CIRT-Level Response to Advanced Persistent Threat Richard Bejtlich

Transcription

1 CIRT-Level Respnse t Advanced Persistent Threat Richard Bejtlich (richard@tasecurity.cm) I. Assumptins Yu have discvered, r learned frm an external party, that yur rganizatin is an Advanced Persistent Threat (APT) victim. Call the time f discvery D-Zer. Yu care. Yu take cmprmise persnally. At least sme thers in yur rganizatin d t, r can be cnvinced t care. Yu are at least hpeful that yur rganizatin can take steps t defend itself. II. Critical Themes Preventin eventually fails. (I cined this phrase in 2004 when I published The Ta f Netwrk Security Mnitring. This is nt a cincidence!) Persistent threats are named as such because they either Maintain their presence in the victim rganizatin r Repeatedly seek t regain that presence Therefre, winning against APT des nt mean preventing cmprmise. Rather, winning means: Increasing the cst the adversary must pay fr each MB stlen (credit: Tny Sager, NSA) Predicting the adversary s next mve (credit: Kevin Mandia, MANDIANT) Tracking the adversary as he changes tls, tactics, and prcedures Intrusin suppressin is ne way t describe cunter-apt peratins (credit: Rbert Runsavall frm Terremark) III. Recent qutes n APT by Kris Harms frm Mandiant (FIRST 2010 cnference) Cmpliance is the flr upn which yu re ging t fall when yu get hacked. Tday a B [grade] is nt gd enugh. D nt get in a battle ver knwledge f Windws with an intruder. Yu will lse. IV. During the first hur after D-Zer. Dcument everything. Write everything dwn, in a ntebk, because facts need t becme yur currency, nt beliefs. Change cmmunicatin patterns when discussing the incident. Dn t use . Dn t use VIP. Cnsider yur cmputing infrastructure untrustwrthy. Cmmunicate in persn r use cell phnes. Activate yur incident respnse plan. If yu dn t have ne, cntact a small grup f trusted representatives frm IT, security, legal, and ther grups yu feel shuld be invlved. Share what yu knw and institute strict infrmatin sharing plicies. 1

2 V. During the first day after D-Zer. Prvisin and cnfigure alternative cmputing infrastructure. Build yur wn IR laptp running an perating system yu trust and feel cnfident cnfiguring. Start with clean hardware and new media. Build the gear ff the rganizatin s netwrk. Develp trusted means f electrnic cmmunicatin amng IR members. Inventry the security and IT evidence at hand t determine what data surces yu pssess. The gal is t gather data that crrbrates r expands upn the indicatr(s) f cmprmise assciated with the initial APT discvery. VI. During the first week after D-Zer. Decide if yu need external help. Factrs which encurage enlisting experienced cnsultants include: Lack f staff in yur rganizatin Lack f leadership buy-in Lack f technical expertise in yur rganizatin Prvide an initial briefing t decisin makers. Key pints shuld include: Facts available -- dn t speculate! Rules f engagement t try t preserve peratinal security (OPSEC) Initial plan t address the APT incident, stressing that nce APT is fund, it s generally a prblem frever Analyze available evidence fr indicatrs f cmprmise. Begin deplyment f additinal data cllectin systems t imprve available evidence. Optins include: Deply netwrk security mnitring platfrms at key netwrk egress lcatins Deply lg frwarding and lg strage platfrms t cllect lgs frm critical cmputers Deply live respnse scripts t cllect key data frm suspected victims Selectively shut dwn and image hard drives frm suspected victims VII. During the first mnth after D-Zer. 1. Determine the scpe f the incident. Develp a victim list, identify stlen credentials, recgnize internal and external cmmunicatin methds, etc. 2. Evaluate the effectiveness f existing security instrumentatin and plan fr deplyment f imprved capabilities. 3. Plan a remediatin effrt. The fcus f the remediatin shuld be t, simultaneusly, cntain victims, change credentials, deny cmmunicatin, etc. Plan the effrt n equipment nt assciated with the victim rganizatin, r expect the plan t fall int adversary hands. Prepare leaders t accept that even a successful remediatin is likely t be nly the first battle in a prtracted campaign. VIII. During the first year after D-Zer. Evaluate the effectiveness f the IR capability. Plan t justify and then hire additinal persnnel, and prfessinalize the team. 2

3 Institutinalize cunter-apt activities within the rganizatin. Prvide threat briefings t senir leaders and gain supprt fr security initiatives. Develp and embed cunter-apt security imprvements int rganizatinal security prgrams and budgets. Using the lessns and data learned during the first few mnths f cunter-apt peratins, build plans based n facts, recgnized gaps, and expected imprvements. Cntact peer rganizatins t share tls, techniques, and prcedures. Expand the security instrumentatin prgram as team resurces allw. Begin hiring additinal staff as budgets permit. IX. During the secnd year after D-Zer. If ne des nt already exist, create a Red-Blue Team t cnduct adversary simulatin/replicatin exercises and vulnerability and expsure assessments. Identify rganizatinal weaknesses. Develp an internal security intelligence capability t lk beynd technical aspects f APT intrusins. Cntribute knwledge f cunter-apt activities t brader, trusted peers. Cntinue hiring additinal staff as budgets permit. X. Cntainment vs Hneynet: Aside frm selective shut dwn t cllect hard drive images (and live cllectin is als an ptin), fr new APT victim rganizatins, I d nt recmmend immediately discnnecting suspected victims frm the netwrk. Why? 1. Yu are unlikely t knw all f the victims at this stage in the incident respnse. Discnnecting the few victims yu knw fails t truly deny the adversary. 2. Discnnecting the few victims yu knw remves the main surce f intelligence n adversary activity. Discnnecting the few victims yu knw usually hampers IR team effrts t learn the scpe f the intrusin. 3. The adversary will definitely ntice when the rganizatin discnnects multiple victims frm the netwrk. This actin will likely prmpt the adversary t change tactics and further frustrate IR actins. S when d yu start discnnecting victims as plicy? Answer: when yu begin t meet yur winning criteria. 3

4 XI. Suggested CIRT Structure. I rganized GE-CIRT using the fllwing structure. XII. Suggested Hiring Pririties Figure 1. GE-CIRT Structure 1. Incident Handlers - subject matter experts wh will establish early credibility and cmpetency 2. Event Analysts - 24x7 cverage t supprt mre rutine wrk 3. Incident Analysts - assume the natural balance between IH and EA wrk 4. Supprt team - transfer design, build, and run activities frm the IRC t Supprt 5. Threat cell - prfile adversaries and prfessinalize reprting 6. Blue team - prvide cllabrative assessment assistance 7. Technical Assistance Grup - internal security cnsulting 8. Incident Crdinatr - quality cntrl fr IRC peratins 9. Red team - adversary replicatin and simulatin XIII. Headcunt Justificatin. In 2009 I surveyed peer CIRTs and cllected the fllwing data. Using the infrmatin belw I calculated that GE-CIRT required 134 team members t meet the average size f ur peers. I tld ur CIO that I wuld be happy t "drp the 1" and reach 34 peple. I presented a versin f the CIRT structure shwed earlier with numbers attached t each rle. Later when ur CIO, CTO, and CISO made the decisin t increase team size, they used my dcumentatin. 4

5 Figure 2. CIRT Staffing Survey XIV. Incident Cycle. Many rganizatins fcus mst f their security resurces n the tp half f the cycle, shwn in the fllwing figure. They devte resurces t planning and resisting, but d nt knw what t d when an incident ccurs. Alternatively, they adpt what I call a "vlunteer fire fighter" mdel. When they detect an incident, the security planners and resisters transitin frm their nrmal rles t that f incident respnder. When the incident is "ver," they transitin back. Unfrtunately, this mdel fails when 1) incidents never really end and 2) prfessinals are required t cmbat mdern threats. 5

6 XV. Recmmended APT Reading. Figure 3. Incident Cycle M-Unitin (MANDIANT blg): Mike Clppert (via SANS): 6