In a previous blog, we discussed the role of planning in offensive operations and the power that effective planning affords an actor. For an actor conducting an offensive operation, their capability to achieve their goal is predicated on a number of things:
- The number of different scenarios that they can envisage at each stage of the operation
- Their ability to still operate effectively in each scenario despite imposed limitations
Depending on the type of attacker, their tools, tactics and procedures mean that they are able to respond to changes in their operational environment. A low capability actor may be more of a “one trick pony”, exploiting a particular known SQL injection vulnerability or having a single phishing payload. Once that avenue is discovered by the defenders and appropriate controls are deployed, that particular actor is frozen out. A more capable actor will have either planned for such a scenario or have the resources to be able to improvise within an appropriate operational timescale.
Being able to predict when such roadblocks might be appear requires a certain level of anticipatory decision making from the adversary. That is, being able to anticipate the likely moves of the target in advance. The closer these predictions track reality, the greater the chance of the attacker’s success in breaching the target and completing its mission will be. In order to track reality as closely as possible, the attackers must have a model of the defenders, if not specifically for a particular target, then at least in general. This model must give, at the very least, a rough outline of the tools, tactics and procedures that defenders typically use in order to prevent intrusions.
For example, in order to protect against phishing, organizations often operate a Spam blacklist, block certain types of attachments, disable Macros across the organization and conduct security awareness training for employees. An effective attacker, must be aware of these security controls and have options to bypass them, for example, hijacking high reputation domains to evade blacklists, knowing which tricks can be used to bypass attachment filtering, such as embedding files inside of whitelisted or commonly accepted attachment types, having a number of options for gaining code execution on an endpoint, e.g., through embedding OLE packages and knowing that the basic phishes may be caught so using a template that you know will be likely to be accepted, such as using a template that mimics a known supplier to the target organization.
Similarly, in order for defenders to be successful at protecting their networks, they must also have a model of attacker behavior which allows them to predict and anticipate the likely moves that attackers will make as they try to achieve their goals. Unfortunately this attacker model – also known as a threat model – is often neglected by many organizations. By not fully understanding which attackers are likely to target an organization based on which critical assets are present and which capabilities these attackers have, it is difficult to build a model which accurately anticipates what are the likely approaches an attacker is liable to make.
The main issue with a poor model is that it leads to incorrect prioritization of security controls. Spear-phishing with Macro-enabled Microsoft Office documents is still the preferred route for initial compromise in targeted intrusions but many organizations do not arrange their security priorities in such a way as to mitigate this threat first and foremost. Similarly, the exploitation of vulnerable browser plugins by exploit kits to deploy ransomware is another significant threat to organizations. Still many organizations do not have a robust set of practices to patch these plugins in a timely fashion and deploy exploit mitigations like the (sadly to be missed) Microsoft EMET system.
At Digital Shadows (now ReliaQuest), we follow the approach to threat modelling as laid out by the CBEST intelligence-led testing approach. An introduction to this can be found in the “An Introduction to Cyber Threat Modelling” document. It describes how to understand the goal-orientation of the threat actor, the capabilities they possess and their general modus operandi. This allows a defender to systematically develop a model of attack behavior and match that to their organization’s critical assets. Through understanding which threat actors are known to target particular critical assets (e.g., Point of Sale terminals, sensitive internal documents or customer data) and a comprehensive assessment of threat actor capabilities, an organization can better plan for likely attacker scenarios.
