Instructor: Back in your Security+ studies, 2 2
you learned a lot about the different types of threats 3 3
that occur to the safety and security 4 4
of our networks and our systems. 5 5
In this lesson, we're going to talk about 6 6
the two highest levels of threat classification categories 7 7
that we have. 8 8
These are known as known threats and unknown threats. 9 9
Now, known threats are any threat 10 10
that can be identified using basic signature 11 11
or pattern matching. 12 12
These are things like malware and documented exploits. 13 13
When I talk about malware, 14 14
I'm talking about any software 15 15
that intentionally is designed to cause damage 16 16
to a computer, a server, a client, or a computer network. 17 17
These are things like viruses, and rootkits, 18 18
and Trojans, and botnets, 19 19
all the things you talked about back in Security+. 20 20
Now, these are very straightforward to identify and scan for 21 21
because we have a matching signature in our database 22 22
that can help us detect it. 23 23
This brings us to the idea of a documented exploit. 24 24
Now a documented exploit is a piece of software, 25 25
data, or a sequence of commands 26 26
that takes advantage of a vulnerability 27 27
to cause unintended behavior, 28 28
or to gain unauthorized access to sensitive data. 29 29
If we're using a vulnerability scanner, 30 30
we can look for certain things in our environments 31 31
that we know have documented exploits against them, 32 32
and therefore we can detect those things, 33 33
making them a known threat. 34 34
These are very static and we deal with known threats, 35 35
these are things that are easily detected 36 36
using signatures, hash values, or other things like that. 37 37
Now, the next thing we want to talk about 38 38
is the other category, which is unknown threats. 39 39
And this is a more dangerous area for us 40 40
as cybersecurity analysts. 41 41
An unknown threat is any threat that cannot be identified 42 42
using basic signature or pattern matching. 43 43
Now, when we talk about unknown threats, 44 44
there are lots of these things out there. 45 45
We have zero-day exploits, we have obfuscated malware code, 46 46
we have behavior-based detection, we have recycled threats, 47 47
we have known unknowns, and we have unknown unknowns. 48 48
We're going to talk about each of those 49 49
through the rest of this lesson. 50 50
A zero-day exploit is any unknown exploit in the wild 51 51
that exposes a vulnerability in the software or hardware, 52 52
and it can create complicated problems for us 53 53
well before anyone realizes that something is wrong. 54 54
When we are dealing with a zero-day vulnerability, 55 55
this is something that somebody found out in the wild 56 56
and they said, "Ah, I found a new way 57 57
to break in on something." 58 58
And we don't have a way to detect that or to stop it yet. 59 59
And so it is a zero-day because the attack happens 60 60
on day zero, the first day it was discovered. 61 61
And this becomes a big problem, 62 62
and is one of the most dangerous areas 63 63
for us as cybersecurity analysts. 64 64
The next area we want to talk about 65 65
is Obfuscated Malware Code. 66 66
This is malicious code whose execution 67 67
the malware author has attempted to hide 68 68
through various techniques such as compression, 69 69
encryption, or encoding to severely limit our attempts 70 70
to statically analyze that malware. 71 71
Now, when you do this, 72 72
you're essentially scrambling the code 73 73
or changing it slightly, 74 74
and if you keep doing this randomly at different intervals 75 75
you're going to be able to take a known threat 76 76
and essentially make it unknown, 77 77
because you continually are scrambling that code 78 78
making those signatures inaccurate 79 79
and they won't detect it anymore. 80 80
The next thing we want to talk about 81 81
is behavior-based detection. 82 82
Now, behavior-based detection is really important 83 83
when we're trying to get unknown threats and discover them. 84 84
The reason is we can't use a signature 85 85
because they're unknown, but using behavior-based detection 86 86
this is a malware detection method 87 87
that evaluates an object based on its intended actions 88 88
before it can actually execute that behavior. 89 89
For example, if you send me a piece of email 90 90
with an attachment in it, 91 91
that attachment may be opened in a sandbox first, 92 92
evaluated based on its behavior, 93 93
see if it's malicious or not, and if it isn't malicious 94 94
then be sent into my inbox, and if it is malicious, 95 95
it can be sent out and be destroyed. 96 96
That's the idea of a behavior-based detection. 97 97
When we're looking at behavior-based detection, 98 98
we're going to be doing things heuristically. 99 99
We're looking at all the different things 100 100
that are around this, what ports are being opened, 101 101
what calls are being made in the software, 102 102
and based on that, we can determine 103 103
if it's good or if it's bad, 104 104
and whether we should allow it or not. 105 105
Now the next one we're going to talk about 106 106
is what's known as a recycled threat. 107 107
Now, recycled threat refers to the process 108 108
of combining and modifying parts of existing exploit code 109 109
to create new threats that are not as easily identified 110 110
by automated scanning. 111 111
Again, if we take different pieces and parts 112 112
of different malware code and we put them together, 113 113
we can now bypass the signature-based detection 114 114
of a known threat because it is now something new. 115 115
We've recycled it, we've changed it, 116 116
and now we might be able to get it through that system 117 117
and pass the anti-malware scans. 118 118
The next two we're going to talk about 119 119
is known unknowns and unknown unknowns. 120 120
Now known unknowns is a classification of malware 121 121
that contains obfuscated techniques 122 122
to circumvent signature matching and detection. 123 123
When we talk about unknown unknowns, 124 124
this is a classification of malware 125 125
that contains completely new attack vectors and exploits. 126 126
Now, these both come from this chart, 127 127
and you'll see here I have four quadrants on the screen 128 128
I have the unknown knowns, the known knowns, 129 129
the unknown unknowns, and the known unknowns. 130 130
Now when I deal with all of these 131 131
and we start looking at them, 132 132
each one is going to tell us something different. 133 133
And when we take our malware that we're looking at, 134 134
we can put it in one of these four categories. 135 135
For instance, if we start in the upper right corner 136 136
we have the known knowns. 137 137
These are things that we are certain of. 138 138
We have a piece of malware, we have a good signature for it, 139 139
and therefore it is a known threat. 140 140
We know what it is, and when it comes into our system 141 141
we immediately can stop it, we can block it, 142 142
we can alert on it, whatever we need to do 143 143
because we are certain, we are clear and transparent 144 144
this is a bad thing. 145 145
Now, the next one we have is what's known 146 146
as an unknown known, this is on the top left. 147 147
Now, an unknown known is something that is known 148 148
to other people, but it may not be known to you. 149 149
For example, there might be a signature out there 150 150
inside the McAfee firewall, 151 151
but there's not one inside your firewall. 152 152
And so McAfee knows about it and they can stop it, 153 153
it's a known thing, but to you it's unknown. 154 154
And that's what an unknown known is, that top left corner. 155 155
Now the two we really have to be concerned with 156 156
is the bottom of this chart, 157 157
and this is our known unknowns and our unknown unknowns. 158 158
When we deal with a known unknown, 159 159
this is where this is something that is an unknown thing, 160 160
we don't have a signature for it. 161 161
All the things here on the bottom where they are 162 162
something unknown means we don't have a signature. 163 163
Now if it's a known unknown, 164 164
these are things that we can't predict 165 165
so we need to start doing research 166 166
to start reducing the uncertainty we have around this thing. 167 167
This unknown has to become known at some point, 168 168
and so what we do is we know that it's bad 169 169
that's the known part of it, 170 170
but we don't know any signatures that are related with it 171 171
so we don't have an easy way to block it. 172 172
And this is generally where you're going to see 173 173
a lot of your behavior-based analysis being done. 174 174
And then we have our unknown unknowns. 175 175
Now when you do a unknowns unknowns, 176 176
these are things that we don't know 177 177
and we just don't have any way to know about it yet. 178 178
And so we have to experiment more and more, 179 179
and we have to do a lot more research, 180 180
and try to figure these things out. 181 181
For example, if there is a zero-day, 182 182
we've never seen it before, 183 183
and it's doing something that we never thought 184 184
was malicious behavior, this is an unknown unknown. 185 185
And eventually we might find out, 186 186
oh, that thing they're doing with these 20 steps, 187 187
when you put all those together, that is a bad thing. 188 188
And so then it becomes a known unknown, 189 189
and eventually if we can create a signature, 190 190
we can make it a known known. 191 191
And so that's the idea here, 192 192
when we start dealing with these threat classifications. 193 193
For the exam, no one is going to ask you 194 194
to put a threat into one of these categories, 195 195
but in the real world 196 196
this is a good way to think about things 197 197
as you start bucketing pieces of malware 198 198
and different behavior you're seeing within your network. 199 199
And all of this is based on a concept known 200 200
as the Johari Window. 201 201
In the Johari Window, you have four quadrants again. 202 202
We have open, blind, hidden, and unknown, 203 203
and our whole goal is to try to get things known more by us. 204 204
And so if it's something that is known to ourself 205 205
and known to others, that's open. 206 206
For instance, we all know that two plus two equals four, 207 207
that is an open piece of knowledge that everybody knows. 208 208
Now there are some things that are known to yourself 209 209
but they're not known to others, and we call these hidden. 210 210
For instance, I know a lot about cybersecurity 211 211
and you may not know as much as I do, 212 212
but if there's things that are known to me 213 213
but not known to you, well, if I tell you about them 214 214
it's going to move you from this hidden area 215 215
up into the open area where you start learning about it too, 216 216
and now it's known to me and you. 217 217
When we start dealing with other things, 218 218
there might be things that you know, but I don't know, 219 219
and so I am blind to those things. 220 220
For me to know about those things that I'm blind to, 221 221
you have to tell me. 222 222
And so if you tell me about it 223 223
it's going to take me from blind into open. 224 224
And then if we have an unknown, 225 225
that means you don't know it and I don't know it, 226 226
so it's not known to others and it's not known to me. 227 227
And so in that area, we have to, 228 228
one of us has to eventually discover it, 229 229
and once we do, we can then tell the other 230 230
and we can get ourself back up to open. 231 231
The goal here is we always want to try to get to open 232 232
if we can, and that's the idea here with malware. 233 233
If we have something that is unknown 234 234
but a security researcher learns about it, 235 235
they can tell others about it, and when they do, 236 236
that helps bring us into either the hidden or the blind, 237 237
and then from hidden or blind over to open. 238 238
Once we all know about it, it becomes open, 239 239
it becomes very easy to know this as a known threat 240 240
and it's something that we can build a signature 241 241
or automation to block that attack.