White Paper Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies www.invincea.com Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies Contents Executive Summary ...................................................................................................................................... 3 1. Know Your Adversary: Adversarial Modeling ...................................................................................... 4 1.1 Adversary Type (AT) ...................................................................................................................... 5 1.2 Campaign Objective (CO) .............................................................................................................. 5 1.3 Campaign Vehicle (CV) .................................................................................................................. 5 1.4 Campaign Weapon (CW) ............................................................................................................... 6 1.5 Payload Delivery (PD) .................................................................................................................... 6 1.6 Payload Capabilities (PC) ............................................................................................................... 6 2. Enterprise Security Modeling ............................................................................................................... 7 2.1 Perimeter Network Defenses ........................................................................................................ 8 2.2 Endpoint Defenses ........................................................................................................................ 8 2.3 Response and Recovery ................................................................................................................ 8 3. Adversarial Playbooks ........................................................................................................................ 10 3.1 Developing an Adversarial Playbook ........................................................................................... 10 3.1.1 Adversarial Playbook Template ............................................................................................. 10 4. Defensive Playbooks .......................................................................................................................... 11 5. Let’s Play a Game ................................................................................................................................ 13 5.1 Game 1: Miscreant Hacker vs. Home User ................................................................................. 15 5.2 Game 2: Nation-State Intelligence Agency vs. Mid-Size Federal Agency ................................... 16 6. Conclusions ........................................................................................................................................ 19 7. Appendix ............................................................................................................................................ 20 7.1 Adversary Playbooks ................................................................................................................... 20 7.2 Defense Playbooks ...................................................................................................................... 22 © Copyright 2015 Invincea, Inc. All rights reserved. 2 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies Executive Summary Cybersecurity continues to grow as one of the hottest markets to invest in today, but remains one of the most misunderstood fields in information technology. The relentless headline- grabbing data breaches are causing unprecedented spending in cybersecurity technologies and people, which in turn is driving more new companies and investment in cybersecurity, launching ever more new products. Lost in the mix of new technologies, approaches, and remarkably similar marketing is the engineering, science, and art in designing an enterprise security architecture that can withstand attacks from advanced adversaries. To design an effective security architecture, you must first model your adversary and their tactics. For instance, if you design a castle and moat to keep out raiding barbarians, but do not realize the barbarians have canons that can breach castle walls from afar, then your architecture is wholly ineffective against the threat you face. Previous attempts to model adversaries and enterprise defenses have been useful at a fairly abstract level. However, none developed adversarial playbooks that can be tested against defensive playbooks. We believe this missing element is crucial to understanding the range of adversary attacks that a given defensive posture will likely withstand, and those to which it – and the enterprise more broadly – remains unprotected. In this paper, we present a reference adversarial model and sample playbooks used in adversarial campaigns. We also develop a defense model and defensive playbooks representative of different sized organizations. The model is extensible to accommodate new adversarial tactics as they evolve with time. Likewise, the defense model and playbooks are configurable to enable specific scenarios and gaming against different adversarial playbooks. Just as importantly, we recommend the consideration of cost in the model. This enables realistic defense modeling by allowing participants to gauge the impact of trading one technology or product for another, given budget constraints. The goal of this paper is to provide a rational basis for architecting enterprise defenses to optimize protection against the most likely adversarial campaigns. By modeling adversarial playbooks and analyzing the coverage provided by various defense architectures, an enterprise security team can develop a clear understanding of the protection and gaps of each security architecture. The models included are configurable and extensible to match evolving threats and defensive postures. A companion website with a modeling and simulation tool is being developed to allow real-time configuration and simulation of attack playbooks, to estimate how well each architecture would withstand various attack scenarios. © Copyright 2015 Invincea, Inc. All rights reserved. 3 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies 1. Know Your Adversary: Adversarial Modeling Many threat intelligence firms proudly announce campaigns they have detected against unwitting targets with colorful names ranging from pandas and kittens to unintelligible monikers. Other firms have simply numbered them. Lost in this mix of cute adversary names and logos and the embellished marketing surrounding these campaigns is the vital question of whether a given adversary poses a real risk to your organization. Therefore, it is critical to “know thy enemy” in order to properly architect and manage one’s defenses. For instance, if you are a small business and have little of value to a nation-state adversary, it probably does not make sense to invest in technologies and people to defend against such actors. Likewise, if you hold dossiers on all federal employees and contractors with security clearances, you should invest in advanced threat protection technologies, people, and processes at a level commensurate with the threat and the consequence of losing such data. If your defenses don’t reflect your adversary’s objectives, budget, and tactics, you will probably suffer a material data breach at some point. Several attempts at adversarial modeling are notable, including the Lockheed Martin Cyber Kill Chain (see below); Mandiant’s version (a minor variation of the Lockheed Martin model); DoD Joint Publication 3-13, 2006; and MITRE’s ATT&CK Matrix. Recon & Internal Lateral Stage & Delivery Exploitation C2 Persistence Prep Recon Movement Action Figure 1: Lockheed Martin Cyber Kill Chain The Cyber Kill Chain is useful for modeling a particular type of adversary – advanced persistent threat actors – and their campaign stages. The Kill Chain by itself is incomplete, however, and insufficient for engineering a defense strategy. It lacks detail regarding the adversary itself, and the adversary’s objectives, tactics and techniques. Putting these together, we can begin to construct adversarial playbooks, which can be used to test defense strategies. Adversary Model We present here an adversary model with the following attributes: • Adversary Type (AT) © Copyright 2015 Invincea, Inc. All rights reserved. 4 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies • Campaign Objective (CO) • Campaign Vehicle (CV) • Campaign Weapon (CW) • Payload Delivery (PD) • Payload Capabilities (PC) Each attribute is populated below with examples. The model is extensible as adversaries and their objectives and tactics evolve. 1.1 Adversary Type (AT) Select one: 1. Script kiddy 2. Hacktivist, hacking collectives 3. Insider threat 4. Cyber terrorist 5. Commercial hacking (for theft of IP, customer data, etc.) 6. Cyber-crime 7. Nation-state intelligence agency 8. Nation-state cyber warfare 1.2 Campaign Objective (CO) Select one or more: 1. Account take-over 2. Botnet farming 3. Identify fraud 4. Data control for extortion 5. Wire fraud 6. DDOS 7. Click-fraud 8. Data record theft 9. Intellectual property theft 10. Intelligence collection 11. Data munging 12. Data destruction 13. System destruction 14. Corporate shaming/political agenda 1.3 Campaign Vehicle (CV) Select one: 1. Spear-phish with link/attachment 2. Compromised legitimate website 3. Malicious website 4. Malvertising 5. Social engineering © Copyright 2015 Invincea, Inc. All rights reserved. 5 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies 6. Insider threat 7. Remote login 8. Physical media (USB/DVD) 9. Supply chain 1.4 Campaign Weapon (CW) Select one or more: 1. IE, Firefox, Chrome exploit 2. Adobe Flash exploit 3. Oracle Java exploit 4. Microsoft Silverlight exploit 5. Microsoft Office macro 6. Adobe Reader exploit 7. User-installed malware 8. Socially engineered remote access 1.5 Payload Delivery (PD) Select one or more: 1. Executable file – pre-assembled 2. Executable file – just-in-time assembly on-host 3. Process hijacking/ROP 4. Scripting 5. DLL injection/side-loading 1.6 Payload Capabilities (PC) Select one or more: 1. Backdoor for remote access 2. Privilege escalation 3. Keystroke logging 4. Screen capture 5. Browser data munging 6. Ransomware 7. Adware, click-jacking 8. Network mapping 9. Lateral movement 10. Command and control 11. DDOS 12. Data discovery 13. Data archiving 14. Data exfiltration 15. Data corruption 16. Data destruction 17. System wiping 18. Patching known vulnerabilities © Copyright 2015 Invincea, Inc. All rights reserved. 6 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies 2. Enterprise Security Modeling Now that we have an understanding of adversary types and tactics, we can model enterprise defenses. The NIST Cyber Security Framework (CSF) shown in Figure 2 is rapidly gaining acceptance within both the federal and commercial segments. Figure 2: NIST Cyber Security Framework The NIST CSF is a way of thinking about defense activities. Like the Cyber Kill Chain, it is a broad model on which to organize defense strategies. However, it does not provide guidance for enterprise security architectures. The framework also lacks any view of adversaries or adversarial playbooks. In other words, the model is built at a higher level and does not address the adversary model. Since our goal is to realistically model a defense architecture against the attacks that enterprises are likely to experience, we represent enterprise architectures at a level of detail that is useful for simulating against adversarial playbooks. © Copyright 2015 Invincea, Inc. All rights reserved. 7 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies We define an enterprise security architecture in three primary categories: • Perimeter network defenses • Endpoint defenses • Response and recovery The perimeter and endpoint defenses are designed to detect and rapidly stop threats, while response and recovery is intended to respond to compromises. Enterprise Security Architecture 2.1 Perimeter Network Defenses 1. Firewall, router (standard and next-generation) 2. Web proxy, data loss prevention filtering 3. Network intrusion detection (IDS) or prevention (IPS) system 4. Network sandbox 5. Email security 6. Log aggregation, log analysis, SIEM 7. Command and control monitoring 8. Threat intelligence, threat aggregation 2.2 Endpoint Defenses 1. Asset discovery, patch management & configuration 2. Anti-virus (standard and next-generation) 3. White-listing, application control, system integrity monitoring 4. Containerization 5. Multi-factor authentication, PIV/CAC authorization 6. Data/disk encryption 7. Privilege management 8. Secure remote access/VPN 9. Anomaly detection / behavioral monitoring 10. Data loss prevention 2.3 Response and Recovery 1. SOC response orchestration 2. Endpoint breach query & confirmation 3. Endpoint quarantine 4. Endpoint forensics collection 5. Malware analysis 6. Endpoint re-image, remediate 7. Endpoint back-up restoration In Figure 3, we map this enterprise security architecture to the NIST Cyber Security Framework (CSF). In addition, we provide example of vendors in each architecture category. © Copyright 2015 Invincea, Inc. All rights reserved. 8 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies NIST Cyber Security Framework Enterprise Defense Controls Product Vendors 1 Perimeter Network Defenses 1.1 Firewall, Router 1.1.1 - Standard Cisco, Check Point, Sophos, Intel McAfee Protect 1.1.2 - Next Generation Palo Alto Networks 1.2 Web Proxy Filtering, DLP Blue Coat, Websense, Zscaler, Vontu 1.3 Network IDS Cisco Sourcefire 1.4 Network Sandbox FireEye, Palo Alto, LastLine, Cyphort, McAfee 1.5 Email Gateway Security ProofPoint Detect 1.6 Log Aggregation, SIEM, Log Analysis HP ArcSight, IBM QRadar, LogRhythm, Splunk 1.7 Command and Control Monitoring Damballa, FireEye 1.8 Threat Intelligence, Threat Aggregation iSIGHT Partners, ThreatStream 2 Endpoint Security Defenses Identify 2.1 Asset Discovery, Patch Management, Configuration Microsoft, IBM BigFix, Symantec Altiris, Tanium 2.2 Anti-virus 2.2.1 - Standard AV (signature-based) Symantec, McAfee, Trend Micro, Sophos 2.2.2 - Next Generation AV (machine learning) Cylance 2.3 White-listing, App Control, Integrity Monitoring Bit9, Microsoft, Tripwire Protect 2.4 Containerization Invincea, Bromium 2.5 Multi-factor Authentication, PIV/CAC RSA, CA, Symantec 2.6 Data/disk Encryption Intel McAfee, Symantec, Sophos 2.7 Privilege Management 2.8 Secure Remote Access/VPN Cisco, RSA 2.9 Process Monitoring/Anomaly Detection Invincea, CrowdStrike, Cybereason, Detect CounterTack, Microsoft EMET, Palo Alto TRAPS 2.10 Data Loss Prevention Vontu, Digital Guardian 3. Response and Recovery 3.1 SOC Response Orchestration CSG Invotas 3.2 Endpoint Breach Query & Confirmation FireEye Mandiant, Tanium Respond 3.3 Endpoint Quarantine/Isolation Invincea, FireEye Mandiant 3.4 Endpoint Forensics Collection RSA ECAT, Carbon Black, Guidant, EnCase 3.5 Malware Analysis Invincea, EnCase, Cisco ThreatGrid, Cuckoo 3.6 Endpoint Re-imaging, Remediation Ghost, Tanium Recover 3.7 Endpoint Data & System Restoration Code42 Figure 3: Enterprise Security Architecture with NIST CSF Mapping The enterprise security architecture model is extensible to other controls, with the listed product vendors being a representative set, not a complete list. By considering cost as well, enterprises can begin to optimize defenses against threats given a specific annual budget. Since a single enterprise architecture will not apply to all enterprises, we define four target types (TT): 1. Individual / home 2. Small business / federal agency / military base 3. Mid-size business / federal agency / military command 4. Large business / federal department / military service These are organized roughly by the resources each organization type can commit to defenses. © Copyright 2015 Invincea, Inc. All rights reserved. 9 Know Your Adversary: An Adversary Model for Mastering Cyber-Defense Strategies 3. Adversarial Playbooks Now that we have defined adversarial and defensive security models, we can construct adversarial playbooks to “run” against defensive playbooks. Adversaries have inherent advantages over defenders, given their broader freedom to operate. Adversaries can choose the target, the timing of their attack, and the range of tactics used in a particular campaign. Defenders, on the other hand, typically do not know who will attack, when, or what tactics are likely to be used against them. Most notably, while the adversary can be extremely agile in picking targets and methods, the defender must operate with a largely fixed infrastructure based on prior years’ cybersecurity investments and current corporate/IT policies. 3.1 Developing an Adversarial Playbook When launching a campaign, the threat actor uses an adversarial playbook, whether formal and explicit, or a learned method that has been practiced over time. These playbooks are likely to change based on objective and target. 3.1.1 Adversarial Playbook Template We define an adversarial playbook with the following information: 1. Adversary type 2. Target (organization) type 3. Campaign objective 4. Campaign vehicle 5. Campaign weapon 6. Payload delivery 7. Payload capabilities Figure 4 shows an example playbook that a nation-state intelligence agency might run in a campaign against a mid-size federal agency. © Copyright 2015 Invincea, Inc. All rights reserved. 10