Instructor: Defensive capabilities. 2 2
In this lesson, we are going to talk 3 3
about the different types of defensive capabilities. 4 4
Now, every organization has different defensive capabilities 5 5
so you have to ask yourself, 6 6
what defensive capabilities does your organization have? 7 7
Now, when we talk about defensive capabilities, 8 8
these are outlined 9 9
inside the intelligence-driven computer network defense 10 10
informed by analysis and adversary campaigns 11 11
and intrusion kill chains. 12 12
This is a document that came from Lockheed Martin. 13 13
And it is a very popular one to use 14 14
inside the cybersecurity world. 15 15
This document is only about 14 pages long, 16 16
so if you want to read it, you can Google 17 17
intelligence-driven computer network defense, 18 18
Lockheed Martin, 19 19
and it will come up immediately in your browser. 20 20
Now, I would recommend going through and reading this 21 21
not necessarily for the exam, but just for the fact 22 22
that it's going to be helpful to you in the real world. 23 23
We're going to cover what you need to know 24 24
for the exam in this lesson though. 25 25
Now, when we talk about these different things 26 26
that we can do as defensive capabilities, 27 27
there are a handful of them. 28 28
We have things like: 29 29
detect, destroy, degrade, disrupt, deny, and deceive. 30 30
Let's talk about what each of those mean. 31 31
First, we have detect, 32 32
and this is going to identify the presence 33 33
of an adversary or the resources at their disposal. 34 34
Essentially, when you go through your SIEM 35 35
and you look at the alerts 36 36
that's your ability to detect an adversary in your network. 37 37
That is a defensive capability, 38 38
and usually the first one you're going to use. 39 39
Then we have destroy. 40 40
Now, destroy is going to render an adversary's resources 41 41
permanently useless or ineffective. 42 42
For most of us in a commercial organization, 43 43
we are not going to be using destroy, 44 44
but if you happen to work for the government 45 45
or you work for the military, 46 46
they have the ability to destroy, 47 47
which essentially would be a hack-back, 48 48
and they'd be able to take down 49 49
somebody else's system who is attacking them. 50 50
Next, we have degrade. 51 51
Degrade is going to reduce 52 52
an adversary's capabilities or functionality, 53 53
perhaps temporarily. 54 54
For example, maybe you've identified 55 55
that a particular adversary is attacking you 56 56
from a virtual private network with a certain IP range. 57 57
You could block that range, 58 58
and that would degrade their ability, 59 59
but it's only going to do that temporarily 60 60
because they're going to be able to go and get new services 61 61
from another IP range and then re-attack you again. 62 62
The next defensive capability we have is disruption. 63 63
When you disrupt something, 64 64
you're trying to interrupt an adversary's communications 65 65
or frustrate or confuse their efforts. 66 66
Again, you can do this by blocking their IP address. 67 67
You might add a second factor of authentication 68 68
or something else. 69 69
Anything you do that is going to interrupt their ability 70 70
to communicate or frustrate or confuse their efforts 71 71
would be considered disruption. 72 72
After that, we have deny. 73 73
When we deny, we are preventing an adversary 74 74
from learning about your capabilities 75 75
or accessing your information assets. 76 76
Deny is the best thing. 77 77
We want to make sure we keep the bad guy out, 78 78
and that is what deny is all about. 79 79
In addition to keeping them out of our systems, 80 80
we also want to keep them from knowing about our systems. 81 81
And if we can deny their ability 82 82
to learn what IP ranges we're using, 83 83
what type of servers or software we're using, 84 84
that is going to help us in defending our networks. 85 85
And finally, we have deceive. 86 86
Deceive is where we're going to supply false information 87 87
to distort the adversary's understanding and awareness. 88 88
If you use something like a honeypot 89 89
or you start sending out false documents 90 90
for them to steal from you, 91 91
that would be a deception mechanism 92 92
under the deceive category. 93 93
Now, as you go through 94 94
and you look at the Lockheed Martin white paper, 95 95
there's a chart that looks like this, 96 96
and they show you the different phases 97 97
going down the left side based on the kill chain, 98 98
such as reconnaissance, weaponization, delivery, 99 99
exploitation, installation, C2, and action on objectives. 100 100
And then going across to the right, you'll see: 101 101
detect, deny, disrupt, degrade, deceive, and destroy, 102 102
and then you can map out 103 103
which technologies you have in each of these categories. 104 104
For example, if I'm using web analytics, 105 105
that is a detection technology 106 106
that's going to be focused on the reconnaissance phase. 107 107
If I have a network intrusion detection system, 108 108
that might detect things in the weaponization phase. 109 109
If I'm using something like a vigilant user, 110 110
that would be something where we're going to detect things 111 111
in the delivery phase. 112 112
And you can see how this chart starts filling out 113 113
based on the different technologies we're going to use. 114 114
Now, this is particularly set up for your organization, 115 115
so you can use this as a template, 116 116
and then modify it based on your own defensive capabilities. 117 117
Again, notice the destroy column. 118 118
It is completely empty here. 119 119
That's because I'm a commercial organization. 120 120
I don't have the legal authority 121 121
to hack-back against an adversary, 122 122
so therefore I cannot destroy them. 123 123
I can only detect, deny, disrupt, degrade, and deceive them. 124 124
If you work for the military though, 125 125
you might have the legal authority to hack-back, 126 126
and that would allow you to have some destroy options. 127 127
But for me, I don't have those, 128 128
and that's why my chart looks like this.