Identity, credentials and behavior are critical to network protection

Recently, Cybersecurity and Infrastructure Security Agency information security specialist Jay Gazlay said the SolarWinds breach made it clear that “identity is everything now.”  Tighter identity controls, including behavior analysis techniques, can flag impossible logins, Gazlay told the National Institute of Standards and Technology’s Information Security and Privacy Advisory Board. “If we don’t get set up to do that, we’re not going to notice these user impersonation attacks that become de rigueur for our adversaries.” 

In 2004, the U.S. invested billions in the Einstein intrusion detection system to protect government resources on the internet. Over the years and despite enhancements, Einstein 3.0 failed to detect the SolarWinds cyberattack on the Departments of Treasury, State, Defense, Homeland Security and Commerce, the Postal Service and the National Institutes of Health.

With so many security tools available, why are we allowing breaches of this scope and magnitude to continue? To me, the answer is simple: We lack of the technology knowledge and refined processes needed to spot a breach.

The first lesson we already knew: We can’t see the forest for the trees

So much money and resources are spent on stopping the hack by chasing indicators of compromise to stop an intrusion. Often IOCs aren’t reused, and they can distract analysts looking for a malicious intruder or suspicious behavior.

As a result, cybersecurity analysts cannot see the forest for the trees. They need a timeline of what is happening and a complete picture to understand an attacker’s intent, rather than focusing on alerts strung together from a host of security tools after the event has occurred.

There is no silver bullet for this problem because users, machines and data all must be protected. Before buying the latest security tool that might help in the short term, agencies should instead shift their priorities to securing enterprise processes.

Using a more credential-centric and identity management-focused approach can identify attackers in the network quickly and enable extraction -- a defensive play that can reduce exposure and improve processes.

The second lesson we already knew: We must evolve or die

We must help agencies evolve with the changing threat landscape and create greater operational efficiency. Cybersecurity vendors have introduced functionality to automate parts of security operations, but the role needs expansion.

Most automation solutions focus on threat response before initiating an automation playbook. Hoping security analysts make the correct query at the right time will never work because it requires they synthesize massive volumes of data and ignore the  noise to determine an attacker’s intent. It is like looking for one needle in a stack of many needles.

Criminals have become so sophisticated and computer networks so vast that traditional detection is simply inadequate. To understand intent, agencies must understand normal network, device and user behavior which is no easy endeavor, especially at scale. 

User and entity behavior analytics security solutions use machine learning and deep learning to discover abnormal and risky behavior by users, machines and other entities. Using behavior to track normal and anomalous actions offers a process improvement, as does automatic contextual enrichments.

The third lesson we already knew: All attacks are insider threats

Here’s the reality: Most insider threats don’t come from a disgruntled former or current employee, they are instead cyberattacks using compromised employees credentials. 

When stolen valid credentials are used to enter a network, hackers use Active Directory to create new ones, making visibility critical to understanding how credentials are created, dumped and stolen.

For example, agencies believe that security methods like encryption, VPN usage and two-factor authentication offer sound protection. A breach may lead them to believe a threat is isolated to a single machine not understanding the attacker created valid credentials and used the VPN to get inside, blend with other traffic and behaviors and move deep inside the network.

In a post-pandemic economy with employees outside the firewall, agencies must embrace the idea that identity is the new perimeter. Visibility into the credential usage at the Department of Treasury would not have stopped the SolarWinds attack, but it would have identified and contained it rapidly. 

The fourth lesson we already knew: A strong offense is still the best defense 

Ice hockey legend Wayne Gretzky said, “A good hockey player plays where the puck is. A great hockey player plays where the puck is going to be.” Do agency cybersecurity investigators have an investigation playbook, like the MITRE framework that focuses on the behavior of the attackers and the things they do? Anticipation is offensive play. 

Building a strong offense against breaches is the best defense. It starts with the four pillars of the security operation center: detection, triage, investigation and response. Unfortunately, the focus is often only on detection and response, with the middle pieces forgotten. 

Teams can bounce between systems, not getting anywhere. Instead, a process driven by outcomes can discern the meaning in the context of alerts, so threats can be removed before damage is done. Today, too many less important alerts lacking context come from too many solutions.

The attack on SolarWinds won’t be the last of its kind, and cybersecurity must change. Otherwise, Gazlay’s observations will become a self-fulfilling prophecy, and we will be stuck attempting to thwart new attack methods with old weapons.