be the strong link in your September 2014 Let HP ArcSight ESM be the strong link in your Cyber Kill Chain Pete Babcock - USAA

What is the Cyber Kill Chain? Layer 3 Layer 2 Layer 1 The Cyber Kill Chain is a taxonomy designed to measure the effectiveness of the Defense-in-Depth strategy. How far can I get?

What is the origin of the Kill Chain? The Cyber Kill Chain was socialized by Lockheed Martin. It is based on military doctrine. It was developed as a method for describing an intrusion from an attacker’s point of view. It can inform Cyber Security and Intelligence Analysis.

Cyber Kill Chain Stages Reconnaissance Weaponization Delivery Searches LinkedIn for System Administrators at USAA. Guesses their USAA email addresses based on name. Reconnaissance Obtains domain name and creates website with malware. Crafts spear phish. Weaponization Sends spear phish to targeted email addresses. Administrator clicks on link and goes to evil website. Delivery Zero day exploit on website executes on Administrator’s PC. Administrator’s PC is compromised. Exploitation Root Kit is installed on Administrator’s PC. Installation Root kit connects back to Threat Actor’s server to obtain further instructions. Establish C2 Threat Actor looks for data on Administrator’s PC. Threat Actor starts compromising other USAA machines. Actions on Objectives

What can the Kill Chain do? Each phase of the kill chain can be mapped to corresponding defensive tools and actions. An analyst who knows the stage of the Kill Chain has a basic understanding of what is being attempted and what response is called for. Defensive “Courses of Actions” are based on the Information Operations principles of: Detect, Deny, Disrupt, Degrade, Deceive & Destroy

Courses of Action Matrix Phase Detect Deny Disrupt Degrade Deceive Reconnaissance Firewall NIDS Web Logs NIPS * Weaponization DNS Monitoring Website Monitoring Delivery Antivirus Vigilant User Proxy In-Line Antivirus Exploitation NIDS Antivirus System Patching Restricted User Accounts Installation Application Logs Establish C2 CIC Malware Sandbox Actions on Objectives VLANs

What can the Kill Chain do? The sooner in the kill chain you can disrupt the attack, the better. Tracking similarities across kill chain phases can give CTOC Analysts insight into: • Threat Actor Tactics, Techniques and Procedures (TTP) • Campaign Analysis

How will USAA operationalize? 1 Integrate into ArcSight ESM Cases 2 Integrate into the CTOC Wiki 3 Integrate into the Weekly Stand-Up Briefing

Repurposing Case Fields “Energy cannot be created or destroyed, it can only be changed from one form to another.” - Albert Einstein ArcSight ESM Case Fields are kinda like that…

Yes, the modified files will need to be updated on ALL Consoles… Modifying ESM Cases When using ArcSight ESM Cases, it is possible to modify them to your needs. There are 3 files that control cases: Manager /opt/arcsight/manager/config/caseui.xml Console C:\arcsight\Console\current\i18n\common\ label_strings_en.properties C:\arcsight\Console\current\i18n\common\ resource_strings_en.properties Yes, the modified files will need to be updated on ALL Consoles…

Repurposing Case Fields The Joke: You are going to use ArcSight’s Foreign Language capabilities to give a field an alias…In English! First pick a Case field that you are not using of the correct field type. Candidates can be found in the resource_strings_en.properties file. Modify the field in the resource_strings_en.properties file. If using a list field in the resource_strings_en.properties file, make sure to configure the list options.

resource_strings_en.properties Modify the Field extendedcase.attribute.vulnerabilitydata.label=Vulnerability Data extendedcase.attribute.vulnerabilitydata.shortlabel=Vulnerability Data extendedcase.attribute.history.label=Reoccurence Pain extendedcase.attribute.history.shortlabel=Reoccurence Pain extendedcase.attribute.lastoccurrencetime.label=4 - Investigation Start Time extendedcase.attribute.lastoccurrencetime.shortlabel=4 - Investigation Start Time extendedcase.attribute.resistance.label=Kill Chain Stage extendedcase.attribute.resistance.shortlabel=Kill Chain Stage extendedcase.attribute.conclusions.label=Conclusions extendedcase.attribute.conclusions.shortlabel=Conclusions List Field Options extendedcase.history=Unknown or None,Low,Medium,Please make it stop #extendedcase.resistance=High,Low,Unknown extendedcase.resistance=Unknown,Reconnaissance,Weaponization,Delivery,Exploitation,Installation,Establish C2,Actions on Objectives,Not on Kill Chain

label_strings_en.properties This file is used to rename the Case tabs and headers displayed in the ArcSight ESM Console. Manager #Cases cases.tab.initial=Initial cases.tab.attributes=Case Info cases.tab.description=Description cases.tab.securityClassification=Security Classification cases.tab.followup=Incident cases.tab.final=Analysis cases.tab.attackMechanism=Dean's Categorization cases.tab.attackAgent=Attack Agent cases.tab.incidentInformation=Incident Information cases.tab.vulnerability=Vulnerability cases.tab.other=Other cases.header.case=Case cases.header.ticket=Ticket cases.header.incidentInformation=Incident Information cases.header.securityClassification=Security Classification cases.header.securityClassificationCode=Security Classification Code

CaseUI.xml This is the xml file that defines the fields and tabs to display within a case. <editor enforceLocking="true" colorTreeBy="consequenceSeverity" width="480" height="480"> <tab name="cases.tab.final" type="base"> <component name="securityClassificationTable" type="table"> <parameter name="cases.header.case" type="header"/> <parameter name="name" type="resourceName"/> <parameter name="plannedActions" type="string"/> <parameter name="ticketType" type="stringList"/> <parameter name="stage" type="stringList"/> <parameter name="securityClassification" type="stringList"/> <parameter name="resistance" type="stringList"/> <parameter name="consequenceSeverity" type="stringList"/> <parameter name="history" type="stringList"/> <parameter name="cases.header.ticket" type="header"/> <parameter name="estimatedStartTime" type="date"/> <parameter name="detectionTime" type="date"/> <parameter name="attackTime" type="date"/> <parameter name="lastOccurrenceTime" type="date"/> <parameter name="estimatedRestoreTime" type="date"/> </component> <component name="actionsTaken" type="textarea"/> <component name="followupContact" type="textarea"/> <component name="conclusions" type="textarea"/> </tab> <tab name="cases.tab.attributes" type="base" showExport="true"> <component name="attributesTable" type="table"> <parameter name="cases.header.case" type="header"/> <parameter name="name" type="resourceName"/> <parameter name="displayId" type="int" readOnly="true"/> <parameter name="common" type="commonResourceAttrs"/> </component> <tab name="cases.tab.followup" type="base"> <component name="incidentInformationTable" type="table"> <parameter name="incidentSource1" type="string"/> <parameter name="attackMechanism" type="stringList"/> <component name="estimatedImpact" type="textarea"/> </editor>

Classify ArcSight ESM Cases

Classify ArcSight ESM Cases

Categorize CTOC Use Cases in Wiki

Categorize CTOC Use Cases in Wiki

Categorize CTOC Use Cases in Wiki

How will this be briefed?

Integrate into the Weekly Standup Briefing The CTOC gives a Weekly Briefing to USAA’s CSO and 80-100 of his direct reports and other parts of the business. 3 new slides were incorporated into the Weekly Standup Briefing slide deck to communicate the Cyber Kill Chain metrics.

Weekly Cyber Kill Chain Metrics Reconnaissance Weaponization Delivery Exploitation Installation Establish C2 Actions on Objectives

This Week’s Cyber Kill Chain

This Week’s Cyber Kill Chain Highlights Reconnaissance Multiple Failed Logins - Non-Privileged This spike was caused by USAA employees attempting (and failing) to VPN into USAA during the icy weather on Friday 1/24/14. Actions on Objectives Non-Active USAA User Name - Destination This was caused by Peoplesoft listing contactors as being terminated when, in fact, their contract was extended. More timely updates to Peoplesoft would correct this.

Why do we need the Cyber Kill Chain? “Measurement is the first step that leads to control and eventually to improvement. If you can’t measure something, you can’t understand it. If you can’t understand it, you can’t control it. If you can’t control it, you can’t improve it.” - H. James Harrington

Q&A Questions?