The check engine light tells you when one of your car’s systems has failed. Your cellphone alerts you when the battery is low. Your home security system sounds an alarm if it detects an intruder. Your home computer displays a warning message when a device or piece of software malfunctions. From a design perspective, it seems simple: You understand what to look for and you design a monitoring control around it. But what if your task is to reliably detect intrusions within a network or operating system? What if you’re building a system to identify indicators of compromise (IoC)? That is not simple at all.

There’s Salt in My Coffee! Now What?

On the surface, you know something isn’t right. Complaints that customers are receiving virus notifications when viewing your company’s website have begun without warning. Some of your sensitive data has been leaked on Twitter accounts and made fully available to the public on Pastebin. Your executive staff receives strange emails that appear to be from your company’s CEO and are sent from the internal mail system requesting that a large amount of money be transferred to an account that is already 30 days late for payment. All these things should raise a red flag. Scenes like these are taking place daily on a wide array of enterprise networks. And they’re causing millions of dollars in damage to companies and governments worldwide, perpetrated by an even wider array of attacker groups, company insiders, state-sponsored consortia and cybercriminal organizations.

Reading Between the Lines: Building a Better Rat Trap With IoC

Let’s say you’re fairly sure that your network may have been compromised. What do you do? There’s a good chance your first response would be to panic. Yet over the last few years, analytic techniques and tools have been developed and made available to the public — some for free, and others for a price. Either way, they can assist with digging in and identifying an IoC on your network, allowing you to build detection capabilities to find the root cause of a specific attack type and prevent breaches from recurring.

Interested in emerging security threats? Read the latest IBM X-Force Research

more from Intelligence & Analytics

CISA Certification: What You Need to Know

The globally-recognized Certified Information Systems Auditor (CISA) certification shows knowledge of IT and auditing, security, governance, control and assurance to assess potential threats. As you can imagine, it’s very much in demand. It can also be confusing.  Is CISA Certification Related to the Cybersecurity and Infrastructure Security Agency? CISA, the certification, is related to CISA, the federal agency, right?  Wrong.…

Raspberry Robin and Dridex: Two Birds of a Feather

IBM Security Managed Detection and Response (MDR) observations coupled with IBM Security X-Force malware research sheds additional light on the mysterious objectives of the operators behind the Raspberry Robin worm. Based on a comparative analysis between a downloaded Raspberry Robin DLL and a Dridex malware loader, the results show that they are similar in structure and functionality. Thus, IBM Security…