>> Indicators of compromise.
The learning objectives for this lesson,
are to define an indicator of compromise,
detail where indicators of compromise can be found,
and respond to indicators of compromise.
Let's get started. Indicators of compromise or IOC
can be thought of as a clue or a sign
that an intrusion has taken place in some way.
For example, if an attacker were
using the technique of password spraying,
you might see that many accounts
were being locked out at the same time.
In addition, your log files are going to be
filled with invalid credential events.
If an attacker has breached
your network and is in the process of stealing data,
you might see an abnormal amount of
traffic exiting your network.
Finally, you may see privileged accounts being
created or used in abnormal ways.
The root or administrator level account
is the crown jewels for most attackers.
What they're looking for is to get in,
gain access to that level of account and then start
using it in ways that you wouldn't be using it.
They also want to create additional accounts that are at
the same level in case their main access gets cut off.
Logging. Most devices on
your network will generate logs in some form.
These logs will always contain
valuable information on locating potential IOCs.
Some examples of log files would be
your operating system events such as
your window event logs and
your Syslog on Linux and Unix systems.
Routers and switches will also generate their own logs,
as do access points and printers.
The problem with logs is that they're
all scattered across your network and
you have to go to each one to
look for them and then look through
many events to find those very few fleeting IOCs.
We can also use packet capture for looking for IOCs.
This is when we're looking at the network traffic
down to the packet level.
This requires the use of a special tool known as
a snipping tool or also a protocol analyzer.
Examples of these would be Wireshark and TCP dump.
IOC notification sources are devices
that send us the information when they detect IOCs,
rather than us having to go and look through
all those logs scattered through our network.
Examples of these would be SIEM devices,
intrusion detection or prevention systems,
file integrity monitoring systems,
data leak or loss prevention systems,
and antivirus or antimalware software.
How do we respond to an IOC?
The first thing we have to do, is prioritize.
It should not be a first-come, first-serve basis.
It should be based on the following factors.
The severity and the priority.
The functional impact to your organization.
The information impact. What is being stolen,
what data is being affected?
Then the recoverability. We can
also use our existing security infrastructure
in our responses.
For example, firewall rules can
be quickly created to block off
traffic from leaving a network or traffic from coming in.
We can also use our intrusion
prevention or intrusion detection system rules,
or access control lists rules.
Endpoint protection can be updated to look for
certain files that have been added to
a system that contain malicious content
or to block specific attacks as they're occurring.
We can also update our DLP rules.
We can use scripts that contain
regular expressions to help
us automate some of these activities.
Triage and incident response.
During triage, your first goal
is to determine the scope of the breach,
how many systems have been impacted and
what has been affected?
Then you need clearly defined processes
for identifying incidents,
classifying those in incidents,
and then responding to
the incidents in the appropriate way.
The key is this needs to be
created before these type of things are
occurring so that you have
everything in a documented manner.
When these incidents happen,
you're not going to be thinking with a clear head.
It's crucial to have
these processes already identified ahead of time.
Event classification.
We have four categories of events.
The first is false positive.
This is something identified as an issue, but it's not.
Then we have false negative.
This is a potential issues that weren't identified.
True positives are an issue that is correctly identified.
Finally, we have true negative.
This is informational item that
is flagged as a non-issue.
We need a communications plan in our incident response.
We need to define who are the stakeholders.
This usually involves the human
relations part of the company,
public relations, senior leadership,
legal, law enforcement and regulators.
We also need to decide who needs to be notified.
We also need to know how we're going to notify them
and how are we going to control
the release of information about the incident?
It's critical that we don't
release sensitive information about the breach.
These are the types of things that
also need to be planned ahead of time.
You don't want to be deciding these on the fly,
after an incident has already happened.
Then the incident response process
we first start with preparation.
We harden our systems,
we create policies and procedures,
and then we create an incident response procedure plan.
Again, all of this needs to be done ahead of time.
Detection analysis.
We need to decide if an incident has
occurred and then how serious it is,
from there we notify our stakeholders.
After that, we begin to contain the incident.
We limit the scope of the breach.
Once we've contained everything,
we move to the eradication and recovery phase.
This is where we remove the cause of
the breach and bring things back to where they were.
Then we have a post incident activity.
This is an after action review.
What can we improve? What did we do?
Well, what did we not do so well in,
and then what lessons can we learn and
then document those for the future?
Let's summarize. We went over indicators of compromise.
We discussed logging,
and where log files come from.
Then we discussed the sources of IOCs,
and we moved to triaging and incident response.
How to classify incidents and
then coming up with a communications plan.
Let's do some example questions.
Question 1.
This stage of the incident response process is
focused on controlling how far the incident has spread,
this is Phase 3 or containment.
Question 2. Which of the following
would you not include in your communications plan?
One, legal counsel, two,
human resources, three,
financial department, four, law enforcement.
This is three, the finance department.
Question 3. Which of the
following would not likely be an IOC?
Ransomware demand found on PCs,
a user account being locked out,
abnormal bandwidth leaving the network,
excessive log entries for invalid credentials.
A user account being locked out.
A single user account is
a normal occurrence in
the day-to-day operations of a network.
One user account would not necessarily be an IOC.
Several user accounts being
locked out around the same time
would be. Question 4.
This technology allows for the capture of
network traffic data so that it can
be analyzed at the packet and frame level.
Sniffer or protocol analyzer.
I hope this lesson was helpful
for you, and I'll see you in the next one.