Software supply chain attacks are not new, but as we’ve seen recently, if executed successfully they can have huge payoffs for sophisticated attackers. Detecting malicious code inserted into a trusted vendor’s security updates is extremely difficult to do at scale, and for most organizations, impractical given the time required to analyze updates vs. the increased risk of not applying security patches to vulnerable systems. This holds especially true if the software providers’ upstream update servers are compromised and used for command and control of infected victim systems, ruling out restricting egress connections only to the vendor from the customers’ update management systems.

The fact is, most organizations still struggle for months to detect malicious actors within their network who managed to gain a foothold from much more common attack vectors, such as compromising vulnerable systems exposed to the internet or spear phishing to gain a foothold. A more effective approach to combating software supply chain attacks is to focus on better prevention, detection, and response to the actions a threat actor will take after they gain a foothold. These actions, commonly referred to as Tactics, Techniques, and Procedures (TTPs), are the activities that threat actors perform to gather information about compromised systems and your internal network, laterally move between systems, elevate their permissions on the network, and achieve their primary objectives in compromising your network, stealing sensitive data or funds, causing service disruptions, establishing long term persistence, or modifying important data.

Selecting, deploying, configurating and tuning an effective detection security stack, however, can be a major undertaking even for mature blue teams. Breach after breach we have seen that the most effective attackers have the motivation and skillset to invest time in finding ways to evade and bypass individual security controls, including machine learning algorithms used by modern cloud based EDR. Ultimately, these “next-gen” tools may create a false sense of security as attackers continue the arms race of identifying innovative ways to fool the analytics intended to detect their activities.

Blue Teams Working With Red Teams

Effective blue teams work with red teams to invest time and energy in improving detection rules, verify and tune alerts, and give their staff opportunities to train with skilled red team partners and learn how advanced techniques are chained together to evade security controls and remain undetected for months.

Organizations have invested significantly in products, including “next-gen” firewalls, antivirus, EDR controls, user behavioral analytics tools, and SIEMs, but the majority do not sufficiently test the effectiveness of these stand-alone controls and how they perform together as a complete security stack against known threat actor attack paths or more advanced techniques.

Controls aside, many organizations struggle to conduct exercises that provide their blue teams, detection engineers, and threat hunters with realistic experiences and opportunities to tune their detection rules and identify gaps in their incident response playbooks. An effective blue team is an experienced blue team, and that experience should ideally be built upon working with a trusted partner, not as a result of a real-world breach. The best blue teams are empowered to understand how advanced attacks work step-by-step, including gaining awareness in the gaps of their security stack, the flow of suspicious events between multi-tier security analyst teams as they are identified and escalated to incidents, the gaps in current incident response playbooks, and the overall unpredictability that comes from an advanced attacker using new tools, techniques, or exploiting unpatched or 0-day vulnerabilities.

Adversary Simulation engagements can help you mature your security program and controls, as well as help reduce key metrics such as the blue team’s Mean-Time-To-Detect (MTTD) and Mean-Time-To-Respond (MTTR), by conducting exercises designed to use the same TTPs as sophisticated actors, explaining how the attacks work, and providing detailed recommendations to both prevent and better detect attackers in the future. When blue teams know which types of attacks to look for, and what they look like, they can detect and respond quicker, and as such, minimize the damage. The preparedness can help prevent and reduce the time required to identify a breach; supply chain included.

X-Force Red provides adversary simulation services to enterprises worldwide. The services include red teaming, purple teaming, threat-intel-based testing and control.

To learn more about the value each type of adversary simulation exercise can provide, download our new ebook, Adversary simulation: Put your incident response programs to the test.

More from Incident Response

How to Start a Career in Cyber Incident Response

Cyber incident response is one of cybersecurity's most interesting and rewarding careers. It’s an in-demand role, and it pays well. But how do you get started? First, let’s start with the basics. What is Cyber Incident Response? Cyber incident response is the preparation for and practice of identifying, containing and ending cyber attacks. A computer security incident response team (CSIRT) within an organization — ideally including the chief information security officer, security operations center staff, executives and representatives from the…

How the Mac OS X Trojan Flashback Changed Cybersecurity

Not so long ago, the Mac was thought to be impervious to viruses. In fact, Apple once stated on its website that "it doesn't get PC viruses". But that was before the Mac OS X Trojan Flashback malware appeared in 2012. Since then, Mac and iPhone security issues have changed dramatically — and so has the security of the entire world. In this post, we'll revisit how the Flashback incident unfolded and how it changed the security landscape forever. What…

What Hurricane Preparedness Can Teach Us About Ransomware

Each year between June and November, many parts of the U.S. become potential targets for hurricanes. In October 2022, we had Hurricane Ian devastate Florida. To prepare for natural disasters like hurricanes, organizations are encouraged to build out and test business continuity, disaster recovery, and crisis management plans to use in the response efforts. Millions of dollars each year are spent on natural disaster preparation, but natural disasters are not the only disruption businesses face. While we can’t equate the…

Charles Henderson’s Cybersecurity Awareness Month Content Roundup

In some parts of the world during October, we have Halloween, which conjures the specter of imagined monsters lurking in the dark. Simultaneously, October is Cybersecurity Awareness Month, which evokes the specter of threats lurking behind our screens. Bombarded with horror stories about data breaches, ransomware, and malware, everyone’s suddenly in the latest cybersecurity trends and data, and the intricacies of their organization’s incident response plan. What does all this fear and uncertainty stem from? It’s the unknowns. Who might…