickly and efficiently respond to security incidents. With an incident response playbook, organizations define the steps they need to take to respond to a security incident, such as the specific roles, processes, and procedures that security staff must follow. Incident response playbooks also guide communication with stakeholders and the public, as well as guide how to gather evidence and determine the incident's root cause.

Oftentimes the playbook is just that—a physical book used by a security analyst in response to an incident. Using a physical book ensures its availability during a wide-scale incident. In a highly secure environment, it also ensures the IR capabilities are not digitally exfiltrated by the attackers.

The most effective incident response playbooks are tailored to an organization's specific security needs and provide detailed guidance on responding to various security incidents. For example, a playbook may contain detailed instructions on responding to a ransomware attack or a data breach. Additionally, the playbook should include guidance on the necessary steps to contain the incident, such as isolating affected systems, and measures to ensure the incident is fully resolved.

When creating an incident response playbook, organizations should ensure they have the right level of detail and that all necessary stakeholders are involved, including security teams, IT staff, legal teams, and other personnel who may be involved in responding to the incident. Organizations should update the incident response playbook as new threats and technologies emerge. 

Communication Plan

A secure method of communication between the IR team members is essential for successfully managing incidents. The team may require "out-of-band" or "off-band" channels that attackers cannot intercept. In a major intrusion incident, using corporate email or VoIP runs the risk that the adversary can intercept communications. One obvious method is via smartphones, but ideally, the messaging system should support end-to-end encryption, digital signatures, and encryption keys supplied by a system independent of the identity and access management systems used by the attacked environment.

Forensic Process

Incident investigation requires analysis techniques designed to reveal the details of what happened. Forensic techniques are a critical component of the investigation. Broadly, forensic techniques look closely at the inner workings of devices, operating systems, and applications to reveal a detailed sequence of events. A sequence of events supported by forensic analysis helps the IR team improve the response to future incidents.

Digital forensics is highly specialized and complicated work, and entire books and certification exams are devoted to the topic. Regarding incident response, it is important to understand that the forensic process supports an investigation by providing specific details regarding an event.

Lessons Learned

Incident Response Plan Update

The conclusions of the lessons learned report should drive changes to incident response. This might involve small tweaks to procedures, better explanations or greater clarity for incident handlers, new templates for communicating with trusted parties, or major changes to the security controls used. Updates to incident response procedures require updated training and testing programs.

A collection of processes that enable an organization to maintain normal business operations in the face of some adverse event.

In short, business continuity (BC) describes the efforts the organization takes to keep the organization running during and after a disaster event. It describes how the organization continues to operate in the face of significant adversity and the effort needed to work through the event and then restore operations to normalcy. Bringing systems back online is part of the objective; returning things back to normal takes more time. For example, employees may need to complete or track work using alternative methods during a disaster. At some point, that information will need to be entered into the systems that were unavailable during the disaster. If the organization had to operate out of an alternative facility, all of the people and equipment will need to move back after the event passes. These activities are part of the business continuity plan.

A documented and resourced plan showing actions and responsibilities to be used in response to critical incidents.

Disaster recovery (DR) is a component of an overall business continuity plan. Disaster recovery plans focus on the immediate needs of a disaster when things are the most frantic and pressing. The tasks required to bring critical systems back online are the most crucial issue—for example, recovering systems after a wide-scale ransomware infection. Disaster recovery describes the efforts taken to restore infected systems to a safe operating state.

§  Atypical or unusual inbound and/or outbound network traffic

§  Administrator, root, or other highly privileged accounts being used in any unexpected way

§  Any account activity representing access or actions which should not be possible using the identified account

§  A high volume of invalid password entries

§  Unexpected increases in traffic volumes, especially database or DNS traffic

§  High volumes of requests to access a single file

§  Suspicious changes to the Windows registry or any unusual change to system files

§  Atypical requests to Domain Name Servers (DNS) or strange domain name resolution requests

§  Any unauthorized changes to system settings and/or mobile device profiles

§  Large quantities of compressed files stored in unexpected locations

§  Traffic originating from countries where the organization does not operate or have any business dealings

§  Any strange or unknown applications running on a system

§  Any unknown or suspicious scheduled tasks

§  Strange or unknown processes running on a system

§  Strange or unknown services installed on a system

§  Alerts from IDS/IPS, firewalls, endpoint protection, or any other security tools

§  Any unexpected instances of encrypted files