The check engine light tells you when one of your car’s systems has failed. Your cellphone alerts you when the battery is low. Your home security system sounds an alarm if it detects an intruder. Your home computer displays a warning message when a device or piece of software malfunctions. From a design perspective, it seems simple: You understand what to look for and you design a monitoring control around it. But what if your task is to reliably detect intrusions within a network or operating system? What if you’re building a system to identify indicators of compromise (IoC)? That is not simple at all.
There’s Salt in My Coffee! Now What?
On the surface, you know something isn’t right. Complaints that customers are receiving virus notifications when viewing your company’s website have begun without warning. Some of your sensitive data has been leaked on Twitter accounts and made fully available to the public on Pastebin. Your executive staff receives strange emails that appear to be from your company’s CEO and are sent from the internal mail system requesting that a large amount of money be transferred to an account that is already 30 days late for payment. All these things should raise a red flag. Scenes like these are taking place daily on a wide array of enterprise networks. And they’re causing millions of dollars in damage to companies and governments worldwide, perpetrated by an even wider array of attacker groups, company insiders, state-sponsored consortia and cybercriminal organizations.
Reading Between the Lines: Building a Better Rat Trap With IoC
Let’s say you’re fairly sure that your network may have been compromised. What do you do? There’s a good chance your first response would be to panic. Yet over the last few years, analytic techniques and tools have been developed and made available to the public — some for free, and others for a price. Either way, they can assist with digging in and identifying an IoC on your network, allowing you to build detection capabilities to find the root cause of a specific attack type and prevent breaches from recurring.
Interested in emerging security threats? Read the latest IBM X-Force Research
Senior Threat Researcher, IBM X-Force