Reverse Deception: Organized Cyber Threat Counter-Exploitation (33 page)

Knowledge of the operating system

Grasp of commands, options, and arguments

Whether the attack is organized or disorganized, which helps build a clearer picture of the intent and motive

Whether or not the attack is scripted

Your security team can measure and observe these pieces of information by analyzing the utilization of each compromised system by the threat. This specific component of information will tell you a lot about your threat.

Skills and Methods

When observing attackers’ skills and methods, you are also weighing the victimology and attack origination in combination. Why do we do it this way? Well, there is an easy answer for that one: injection and propagation techniques.

The skills of each attacker will vary, and the more skill shown, the more attention should be paid. Also, if you see a single threat using a lot of skills and techniques that infers more than a single individual is behind the observed events.

Having the ability to observe the skills and methods of each threat is critical. This requires a blend of traditional host-based and enterprise-based security solutions that provide the ability to see not only what occurred on the host, but also what happened over the network. How were they able to get into your network, get out, and then maintain persistence?

The following information needs to be weighed when evaluating a threat’s skills and methods:

Attack (the exploitation and remote control of your enterprise systems)

The vulnerability/exploit and its disclosure history (was this a known exploit?)

The methodology, signature, content, and patterns (is this a known threat that has attempted to exploit or exploited your enterprise before, or is there a specific pattern surrounding the attack that would help attribute the threat to a specific individual or group?)

Tools used

Utilization of access (how did the threat use each system?)

Data transfer technique

Logging alteration or deletion technique