{"id":7307,"date":"2021-05-25T10:28:50","date_gmt":"2021-05-25T10:28:50","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7307"},"modified":"2021-05-25T17:05:58","modified_gmt":"2021-05-25T17:05:58","slug":"indicators-of-compromise-analysis-is-half-the-story","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/indicators-of-compromise-analysis-is-half-the-story\/","title":{"rendered":"Indicators of Compromise Analysis is Good. A Cyber Security Prevention Strategy is Better"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7307\" class=\"elementor elementor-7307\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Ever fallen into the trap of the \u2018streetlight effect\u2019? Looking for the most obvious things, the factors based on known knowns, without looking past them into the darkness for the hidden or less obvious factors that someone is desperately hoping you won\u2019t see.<\/span><\/p><p><span style=\"font-weight: 400;\">Many organisations do exactly that when they analyse the indicators of compromise from a cyber security breach and take action based solely on them, rather than implementing and maintaining good security practices that prepare the organisation for anything, and could prevent or mitigate the impact of an attack in the first place.<\/span><\/p><p><span style=\"font-weight: 400;\">That said, analysis of indicators of compromise does serve a purpose. Carrying out forensic analysis of any cyber security incident enables organisations to learn from the incident, and <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/attack-isnt-over-until-post-event-analysis-says-so\/\"><span style=\"font-weight: 400;\">reduce the risk of it happening again<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\"> <img decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/outofsite.biz\/cynance\/wp-content\/uploads\/2021\/05\/viber_image_2021-05-11_09-00-42.jpg\" alt=\"null\" \/>\u00a0<\/span><\/p><h2><span style=\"font-weight: 400;\">What are indicators of compromise?<\/span><\/h2><p><span style=\"font-weight: 400;\">Simply put, <\/span><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/indicators-of-compromise\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">indicators of compromise<\/span><\/a><span style=\"font-weight: 400;\"> are evidence that a cyber attack took place. Indicators of compromise sit within an organisation\u2019s network for example in system or network logs, and they may even provide information about the tactics, techniques, and procedures (TTPs) used in the attack, or who the perpetrators are.<\/span><\/p><p><span style=\"font-weight: 400;\">Some of the <\/span><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/indicators-of-compromise\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">most common forms of indicators of compromise<\/span><\/a><span style=\"font-weight: 400;\"> include unusual inbound or outbound traffic, unknown files, applications, and processes in the system, anomalies in user account activity, frequent log-ins or log-outs from multiple accounts, increases in database read volumes, unusual DNS requests, unexpected changes to files or systems.<\/span><\/p><h2><span style=\"font-weight: 400;\">The benefits of analysing indicators of compromise<\/span><\/h2><p><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">Monitoring networks<\/span><\/a><span style=\"font-weight: 400;\"> for indicators of compromise gives the IT security team eyes on what is happening across the network, either in real time, or forensically. It adds another layer of security beyond firewalls and alerting systems, that could pay off for the organisation. If the network is being monitored in near real time, focussing on indicators of compromise may enable the IT security team to identify an attack close to as it is happening, and prevent it from getting worse.<\/span><\/p><p><span style=\"font-weight: 400;\">Ongoing monitoring of indicators of compromise can also help organisations understand where there are weaknesses in their cyber security, especially if the same indicators of compromise are identified again and again. Using this information smartly will enable the organisation to strengthen their defences before an attack occurs.<\/span><\/p><p><span style=\"font-weight: 400;\">Indicators of compromise can also contribute to the forensic analysis of a cyber incident. Analysis of the indicators of compromise can add to the overall picture of what happened, provide understanding of weak spots, and identify whether their current monitoring is focussing on the right areas of the network.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Indicators of compromise analysis can also provide actionable threat intelligence both about a particular malware\u2019s behaviours and techniques, and in general, to improve the organisation\u2019s incident response and remediation strategies.<\/span><\/p><h2><span style=\"font-weight: 400;\">The alternative: A comprehensive cyber security prevention strategy<\/span><\/h2><p><span style=\"font-weight: 400;\">To borrow yet another old saying, prevention is better than cure, and that is most definitely true when it comes to cyber security.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">While analysing indicators of compromise after an attack is a good way to avoid being attacked <\/span><i><span style=\"font-weight: 400;\">again<\/span><\/i><span style=\"font-weight: 400;\">, a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/manchester-united-cyber-attack-a-textbook-response\/\"><span style=\"font-weight: 400;\">cyber security prevention strategy<\/span><\/a><span style=\"font-weight: 400;\"> that implements and maintains good ongoing security practices will protect an organisation from cyber attack before it happens, saving them the time, money, and reputation points that any cyber attack costs.<\/span><\/p><p><span style=\"font-weight: 400;\">Cyber attacks are expensive. The direct costs of a cyber incident include payments to external consultants to discover the extent of the damage, and to work on remediation efforts, costs of buying new, or upgrading software and systems, legal fees, insurance excesses, fines, compensation, and even PR costs.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">In addition, there are indirect costs such as loss of revenue while systems are non-operational, or loss of customers who choose to take their business elsewhere due to a breach.<\/span><\/p><p><span style=\"font-weight: 400;\">Forensic activity can cost an organisation thousands if not millions of pounds, days, weeks, or even months to get back to normal, and serious reputation points among customers and the market. Some businesses simply never recover from a cyber attack. Isn\u2019t it worth spending the time and money to create a plan that will cost a fraction of that if it will save money in the long run, and possibly even save the business?<\/span><\/p><h2><span style=\"font-weight: 400;\">Elements of a cyber security prevention strategy<\/span><\/h2><p><span style=\"font-weight: 400;\">There isn\u2019t a one-size-fits-all solution to an effective cyber security prevention strategy. Every organisation has their own unique circumstances which in turn leads to a unique set of threats and risks. The best cyber security prevention strategies take a layered approach to security, offering defense in depth to the organisation.<\/span><\/p><p><span style=\"font-weight: 400;\"> However every strategy should consider the following elements:<\/span><\/p><p><b>Risk identification and analysis<\/b><\/p><p><span style=\"font-weight: 400;\">The starting point of any cyber security prevention strategy is an understanding of the threats that the organisation faces, and the implications for the organisation if these threats turned into an event. The resulting risk assessment will inform that activity undertaken by the organisation to <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\"><span style=\"font-weight: 400;\">manage those risks<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><b>Infrastructure protection strategy<\/b><\/p><p><span style=\"font-weight: 400;\">Protecting the organisation\u2019s <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\"><span style=\"font-weight: 400;\">network and infrastructure<\/span><\/a><span style=\"font-weight: 400;\"> is integral to a cyber security prevention strategy. Technical solutions such as firewalls, anti-virus programs, <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/improve-email-security-dmarc-email-authentication\/\"><span style=\"font-weight: 400;\">additional filters<\/span><\/a><span style=\"font-weight: 400;\">, threat management systems, and more will prevent many attacks from getting a foothold inside the network to launch an attack. Perimeter alerting systems will also give IT security teams early warning in case of a breach.<\/span><\/p><p><span style=\"font-weight: 400;\">Internal IT security policies such as segregated networks by area of operation, installing patches in a timely manner, using up to date versions of software, and supported versions of hardware will also reduce the vulnerability of the organisation to attack.<\/span><\/p><p><b>Implement a security culture<\/b><\/p><p><span style=\"font-weight: 400;\">Employees are still often the weakest link for any organisation, and <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/smishing-text-messages-are-cyber-attacks-on-phones\/\"><span style=\"font-weight: 400;\">social engineering tactics<\/span><\/a><span style=\"font-weight: 400;\"> are still a successful entry point for many forms of cyber attack. Educating and supporting employees in the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/10-cyber-security-mistakes-to-avoid\/\"><span style=\"font-weight: 400;\">best cyber secure practices<\/span><\/a><span style=\"font-weight: 400;\">, and turning them into security champions will reduce the chance of a breach originating from an employee.<\/span><\/p><p><span style=\"font-weight: 400;\">In addition, make sure that cyber security policies are relevant, up-to-date, and understood by all employees to help them safeguard the organisation. A Bring Your Own Device Policy for example sets out how employees should use their phones in the office, or a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/secure-passwords-dont-protect-network-security\/\"><span style=\"font-weight: 400;\">Password Policy<\/span><\/a><span style=\"font-weight: 400;\"> helps them understand how to protect their data.<\/span><\/p><p><b>Backup and disaster recovery strategy<\/b><\/p><p><span style=\"font-weight: 400;\">While not entirely about prevention, backup and disaster recovery strategies are also crucial for an effective, ongoing cyber security prevention strategy. Regular backups that are easily accessible in a cyber event, and a functionable, tested disaster recovery plan will enable the organisation to get back on their feet as soon as possible, and will save time, money, and reputation in the event that an attack penetrates other defences.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Ever fallen into the trap of the \u2018streetlight effect\u2019? Looking for the most obvious things, the factors based on known knowns, without looking past them into the darkness for the hidden or less obvious factors that someone is desperately hoping you won\u2019t see. Many organisations do exactly that when they analyse the indicators of compromise&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7407,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7307"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7307"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7307\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7407"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}