And as long as we're talking about things that we all love,
I of course have to bring up NIST.
Who doesn't love them some Cybersecurity Framework?
Not to be confused with the CSWF, or Cybersecurity Workforce Framework,
which describes tasks, and knowledge, and abilities that people need to know,
or understand, or be able to do associated with specific roles in cybersecurity.
Instead, the CSF, or Cybersecurity Framework,
is also from NIST, but not necessarily associated with NICE.
So not all NIST is NICE, but all NICE is NIST.
The point is that the Cybersecurity Framework is completely separate.
It's a set of functions broken down into categories and subcategories.
These are functions that you can see majorly reflected in the
SmartArt wheel of security that I showed you earlier.
Functions like identify and protect,
which focus on identifying the security needs and
implementing proper controls and administration of networks
and services to ensure those needs are met.
Though for the tools that we're going to be discussing,
on the network or on the hosts, performing things like security monitoring,
or threat hunting, or even incident response,
those are most often going to fall into the detect and respond functions.
For instance,
for a network‑monitoring tool like Arkime, formerly Moloch,
it would fall into the detect function, more specifically,
into the category of security continuous monitoring and covers the
subcategories requiring the monitoring of the network and the
monitoring from unauthorized connections.
In this way,
you can look for functions that you're missing in your organization and match
them with tools in this path that map to that function,
or in some cases, check that compliance box,
if you're into that kind of thing.
And before I again bring you to the circle of security armor,
in a way that I see it, let me first give you the original source.
The NIST Cybersecurity Framework is conveniently
located at www.nist.gov/cyberframework.
There are loads of resources that you can explore on your own,
but as you see here, this circle of security was not something that I made up.
These functions, the same ones that we are mapping the tools and capabilities to,
are the foundation of NIST's cybersecurity policy,
fulfilling these functions continuously to achieve specific
outcomes relative to improving your organization's security
posture and reducing overall exposure.
As much as I don't want to spend time just scrolling through a PDF with you,
I have spent some time reading through these frameworks,
and maybe that's some time that I can save you.
So let me show you the highlights.
This document provides a decent outline for how these functions or
actions can be accomplished by connecting risk management and senior
leadership with the business needs in the correct cybersecurity action to
mitigate risks to those business needs.
Now don't get me wrong,
these are for sure technical hands‑on explanations of tools
that are within this blue team tools path,
but with enough information to relate the use of these tools directly
to your business use case and company stakeholders.
And one last note,
as you explore the specific subcategories that are covered,
the documentation also reveals references,
controls, and standards that are also related to the relevant actions.
So if you're a CIS or if you're an ISO shop,
you can relate these functions to specific controls
within those frameworks as well.
Now that you have the official story from NIST,
let's talk about what was missing.
I really appreciate the perspective that the CSF brings to the way that you look
at roles within your security org, but I'm not someone who is beholden to any
one framework. And as far as this framework goes,
it does leave out some really important components.
First,
it leaves out the requirement for those functions to
be linked together to be effective,
each with their own inputs and outputs that feed the continuous cycle.
And second,
there's no function covering the ever‑changing nature of the
threat and how those threats, as they change,
change where your limited resources should be focused.
Also,
there's nothing to check that those policies or recover
activities were actually effective.
That's where Intel in the center and the second‑third of the primary
colors security game, emulation, or Red Teaming, comes in.
These are functions that are equally important to the successful
mitigation of risk to your organization's mission.
But what framework governs this, and how can we use our
understanding of threat actors' tactics to increase the
efficacy of our blue team tools?
Well first, let's talk about pyramids. These days, everybody's got to pyramid.
There's pyramid schemes, there's ancient pyramids that may or
may not have been cold‑fusion power sources, and for cyber
security, we have our pyramid of pain.
And though it sounds like some sort of out‑of‑control Mad Max
death challenge in a post‑apocalyptic world,
it's really about creating the security operation set of functions fed
by Intel that leverage information to detect the bad guys. Depending on
what type of information you're using,
it can be easy or hard for these malfeasance individuals to
bypass your detections or protections,
and this is represented by the lowest level of the pyramid of pain.
This metaphor works pretty well because the base is also wider, and
information wise, requires the largest dataset that's also the most
volatile dataset to try and keep up. Now I talked about that
before, the pace of innovation.
You need to keep up with the adversary's pace of innovation, and one
way to start to get ahead is by looking at TTPs,
as opposed to things like hashes or IPs.
When we're leveraging TTPs as indicators, or tactics,
techniques, and procedures,
you can develop behavioral detection for these techniques that will remain
effective regardless of whether the attacker changes their IPs, domains,
hashes, or other uniquely‑identified atomic IoCs, which stops you from having
to play such a fast‑paced game of whack‑a‑mole.