Download as PDF, PPTX
Left of Boom-Shift Left in Security
- 1. Left of Boom Detectand Stop Attack Before the Boom !!
- 2. Prologue • Attacker getsaccess to CT, MRI scans image and modifies to add and remove evidences of pathology such as cancer • Adversary attacks API exposed to internet in UAT environment to retrieve access credentials to get access to sensitive data • Adversary discover forgotten database open to internet to steal sensitive information • Ransomware group gets admin access using vulnerable sensitive service, moves laterally and encrypts important data leading to system shutdown • Adversary gets open access to admin panel, uses default admin password to get access to edge device pivoting which performs lateral movement inside the network • So what is common in them?
- 3. 🡨 of Boom Racingagainst an Adversary Arnab Chattopadhayay Co-founder, FireCompass
- 4. “Left of Boom”is a common military phrase used to describe the timeline of events before an explosion or incident – a period when you still have a chance to prepare and avert a crisis. The phrase "left of boom" is a military idiom that refers the U.S. military's effort to disrupt insurgent cells before they can build and plant bombs
- 5. Left of Boomin the context of Cyber At its core, “boom” is an unwanted, bad event for the defender — the initial contact from the offender. “Left of boom” is the set of events that occur in the timeline before the boom and “right of boom” is the set of events that follows. If we applied this to the cyber domain, Left of Boom would refer to those proactive initiatives and actions that are designed to prevent/preempt (or minimize risk associated with) an adverse cyber event
- 6. Left of Boomfrom an Adversary Perspective Adversaries have also taken a liking for this strategic paradigm So how to adversaries use this strategy? • Adversarial decision making • Speed • Improvement in capabilities Let's see a few examples
- 7. Left of BoomInfluences adversary decision making Search for exposed Dev/UAT environment and Exploit Target not protected like production Late detection - bigger RoB Attacker triggers the event at the perimeter to gain access Small LoB, less opportunity to take action Search for Open RDP port, Exploit and get admin access Misconfiguration of sensitive service Small LoB, gets admin access by compromising one protocol Very little time difference between finding open sensitive service and triggering attack Small LoB, less opportunity to take action Steal sensitive data by Exploiting Open DB port exposed on Internet (for a small amount of time) Unknown Assets left exposed Attackers continuously monitoring for opportunity and acted fast Even though the exposure was for limited time, it was an unknown exposure Small LoB helped attacker to complete the attack before defender's action Open ssh port on Cloud VM allowing attacker to scrape information Open Cloud Bucket exposes API Keys Open SMB Port allows access to Windows network
- 8. Speed: First perspective Anadversary will most likely choose a collection of TTPs that enables the adversary to achieve its objective faster than a defender can detect and respond Boom, again, is the first contact in the set of tactics used on the target, and the remaining tactics within the set happen “right of boom” but prior to containment and eradication). Typically, speed and stealth are mutually exclusive, but sometimes, going fast is worth the loss of stealth.
- 9. Speed: Another perspective If the adversary’smission is not a single objective, but rather a sustained set of repeated attacks to achieve multiple objectives, then speed as a means of being faster “right of boom” than the defender may be a worthwhile strategy from the adversaries’ perspective However, the defender can then use the first successful objective as a “left of boom” input into future adversary to remediate vulnerabilities and introduce new detection controls making any future runs much, much more difficult without a high-cost imposition on the adversary.
- 10. Attacker Empathy Whether one isan attacker or defender, thinking in terms of timelines “left” or “right” of “boom” will improve capability, as well as the ability to reason about an opponentʼs capability and intent. We call this ability “attacker empathy”
- 11. In summary • Thinkand Act like an attacker • Continuous monitoring to discover new assets and changes in existing ones • Continuous testing - focus on Initial Access points - stop attacker before Boom !! • Emulate Adversaries • Scale testing to Internet scale • Adversaries will and do use the exact same paradigm to determine their own strategies • It is therefore key to exercise attacker empathy in general in the spirit of “Active Defense”