July - 2019ENTERPRISE SECURITY| | 19ou've invested millions into your cybersecurity incident response capabilities. How do you know that when under attack you'll actually be able to find the needle in the haystack that allows you to quickly identify, contain, eradicate, and recover? Traditional methods include running end-to-end tabletop war games, executing a red team exercise, or just documenting your successes against actual attacks. While valuable, each of these methods has its shortcomings.Tabletops and red team exercises can be costly and disruptive and are usually infrequently executed. Red teams sometimes will take the shortest path to the goal, leaving avenues of attack unexplored, or sometimes repeatedly hammer on known issues, yielding little additional insight. Taking the approach of waiting around for an attacker to evaluate your defenses has, let's say, issues.What is needed is a structured, complete, low cost, low risk, and continuously executing mechanism to evaluate your defenses against a constantly changing threat landscape. You need to leverage the results of that evaluation to make incremental, yet meaningful improvements. The continuous improvement cycle needs to be agile, and the testing strategy needs to adapt as well.A structured and complete evaluation framework should account for the myriad of attacker behaviors that may be used against you. Work over the past few years on frameworks such as MITRE ATT&CK has given us such a library of attacker behaviors. They've analyzed thousands of advanced attacks in order to find the common tactics and techniques, or building blocks, that an attacker will string together.Having these building blocks gives a low cost, low-risk way to structure tests. Instead of an end-to-end test of the system, like a red/purple team exercise or a tabletop, we can create "unit," or micro-purple, tests. Each test is used to simulate a specific behavior. If these tests are scriptable, it is straightforward to execute them on-demand or continuously.When executing the micro-purple tests, ask three questions to understand your effectiveness. Was I able to block the behavior? If I didn't block it, could I alert on it? When I alert on it, do I have a procedure to respond to the specific alert? Measure the results, report your improvement over time, and identify additional needs as attacker behaviors evolve. At a strategic level, the results of the tests can support the case for additional investment into controls.As you implement the micro-purple method, there are a number of decisions that will need to be made. There aren't right or wrong answers but thinking through each of these decisions in advance will prepare you for a successful implementation.What behaviors should I simulate or test? MITRE ATT&CK includes all attacker behaviors, even those that overlap with legitimate user By Matt Stiak, Director, Cyber Risk and Threat Operations, Delta Dental of CaliforniaYCXO INSIGHTSMaking Micro-purple Testing WorkMatt Stiak
< Page 9 | Page 11 >