Hidden Warnings: A Look at Indicators of Compromise (IoC)

The check engine light tells you when one of your car’s systems has failed. Your cellphone alerts you when the battery is low. Your home security system sounds an alarm if it detects an intruder. Your home computer displays a warning message when a device or piece of software malfunctions. From a design perspective, it seems simple: You understand what to look for and you design a monitoring control around it. But what if your task is to reliably detect intrusions within a network or operating system? What if you’re building a system to identify indicators of compromise (IoC)? That is not simple at all.

There’s Salt in My Coffee! Now What?

On the surface, you know something isn’t right. Complaints that customers are receiving virus notifications when viewing your company’s website have begun without warning. Some of your sensitive data has been leaked on Twitter accounts and made fully available to the public on Pastebin. Your executive staff receives strange emails that appear to be from your company’s CEO and are sent from the internal mail system requesting that a large amount of money be transferred to an account that is already 30 days late for payment. All these things should raise a red flag. Scenes like these are taking place daily on a wide array of enterprise networks. And they’re causing millions of dollars in damage to companies and governments worldwide, perpetrated by an even wider array of attacker groups, company insiders, state-sponsored consortia and cybercriminal organizations.

Reading Between the Lines: Building a Better Rat Trap With IoC

Let’s say you’re fairly sure that your network may have been compromised. What do you do? There’s a good chance your first response would be to panic. Yet over the last few years, analytic techniques and tools have been developed and made available to the public — some for free, and others for a price. Either way, they can assist with digging in and identifying an IoC on your network, allowing you to build detection capabilities to find the root cause of a specific attack type and prevent breaches from recurring.

Interested in emerging security threats? Read the latest IBM X-Force Research

Share this Article:
Dave McMillen

Senior Threat Researcher, IBM Managed Security Services

Dave brings over 25 years of network security knowledge to IBM. Dave began his career in IBM over 15 years ago where he was part of a core team of six IBMers that created the IBM Emergency Response Service which eventually grew and evolved into Internet Security Systems. As an industry-recognized security expert and thought leader, Dave's background in security is full featured. Dave thrives on identifying threats and developing methods to solve complex problems. His specialties are intrusion detection/prevention, ethical hacking, forensics and analysis of malware and advanced threats. As a member of the IBM MSS Threat Research Team, Dave takes the intelligence he has gathered and turns out immediate tangible remedies that can be implemented within a customer’s network or on IBM MSS's own proprietary detection engines. Dave became interested in security back in the late 1980's and owned and operated a company that provided penetration and vulnerability testing service, one of the first of its kind. As the internet's footprint began to grow, it became clear to him there was a new problem on the horizon; protecting data. Dave worked with WheelGroup (later acquired by Cisco) where he helped develop NetRanger IDS and NetSonar. Dave also assisted with development of the very first IBM intrusion detection system, BillyGoat. Dave also has developed several other security based methods and systems which were patented for IBM.