Intelligence-Driven Incident Response: Outwitting the Adversary

282 Pages·2017·7.56 MB·English

by  Scott J. Roberts

Intelligence-
Driven Incident
Response
OUTWITTING THE ADVERSARY
Scott J. Roberts & Rebekah Brown

Intelligence-Driven
Incident Response
Outwitting the Adversary
Scott J. Roberts and Rebekah Brown
BBeeiijjiinngg BBoossttoonn FFaarrnnhhaamm SSeebbaassttooppooll TTookkyyoo
Intelligence-Driven Incident Response
by Scott J Roberts and Rebekah Brown
Copyright © 2017 Scott J. Roberts and Rebekah Brown. All rights reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.
O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are
also available for most titles (http://oreilly.com/safari). For more information, contact our corporate/insti‐
tutional sales department: 800-998-9938 or [email protected].
Editors: Courtney Allen and Virginia Wilson Indexer: Judith McConville
Production Editor: Shiny Kalapurakkel Interior Designer: David Futato
Copyeditor: Sharon Wilkey Cover Designer: Karen Montgomery
Proofreader: Amanda Kersey Illustrator: Rebecca Demarest
August 2017: First Edition
Revision History for the First Edition
2017-08-21: First Release
The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Intelligence-Driven Incident Response,
the cover image, and related trade dress are trademarks of O’Reilly Media, Inc.
While the publisher and the authors have used good faith efforts to ensure that the information and
instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility
for errors or omissions, including without limitation responsibility for damages resulting from the use of
or reliance on this work. Use of the information and instructions contained in this work is at your own
risk. If any code samples or other technology this work contains or describes is subject to open source
licenses or the intellectual property rights of others, it is your responsibility to ensure that your use
thereof complies with such licenses and/or rights.
978-1-491-93494-4
[LSI]
Table of Contents
Foreword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Part I. The Fundamentals
1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Intelligence as Part of Incident Response 1
History of Cyber Threat Intelligence 1
Modern Cyber Threat Intelligence 2
The Way Forward 3
Incident Response as a Part of Intelligence 4
What Is Intelligence-Driven Incident Response? 5
Why Intelligence-Driven Incident Response? 5
Operation SMN 5
Operation Aurora 6
Conclusion 7
2. Basics of Intelligence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Data Versus Intelligence 10
Sources and Methods 11
Process Models 14
OODA 14
Intelligence Cycle 17
Using the Intelligence Cycle 21
Qualities of Good Intelligence 23
Levels of Intelligence 24
iii
Tactical Intelligence 24
Operational Intelligence 24
Strategic Intelligence 25
Confidence Levels 25
Conclusion 26
3. Basics of Incident Response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Incident-Response Cycle 28
Preparation 28
Identification 30
Containment 30
Eradication 31
Recovery 32
Lessons Learned 33
Kill Chain 34
Targeting 36
Reconnaissance 36
Weaponization 38
Delivery 42
Exploitation 43
Installation 43
Command and Control 44
Actions on Objective 45
Example Kill Chain 47
Diamond Model 48
Basic Model 49
Extending the Model 50
Active Defense 50
Deny 51
Disrupt 51
Degrade 51
Deceive 52
Destroy 52
F3EAD 52
Find 53
Fix 54
Finish 54
Exploit 54
Analyze 55
Disseminate 55
Using F3EAD 56
Picking the Right Model 56
iv | Table of Contents
Scenario: GLASS WIZARD 57
Conclusion 57
Part II. Practical Application
4. Find. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Actor-Centric Targeting 62
Starting with Known Information 63
Useful Find Information 64
Asset-Centric Targeting 70
Using Asset-Centric Targeting 71
News-Centric Targeting 71
Targeting Based on Third-Party Notification 72
Prioritizing Targeting 73
Immediate Needs 74
Past Incidents 74
Criticality 74
Organizing Targeting Activities 75
Hard Leads 75
Soft Leads 75
Grouping Related Leads 75
Lead Storage 76
The Request for Information Process 77
Conclusion 77
5. Fix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Intrusion Detection 80
Network Alerting 80
System Alerting 85
Fixing GLASS WIZARD 87
Intrusion Investigation 89
Network Analysis 89
Live Response 95
Memory Analysis 96
Disk Analysis 97
Malware Analysis 98
Scoping 101
Hunting 102
Developing Leads 102
Testing Leads 102
Conclusion 103
Table of Contents | v
6. Finish. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Finishing Is Not Hacking Back 105
Stages of Finish 106
Mitigate 107
Remediate 109
Rearchitect 112
Taking Action 113
Deny 113
Disrupt 114
Degrade 115
Deceive 115
Destroy 116
Organizing Incident Data 116
Tools for Tracking Actions 117
Purpose-Built Tools 119
Assessing the Damage 120
Monitoring Life Cycle 121
Conclusion 122
7. Exploit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
What to Exploit? 124
Gathering Information 125
Storing Threat Information 126
Data Standards and Formats for Indicators 126
Data Standards and Formats for Strategic Information 130
Managing Information 132
Threat-Intelligence Platforms 133
Conclusion 135
8. Analyze. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
The Fundamentals of Analysis 137
What to Analyze? 139
Conducting the Analysis 141
Enriching Your Data 142
Developing Your Hypothesis 146
Evaluating Key Assumptions 147
Judgment and Conclusions 150
Analytic Processes and Methods 150
Structured Analysis 151
Target-Centric Analysis 153
Analysis of Competing Hypotheses 155
Graph Analysis 157
vi | Table of Contents
Contrarian Techniques 158
Conclusion 160
9. Disseminate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Intelligence Consumer Goals 162
Audience 162
Executive/Leadership Consumer 163
Internal Technical Consumers 165
External Technical Consumers 167
Developing Consumer Personas 168
Authors 171
Actionability 172
The Writing Process 174
Plan 174
Draft 174
Edit 176
Intelligence Product Formats 178
Short-Form Products 178
Long-Form Products 182
The RFI Process 191
Automated Consumption Products 195
Establishing a Rhythm 199
Distribution 200
Feedback 200
Regular Products 201
Conclusion 202
Part III. The Way Forward
10. Strategic Intelligence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
What Is Strategic Intelligence? 206
Developing Target Models 207
The Strategic Intelligence Cycle 210
Setting Strategic Requirements 210
Collection 211
Analysis 214
Dissemination 218
Conclusion 218
11. Building an Intelligence Program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Are You Ready? 221
Table of Contents | vii
Planning the Program 223
Defining Stakeholders 224
Defining Goals 225
Defining Success Criteria 226
Identifying Requirements and Constraints 226
Defining Metrics 228
Stakeholder Personas 228
Tactical Use Cases 229
SOC Support 230
Indicator Management 230
Operational Use Cases 232
Campaign Tracking 232
Strategic Use Cases 233
Architecture Support 233
Risk Assessment/Strategic Situational Awareness 234
Strategic to Tactical or Tactical to Strategic? 235
Hiring an Intelligence Team 236
Demonstrating Intelligence Program Value 236
Conclusion 237
A. Intelligence Products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
viii | Table of Contents