MA
Uploaded byMITRE ATT&CK
PDF, PPTX1,268 views

When Insiders ATT&CK!

The document discusses insider threats in organizations and how to utilize the MITRE ATT&CK framework to identify and mitigate them. It categorizes insider threats into types such as oblivious users, negligent users, and malicious insiders, highlighting the importance of understanding each profile to build intelligent detections. The document emphasizes the necessity of creating tailored insider threat programs, collaborating with legal and HR departments, and continuously testing detection methods.

Embed presentation

Download as PDF, PPTX
©2022 VMware, Inc. When Insiders ATT&CK!!! Matt Snyder Program Lead – Advanced Security Analytics March 2022
©2022 VMware, Inc. 2 Program Lead - Advanced Security Analytics • Over the past 17 years, I have been fortunate to work in a wide range of IT/Security positions; from systems admin, to digital forensics and incident response during one of the 1st major credit card breaches in 2013, and most recently security engineering. • In my current position at VMware, I work on the Security Intelligence & Response Team (SIRT), where I enjoy building advanced analytics and detections. Matt Snyder – VMware Speaker Introduction
©2022 VMware, Inc. Agenda 3 • Types of Insider Threats • How to use MITRE ATT&CK to identify key TTPs • How to use MITRE ATT&CK to build intelligent detections
4 ©2022 VMware, Inc. Everyone has an Insider Threat problem.
©2022 VMware, Inc. 5 Insider Threats are Evolving Is your company prepared? Source: https://www.code42.com/resources/report-2021-data-exposure Source: Hitachi ID shorturl.at/fwEFV
©2022 VMware, Inc. 6 Types of Insider Threats Knowing is half the battle… Well intentioned but makes poor decisions Knows better but still takes unacceptable risks Intentionally tries to cause harm/damage Is acting on behalf of a 3rd party Knowingly stores data in unapproved locations Oblivious User Negligent Malicious Saboteur/ Espionage Data Hoarder
7 ©2022 VMware, Inc. How to use MITRE ATT&CK to identify key TTPs
©2022 VMware, Inc. 8 Getting Started… Sometimes looks like this…
©2022 VMware, Inc. 9 We don’t have to start from scratch MITRE ATT&CK to the Rescue! With the MITRE ATT&CK framework, we have a comprehensive map of relevant TTPs we can choose from. Using news and threat intel reports, as well as previous incidents, we can begin to map TTPs of greatest concern.
©2022 VMware, Inc. 10 Data Exfiltration/Theft I’ll Take That… Here we focus on techniques related to the exfiltration of data from an Insider Threat. Threat Profiles: • Oblivious User • Negligent User • Data Hoarder • Saboteur/Espionage
©2022 VMware, Inc. 11 Data Exfiltration/Theft Cont. I’ll Take That… Insider Threats typically have access to data sources, so all they need to worry about is collecting and then exfiltrating that information.
©2022 VMware, Inc. 12 Rogue Employee Vengeance is Mine!! With a Rogue Insider, the possibilities are endless: - Data Exfiltration (possibly for extortion) - Business Impact/Cause Outages - Enable Persistence Threat Profiles: • Malicious User • Saboteur/Espionage
©2022 VMware, Inc. 13 Rogue Employee Cont. Vengeance is Mine!! A rogue employee might use numerous techniques so they can maintain persistence or cover their tracks. With a goal to carry out an attack against their employer, you may even see them try to emulate an APT group to conceal their involvement.
©2022 VMware, Inc. 14 Accident or Intentional? Ignorance is Bliss… They have no idea that what they are doing will have any impact or do they? Some examples: - Serial Phishing offender - Stores sensitive data everywhere -Leaks credentials on GitHub Threat Profiles: • Oblivious User • Negligent User • Saboteur/Espionage
©2022 VMware, Inc. 15 Accident or Intentional? Cont. Ignorance is Bliss… It can be complicated to determine the motive or reasoning behind these types of incidents. Accidents happen and people make mistakes. Completing a through investigation is key to determining the truth.
16 ©2022 VMware, Inc. How to use MITRE ATT&CK to build intelligent detections Reduce false positives without loosing visibility
©2022 VMware, Inc. 17 Intelligent Alerting DLP Type Case
©2022 VMware, Inc. 18 Intelligent Alerting Employee Gone Rogue
©2022 VMware, Inc. 19 Oops…. Oblivious User
©2022 VMware, Inc. 20 Follow the ATT&CK… One Alert to Rule them All!
©2022 VMware, Inc. 21 Test Your Detections! Don’t wait for an attacker, test today!! Here is a basic python script to help generate some canary files you can use to test out your detections. This example and more can be found here: https://github.com/m att-snyder- stuff/python_canary_ files
©2022 VMware, Inc. 22 • Minor deviations from normal activity • Has motive to carry out attack • Impacted items are directly related to their work • Absence of any indicators of compromise • Random activity not associated with user’s work • Activity algins with groups that target your industry • Activity is beyond the employee’s technical capabilities • Unusual Access Events Insider Threat APT or External Threat Insider Threat vs APT How can you tell them apart?
23 ©2022 VMware, Inc. Wrapping it Up
©2022 VMware, Inc. 24 • There are endless attack possibilities, you might not catch them all, but you won't catch any if you don’t get started, so get started. • Begin with use cases that are top of mind for your company. • Utilize the data you are already collecting. • With your custom Insider Threat matrix in hand, get the additional logs you need. • Team up with your Legal and HR departments, find out what is important to them. • Work with your business partners to better understand their concerns. • Have plan and workflow on how to support investigations and remediation efforts. Then test it (Live Fire, Tabletop, Round Table)! Lessons Learned Prioritize and Execute Work with the Business Follow the ATT&CK • Look for the patterns of risky behavior, this reduces false positives and wasted time. • You must build your own detections! DLP tools alone are NOT an Insider Threat program!
©2022 VMware, Inc. 25 • MITRE’s Insider Threat TTP Knowledge Base https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/ • Insider Threat Matrix https://github.com/Insider-Threat/Insider-Threat • National Insider Threat Task Force (NITTF) https://www.dni.gov/index.php/ncsc-how-we-work/ncsc-nittf • NITTF Maturity Framework https://www.dni.gov/files/NCSC/documents/nittf/20181024_NITTF_MaturityFramework_web.pdf • CISA https://www.cisa.gov/sites/default/files/publications/Insider%20Threat%20Mitigation%20Guide_Final_508.pdf • DNI https://www.dni.gov/files/NCSC/documents/nittf/NITTF-Insider-Threat-Guide-2017.pdf • Code42 Report https://www.code42.com/resources/report-2021-data-exposure • Hitachi ID Report https://www.hitachi- id.com/hubfs/A.%20Key%20Topic%20Collateral/Ransomware/%5BInfographic%5D%20The%20Rising%20Insider%20Threat%20%7C%20Hackers%20Have%20Approached%2 065%25%20of%20Executives%20or%20Their%20Employees%20To%20Assist%20in%20Ransomware%20Attacks. Additional Resources
Confidential │ ©2019 VMware, Inc. Thank You

More Related Content

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 

What's hot

PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PPTX
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
PDF
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PPTX
Threat hunting - Every day is hunting season
byBen Boyd
 
PDF
Threat Hunting with Splunk Hands-on
bySplunk
 
PDF
Purple Team Exercise Framework Workshop #PTEF
byJorge Orchilles
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Threat hunting - Every day is hunting season
byBen Boyd
 
Threat Hunting with Splunk Hands-on
bySplunk
 
Purple Team Exercise Framework Workshop #PTEF
byJorge Orchilles
 

Similar to When Insiders ATT&CK!

PPTX
MITRE ATT&CK framework
byBhushan Gurav
 
PPTX
Insider Threat
byAndy Thompson
 
PDF
Cyber security series advanced persistent threats
byJim Kaplan CIA CFE
 
PDF
Insider Threat Detection Recommendations
byAlienVault
 
PPTX
Insider threat v3
byLancope, Inc.
 
PPTX
Unintentional Insider Threat featuring Dr. Eric Cole
byDavid Mai, MBA
 
PPTX
Unintentional Insider Threat featuring Dr. Eric Cole
byDavid Mai, MBA
 
PPTX
Security Advisories - SOC - Finannl.pptx
bymettildauthayakumar
 
PPTX
Why Insider Threat is a C-Level Priority
byObserveIT
 
PPTX
Why Insider Threat is a C-Level Priority
byDavid Mai, MBA
 
PDF
Identify and Stop Insider Threats
byLancope, Inc.
 
PPTX
Enterprise-MITRE-ATTandCK-Threat-Hunting _ Updated.pptx
byBheemeshChowdary2
 
PPTX
ObserveIT - Unintentional Insider Threat featuring Dr. Eric Cole
byObserveIT
 
PPTX
Combating Insider Threats – Protecting Your Agency from the Inside Out
byLancope, Inc.
 
PDF
10 Tips to Strengthen Your Insider Threat Program
byDtex Systems
 
PDF
The Custom Defense Against Targeted Attacks
byTrend Micro
 
PPTX
Insider Threat Experiences
byNapier University
 
PDF
InsiderThreat-2016NDITS
byMike Saunders
 
PDF
5 Signs you have an Insider Threat
byLancope, Inc.
 
PPT
Accidental Insider
byBarry Caplin
 
MITRE ATT&CK framework
byBhushan Gurav
 
Insider Threat
byAndy Thompson
 
Cyber security series advanced persistent threats
byJim Kaplan CIA CFE
 
Insider Threat Detection Recommendations
byAlienVault
 
Insider threat v3
byLancope, Inc.
 
Unintentional Insider Threat featuring Dr. Eric Cole
byDavid Mai, MBA
 
Unintentional Insider Threat featuring Dr. Eric Cole
byDavid Mai, MBA
 
Security Advisories - SOC - Finannl.pptx
bymettildauthayakumar
 
Why Insider Threat is a C-Level Priority
byObserveIT
 
Why Insider Threat is a C-Level Priority
byDavid Mai, MBA
 
Identify and Stop Insider Threats
byLancope, Inc.
 
Enterprise-MITRE-ATTandCK-Threat-Hunting _ Updated.pptx
byBheemeshChowdary2
 
ObserveIT - Unintentional Insider Threat featuring Dr. Eric Cole
byObserveIT
 
Combating Insider Threats – Protecting Your Agency from the Inside Out
byLancope, Inc.
 
10 Tips to Strengthen Your Insider Threat Program
byDtex Systems
 
The Custom Defense Against Targeted Attacks
byTrend Micro
 
Insider Threat Experiences
byNapier University
 
InsiderThreat-2016NDITS
byMike Saunders
 
5 Signs you have an Insider Threat
byLancope, Inc.
 
Accidental Insider
byBarry Caplin
 

More from MITRE ATT&CK

PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 

Recently uploaded

PPTX
Building Cyber Resilience for 2026: Best Practices for a Secure, AI-Driven Bu...
byYasir Naveed Riaz
 
PPTX
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
PDF
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
PPTX
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
PDF
Day 3 - Data and Application Security - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
PDF
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
PDF
Data Virtualization in Action: Scaling APIs and Apps with FME
bySafe Software
 
PDF
DevFest El Jadida 2025 - Product Thinking
byElmehdi AMLOU
 
PDF
Security Forum Sessions from Houston 2025 Event
byMark Simos
 
PDF
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
PPTX
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
PPTX
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 
PPTX
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
PDF
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
PPTX
DYNAMICALLY.pptx good for the teachers or students to do seminars and for tea...
bympoorvika031
 
PDF
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
PDF
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
PDF
GPUS and How to Program Them by Manya Bansal
byScyllaDB
 
PDF
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
PPTX
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
Building Cyber Resilience for 2026: Best Practices for a Secure, AI-Driven Bu...
byYasir Naveed Riaz
 
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
Day 3 - Data and Application Security - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
Data Virtualization in Action: Scaling APIs and Apps with FME
bySafe Software
 
DevFest El Jadida 2025 - Product Thinking
byElmehdi AMLOU
 
Security Forum Sessions from Houston 2025 Event
byMark Simos
 
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
DYNAMICALLY.pptx good for the teachers or students to do seminars and for tea...
bympoorvika031
 
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
GPUS and How to Program Them by Manya Bansal
byScyllaDB
 
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 

When Insiders ATT&CK!

  • 1.
    ©2022 VMware, Inc. WhenInsiders ATT&CK!!! Matt Snyder Program Lead – Advanced Security Analytics March 2022
  • 2.
    ©2022 VMware, Inc.2 Program Lead - Advanced Security Analytics • Over the past 17 years, I have been fortunate to work in a wide range of IT/Security positions; from systems admin, to digital forensics and incident response during one of the 1st major credit card breaches in 2013, and most recently security engineering. • In my current position at VMware, I work on the Security Intelligence & Response Team (SIRT), where I enjoy building advanced analytics and detections. Matt Snyder – VMware Speaker Introduction
  • 3.
    ©2022 VMware, Inc. Agenda 3 •Types of Insider Threats • How to use MITRE ATT&CK to identify key TTPs • How to use MITRE ATT&CK to build intelligent detections
  • 4.
    4 ©2022 VMware, Inc. Everyonehas an Insider Threat problem.
  • 5.
    ©2022 VMware, Inc.5 Insider Threats are Evolving Is your company prepared? Source: https://www.code42.com/resources/report-2021-data-exposure Source: Hitachi ID shorturl.at/fwEFV
  • 6.
    ©2022 VMware, Inc.6 Types of Insider Threats Knowing is half the battle… Well intentioned but makes poor decisions Knows better but still takes unacceptable risks Intentionally tries to cause harm/damage Is acting on behalf of a 3rd party Knowingly stores data in unapproved locations Oblivious User Negligent Malicious Saboteur/ Espionage Data Hoarder
  • 7.
    7 ©2022 VMware, Inc. Howto use MITRE ATT&CK to identify key TTPs
  • 8.
    ©2022 VMware, Inc.8 Getting Started… Sometimes looks like this…
  • 9.
    ©2022 VMware, Inc.9 We don’t have to start from scratch MITRE ATT&CK to the Rescue! With the MITRE ATT&CK framework, we have a comprehensive map of relevant TTPs we can choose from. Using news and threat intel reports, as well as previous incidents, we can begin to map TTPs of greatest concern.
  • 10.
    ©2022 VMware, Inc.10 Data Exfiltration/Theft I’ll Take That… Here we focus on techniques related to the exfiltration of data from an Insider Threat. Threat Profiles: • Oblivious User • Negligent User • Data Hoarder • Saboteur/Espionage
  • 11.
    ©2022 VMware, Inc.11 Data Exfiltration/Theft Cont. I’ll Take That… Insider Threats typically have access to data sources, so all they need to worry about is collecting and then exfiltrating that information.
  • 12.
    ©2022 VMware, Inc.12 Rogue Employee Vengeance is Mine!! With a Rogue Insider, the possibilities are endless: - Data Exfiltration (possibly for extortion) - Business Impact/Cause Outages - Enable Persistence Threat Profiles: • Malicious User • Saboteur/Espionage
  • 13.
    ©2022 VMware, Inc.13 Rogue Employee Cont. Vengeance is Mine!! A rogue employee might use numerous techniques so they can maintain persistence or cover their tracks. With a goal to carry out an attack against their employer, you may even see them try to emulate an APT group to conceal their involvement.
  • 14.
    ©2022 VMware, Inc.14 Accident or Intentional? Ignorance is Bliss… They have no idea that what they are doing will have any impact or do they? Some examples: - Serial Phishing offender - Stores sensitive data everywhere -Leaks credentials on GitHub Threat Profiles: • Oblivious User • Negligent User • Saboteur/Espionage
  • 15.
    ©2022 VMware, Inc.15 Accident or Intentional? Cont. Ignorance is Bliss… It can be complicated to determine the motive or reasoning behind these types of incidents. Accidents happen and people make mistakes. Completing a through investigation is key to determining the truth.
  • 16.
    16 ©2022 VMware, Inc. Howto use MITRE ATT&CK to build intelligent detections Reduce false positives without loosing visibility
  • 17.
    ©2022 VMware, Inc.17 Intelligent Alerting DLP Type Case
  • 18.
    ©2022 VMware, Inc.18 Intelligent Alerting Employee Gone Rogue
  • 19.
    ©2022 VMware, Inc.19 Oops…. Oblivious User
  • 20.
    ©2022 VMware, Inc.20 Follow the ATT&CK… One Alert to Rule them All!
  • 21.
    ©2022 VMware, Inc.21 Test Your Detections! Don’t wait for an attacker, test today!! Here is a basic python script to help generate some canary files you can use to test out your detections. This example and more can be found here: https://github.com/m att-snyder- stuff/python_canary_ files
  • 22.
    ©2022 VMware, Inc.22 • Minor deviations from normal activity • Has motive to carry out attack • Impacted items are directly related to their work • Absence of any indicators of compromise • Random activity not associated with user’s work • Activity algins with groups that target your industry • Activity is beyond the employee’s technical capabilities • Unusual Access Events Insider Threat APT or External Threat Insider Threat vs APT How can you tell them apart?
  • 23.
  • 24.
    ©2022 VMware, Inc.24 • There are endless attack possibilities, you might not catch them all, but you won't catch any if you don’t get started, so get started. • Begin with use cases that are top of mind for your company. • Utilize the data you are already collecting. • With your custom Insider Threat matrix in hand, get the additional logs you need. • Team up with your Legal and HR departments, find out what is important to them. • Work with your business partners to better understand their concerns. • Have plan and workflow on how to support investigations and remediation efforts. Then test it (Live Fire, Tabletop, Round Table)! Lessons Learned Prioritize and Execute Work with the Business Follow the ATT&CK • Look for the patterns of risky behavior, this reduces false positives and wasted time. • You must build your own detections! DLP tools alone are NOT an Insider Threat program!
  • 25.
    ©2022 VMware, Inc.25 • MITRE’s Insider Threat TTP Knowledge Base https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/ • Insider Threat Matrix https://github.com/Insider-Threat/Insider-Threat • National Insider Threat Task Force (NITTF) https://www.dni.gov/index.php/ncsc-how-we-work/ncsc-nittf • NITTF Maturity Framework https://www.dni.gov/files/NCSC/documents/nittf/20181024_NITTF_MaturityFramework_web.pdf • CISA https://www.cisa.gov/sites/default/files/publications/Insider%20Threat%20Mitigation%20Guide_Final_508.pdf • DNI https://www.dni.gov/files/NCSC/documents/nittf/NITTF-Insider-Threat-Guide-2017.pdf • Code42 Report https://www.code42.com/resources/report-2021-data-exposure • Hitachi ID Report https://www.hitachi- id.com/hubfs/A.%20Key%20Topic%20Collateral/Ransomware/%5BInfographic%5D%20The%20Rising%20Insider%20Threat%20%7C%20Hackers%20Have%20Approached%2 065%25%20of%20Executives%20or%20Their%20Employees%20To%20Assist%20in%20Ransomware%20Attacks. Additional Resources
  • 26.
    Confidential │ ©2019VMware, Inc. Thank You