{"id":76307,"date":"2025-02-08T18:37:25","date_gmt":"2025-02-08T18:37:25","guid":{"rendered":"https:\/\/peraltafinancing.com\/accounting\/threat-informed-defense-part-1-threat-simulation\/"},"modified":"2025-02-08T18:37:25","modified_gmt":"2025-02-08T18:37:25","slug":"threat-informed-defense-part-1-threat-simulation","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=76307","title":{"rendered":"Threat Informed Defense (Part 1): Threat Simulation"},"content":{"rendered":"


\n<\/p>\n

\n
\"\"<\/div>\n

by Tori Thurmond \/ April 18th, 2024 <\/p>\n

Cyber threats pose significant risk to organizations worldwide, ranging from financial loss to reputational damage to operational disruptions. These ever-evolving threats can be intimidating, but with the right preparation, organizations can proactively mitigate risks and fortify their overall cybersecurity posture. One way to offensively protect your organization from the treat landscape is through threat simulation. \u00a0<\/p>\n

This week, our VP of Pen Testing, Jason Rowland<\/a>, kicked off our three-part Threat Informed Defense webinar series with the first session which focused on Threat Simulation.\u00a0\u00a0<\/p>\n

Note: This is a high-level overview of our webinar\u00a0Threat Informed Defense (Part 1): Threat Simulation. For more insight into this topic and what threat simulation might look like for your organization, make sure to listen to the full recording\u00a0<\/em>here<\/em><\/a>.\u00a0<\/em>\u00a0\u00a0 \u00a0<\/p>\n

What is threat informed defense? <\/strong><\/h2>\n

Before diving into the details, Jason took a moment to define a couple of important terms.\u00a0\u00a0<\/p>\n

MITRE Enginuity\u2019s Center for\u00a0Threat-Informed Defense notes that,\u00a0\u201cThreat-informed defense<\/strong> is the systematic application of a deep understanding of adversary tradecraft and technology to improve defenses.\u201d\u00a0<\/p>\n

In simpler terms, threat-informed defense encourages us to understand the adversaries that are most likely to impact our environment; understand the tactics, techniques, and procedures (TTPs) those adversaries employ in infiltrating our environments; and shape our defenses around those TTPs.\u00a0<\/p>\n

Leveraging knowledge of cyber threats to prioritize the allocation of limited resources is one of the most impactful and efficient ways to reduce overall risk.\u00a0\u00a0<\/p>\n

Threat-informed defense is possible because of ATT&CK. MITRE ATT&CK <\/strong>is a curated knowledge base for cyber adversary behavior that focuses on the why (tactic) and the how (technique) of adversary actions. Over the last ten years, as we\u2019ve learned how adversaries both break into and move through our environments as well as how they ascertain, those techniques have been captured in the ATT&CK framework. The ATT&CK framework also gives us a common taxonomy to talk about adversary actions. It\u2019s a way for red teams and blue teams to communicate using the same terms.\u00a0<\/p>\n

Follow this link<\/a> to check out the MITRE ATT&CK framework.\u00a0<\/p>\n

Fundamentals <\/strong><\/h2>\n

The purpose of threat simulation is to help you understand your cybersecurity effectiveness. Organizations may ask: Are our people trained and alert when it comes to security threats? Are our internal security processes effective? Are technology investments configured correctly and delivering value? \u00a0<\/p>\n

If you\u2019re asking yourself these questions, you\u2019re not alone. These questions are so common that they supported an entire industry built around cybersecurity assessments. There are several different testing approaches used in offensive security, like red team engagements, vulnerability assessments, and penetration tests to name a few. All of these assessments help network owners better understand their security and make improvements in defending against threats. Threat simulation is additive to these methods. Each of these offensive security techniques has its time and place. \u00a0<\/p>\n

Why do new testing methods continue to be created? The reality is that while these other assessments are good to do, they are not always representative of real-world threats. For example, traditional penetration tests and vulnerability assessments often focus overwhelmingly on identifying and mitigating initial access vectors, meaning these tests say very little about the hundreds of post-exploitation TP\u2019s spanning the attack matrix. Therefore, the way that real-world adversaries operate is fundamentally different than how we operate during traditional cybersecurity assessments.\u00a0\u00a0<\/p>\n

What is threat simulation? <\/strong><\/h3>\n

Threat simulation is an intelligence driven discipline that entails researching, modeling, and executing cyber adversary tactics, techniques, and procedures to assess and improve cybersecurity. Threat simulation is about understanding what threats exist with the means and motive to come after your organization and the data that you\u2019re responsible for. Pen testers want to research and model those threats to understand how the threats work inside of an environment.\u00a0 \u00a0<\/p>\n

A primary characteristic of threat simulation is that the TTPs are meant to emulate adversary behaviors commonly seen in the wild. This method ensures that defenses can be tuned to real-world threats. Different industries are facing different threats, so threat simulation takes those real-world threats that are probable for a certain industry and works to defend against them. \u00a0<\/p>\n

Another main focus of threat simulation is tuning defenses around behaviors that are difficult for adversaries to alter as opposed to tuning around fragile signatures like has values and IP addresses. When threat simulation is based off of the TTPs,\u00a0testers\u00a0force the bad actors to\u00a0change the way they conduct their operations. \u00a0<\/p>\n

Threat simulation is also typically transparent, meaning that the testers fully disclose what the red team did in as much detail needed for the network defenders to improve their defenses. Adversary emulation is also collaborative, meaning the testers work with the defenders to effect positive improvement. \u00a0\u00a0<\/p>\n

Threat Simulation Framework <\/strong>\u00a0<\/h2>\n

The threat simulation framework is how the pen testers will conduct a threat simulation engagement. \u00a0<\/p>\n

\n
\"\"<\/figure>\n<\/div>\n

1. Defining Objectives <\/strong><\/h3>\n

Defining the objectives of the simulation is an important first step in the framework. This step will be highly dependent on the industry that you\u2019re in, your business model, and the threat landscape at the time of conducting the exercise. \u00a0<\/p>\n

2. TTP Research<\/strong>\u00a0<\/h3>\n

Adversary Research <\/strong>\u00a0<\/p>\n

In this step of the framework, you need to select adversaries and\/or TTPs to research that are relevant to your organization. It\u2019s important to align this step with your cybersecurity objectives. The requirements of adversary research are understanding the threat landscape and how it relates to your business. Researching adversaries should not be arbitrary. This step takes a lot of time, so you need to make it worth it by conducting good, relevant research. \u00a0<\/p>\n

Internal Research\u00a0<\/strong>\u00a0<\/p>\n

Internal research involves discussing what cyber threats the internal teams are concerned about and reviewing past incidents. Important teams to include in this research are the threat intel team and network defenders\/system administrators. In this step, it\u2019s beneficial to look at past incidents and see how you\u2019ve remediated those issues. Many companies get attacked in the same way multiple times. \u00a0<\/p>\n

External Research\u00a0<\/strong>\u00a0<\/p>\n

External research can be done by accessing publicly available information, such as ATT&CK\/Tidal Cyber Community, CTI article, and industry reports (Verizon Data Breach Report<\/a>). However, when you\u2019re conducting external research, be wary of headline bias when selecting threats.\u00a0\u00a0<\/p>\n

\n

How do you know when your TTP research is complete? Initial research is usually done when you have a short list of threat actors or techniques that align with cyber security goals, and you can clearly communicate their relevance. It\u2019s important that you know how to move forward, and you know how to communicate that strategy to the organization. \u00a0<\/p>\n

Threat Selection Considerations:<\/strong>\u00a0<\/p>\n

Make sure your TTPs are aligned with your business. \u00a0<\/p>\n

Testers\u00a0need enough CTI to replicate a certain threat. If there\u2019s not enough CTI, it may not be a threat that is eligible for this exercise. \u00a0<\/p>\n

Make sure you have the time, staff, and expertise to replicate a certain threat.\u00a0<\/p>\n

3. Simulation Planning<\/strong><\/h3>\n

Planning for your threat simulation is an essential step to this framework. Threat simulation can cause significant issues if not properly planned, such as disclosure of sensitive data, data loss, and unplanned downtime, not to mention that executing adversary TTPs without permission will very quickly land you in trouble. Proper planning is essential to a successful adversary emulation engagement.\u00a0\u00a0<\/p>\n

So, what\u2019s the best way to plan for a threat simulation? Threat simulation planning generally includes documenting<\/strong> the following: \u00a0<\/p>\n

It\u2019s important to be able to describe and document the relevance to your organization and why you\u2019re taking on the TTPs. \u00a0<\/p>\n

In this context, scope identifies organizations, users, and\/or devices upon which adversary emulation activities are permitted, like organizational units, users, and devices. In this step of the planning, testers need to work with network owners and system administrators to identify and document devices that are in scope. Network diagrams can be helpful in this step as long as they are accurate. You\u2019ll also need to identify high-value assets and the assets specifically out of scope. \u00a0<\/p>\n

The schedule defines dates and times in which adversary emulation activities occur and when deliverables are due. This step of planning is important for deconflicting adversary emulation activity against legitimate business operations and identifying periods in which adversary emulation activities should not occur.\u00a0\u00a0<\/p>\n