Active Sensors

Now that your network is segmented, you need to actively monitor to detect suspicious activities and threats, and take actions based on that. Your security posture won't be fully completed if you don't have a good detection system; this means having the right sensors distributed across the network, monitoring the activities. The Blue Team should take advantage of modern detection technologies that create a profile of the user and computer, in order to better understand anomalies and deviations in normal operations. With this information, preventative actions could be taken.

In this chapter, we are going to cover the following topics:

• Detection capabilities
• Intrusion detection systems
• Intrusion prevention systems
• Behavior analytics on-premises
• Behavior analytics in a hybrid cloud

Detection capabilities

Since the current threat landscape is very dynamic and it changes rapidly, it requires detection systems that can quickly adjust to new attacks. The traditional detection systems that rely in manual fine-tuning of initial rules, fixed thresholds, and fixed baselines will most likely trigger too many false positives, and that's not sustainable for many organizations nowadays. When preparing to defend against attackers, the Blue Team must leverage a series of techniques that include:

• Data correlation from multiple data sources
• Profiling
• Behavior analytics
• Anomaly detection
• Activity evaluation
• Machine learning

It is important to emphasize that some of the traditional security controls, such as protocol analysis and signature-based anti-malware, still have their place in the line of defense, but primarily to combat legacy threats. You shouldn't uninstall your anti-malware software just because it doesn't have any...

Intrusion detection systems

As the name implies, an intrusion detection system (IDS) is responsible for detecting a potential intrusion and triggering an alert. What can be done with this alert depends on the IDS policy. When creating an IDS policy you need to answer the following questions:

• Who should be monitoring the IDS?
• Who should have administrative access to the IDS?
• How will incidents be handled based on the alerts generated by the IDS?
• What's the IDS update policy?
• Where should we install the IDS?

These are just some examples of initial questions that should help in planning the IDS adoption. When searching for IDS, you can also consult a list of vendors at ICSA Labs Certified Products (www.icsalabs.com) for more vendor-specific information. Regardless of the brand, a typical IDS has the capabilities shown in the following diagram:

Figure 4: Typical IDS capabilities, visualized

While these are some core capabilities, the amount...

Intrusion prevention system

An intrusion prevention system (IPS) uses the same concept of an IDS, but, as the name says, it prevents the intrusion by taking a corrective action. This action will be customized by the IPS administrator in partnership with the Blue Team.

The same way IDS is available for hosts (HIDS) and network (NIDS), IPS is also available for both as HIPS and NIPS. The NIPS placement within your network is critical and the same guidelines that were previously mentioned are applicable here. You should also consider placing the NIPS inline with traffic in order to be able to take corrective action. IPS and IDS detections can usually operate in one or more of the following modes:

• Rule-based
• Anomaly-based

Rule-based detection

While operating this mode, the IPS will compare the traffic with a set of rules and try to verify whether the traffic matches the rule. This is very useful when you need to deploy a new rule to block an attempt to exploit...

Behavior analytics on-premises

For the vast majority of the companies currently in the market, the core of the business is still based on-premises. There is where the critical data is located, the majority of the users are working, and the key assets are located. As you know, we covered attack strategies in the first part of this book; the attacker tends to silently infiltrate your on-premises network, move laterally, escalate privilege, and maintain connectivity with command and control until able to execute their mission. For this reason, having behavior analytics on-premises is imperative to quickly break the attack kill chain.

According to Gartner, it is foundational to understand how users behave, and by tracking legitimate processes organizations can enlist user and entity behavior analytics (UEBA) to spot security breaches. There are many advantages in using a UEBA to detect attacks, but one of the most important ones is the capability to detect attacks in the early stages...

Behavior analytics in a hybrid cloud

When the Blue Team needs to create countermeasures to secure a hybrid environment, the team needs to expand their view of the current threat landscape and perform an assessment in order to validate continuous connectivity with the cloud and check the impact on overall security posture. In a hybrid cloud, most companies will opt to use an IaaS model and, although IaaS adoption is growing, the security aspect of it is still the main concern, according to an Oracle report on IaaS adoption.

According to the same report, longer-term IaaS users suggest the technology ultimately makes a positive impact on security. In reality, it does have a positive impact and that's where the Blue Team should focus their efforts on improving their overall detection. The intent is to leverage hybrid cloud capabilities to benefit the overall security posture. The first step is to establish a good partnership with your cloud provider and understand what security...

Summary

In this chapter, you learned about the different types of detection mechanisms and the advantages of using them to enhance your defense strategy. You learned about the indications of compromise and how to query current threats. You also learned about IDS, how it works, the different types of IDS, and the best location to install IDS based on your network. Next, you learned about the benefits of using an IPS, and how rule-based and anomaly-based detection works. An effective defense strategy wouldn't be complete without good behavior analytics and, in this section, you learned how the Blue Team can benefit from this capability. Microsoft ATA was used as the on-premises example for this implementation and Azure Security Center was used as the hybrid solution for behavior analytics.

In the next chapter, we will continue talking about defense strategies; this time, you will learn more about threat intelligence and how the Blue Team can take advantage of threat intel to...

References

1. Snort Rules Explanation: https://www.snort.org/rules_explanation.
2. Introduction to IoC: http://openioc.org/resources/An_Introduction_to_OpenIOC.pdf.
3. IoC Editor: https://www.fireeye.com/content/dam/fireeye-www/services/freeware/sdl-ioc-editor.zip.
4. DUQU Uses STUXNET-Like Techniques to Conduct Information Theft: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/90/duqu-uses-stuxnetlike-techniques-to-conductinformation-theft.
5. How to Select a Network Intrusion Prevention System (IPS): https://www.icsalabs.com/sites/default/files/HowToSelectANetworkIPS.pdf.
6. Detect Security Breaches Early by Analyzing Behavior: https://www.gartner.com/smarterwithgartner/detect-security-breaches-earlyby-analyzing-behavior/.
7. Advanced Threat Analytics attack simulation playbook: https://docs.microsoft.com/en-us/enterprise-mobility-security/solutions/ataattack-simulation-playbook.
8. You and IaaS - Learning from the success of early adopters...