Week 5

Question 1

What is the motivation for Common Attack Pattern Enumeration and Classification?

Answer 1

To better understand adversaries. Attackers versus enterprises: attackers are better at sharing information and identifying problems in the systems. Enterprises don’t reveal their security problems because of legal, protect themselves from competitors.

CAPEC aims to standardise the language and improve communication between enterprises. CAPEC is not a modelling technique. It is a catalogue and does not prioritise attacks. It is largely technically focused.

(see http://capec.mitre.org)

Question 2

What does the MITRE Corporation do?

Answer 2

Advocates attack patterns to help organisations. It’s a blueprint to discuss specific types of attacks.

Question 3

What are 3 classifications of attack patterns?

Answer 3

1) architecture - protocols and processes
2) artefact - specifics of the system
3) external

Question 4

What is STRIDE?

Answer 4

• It’s a framework for thinking, discussing and classifying threats.
• Designed to get software developers to consider common threats when designing and implementing software.
• It supports software development.
• Not a modelling technique.

Question 5

What does STRIDE stand for?

Answer 5

1) Spoofing : when an attacked masquerades as something it’s not itself.
2) Tampering: attack that modifies some data
3) Repudiation: refers to rejection of responsibility of actions. e.g. purchasing a movie on Sky box movies. It’s important for the enterprise that the individual accepts responsibility that they purchased the movie.
4) Information disclosure: information has been disclosed to some party it shouldn’t be disclosed to.
5) Denial of Service: consuming resources to the detriment of others, e.g. hit the system with zombies.
6) Elevation of privileges: an entity executing at a level that it’s not permitted to.

Question 6

What are attack trees used for?

Answer 6

Modelling adversary behaviour. Can be considered a formal approach of organising and discussing threats to enterprises.

Question 7

What are the benefits of attack trees?

Answer 7

They reveal what is crucial to consider rather than what’s perceived to be important.
Acts as documentation for systems.
You can construct numerous attack trees from different perspectives, eg cost, whether it’s intrusive/not.
You can create a library of attack trees that can be used in various instances.

Question 8

What are the concerns of attack trees?

Answer 8

Sometimes can be incomplete around unknown attacks. They should be supported with research, investigation and peer-review.

Question 9

What is the root of the attack tree?

Answer 9

The base of the attack and the motivation of the attack. We want to consider all of the branches which can achieve the motivation.

Question 10

What are sub-goals?

Answer 10

We decompose goals (i.e. the root of the attack tree) into subgoals. It’s basically ways that attackers can achieve their motivation. Subgoals can be decomposed further and further.

Question 11

What logic do attack trees use?

Answer 11

Attack trees can be “AND” or “OR” gates.

Question 12

What labels can he give attack trees?

Answer 12

Possible/impossible, based on our research. In this case, possible/impossible are just examples of perspectives. Another perspective could be intrusive or non-intrusive attack.
We can use the relevant AND/OR logic in the attack tree to see whether the adversary’s goal can be achieved.

Question 13

What is a kill chain?

Answer 13

It is a military concept to determine the anatomy of the attack and anticipate a future attack

Question 14

What are the phases of cyber kill chain approach?

Answer 14

-Generally from external attacks

1) reconnaissance: attack identifies targets/enterprise vulnerabilities to focus on, e.g via social media.
2) weaponisation - potentially insert malware or deactivate controls within the organisation.
3) delivery - delivering the malicious piece of software into the organisation to exploit the organisation. How are they going to do this?
4) exploitation - exploiting the vulnerability in the system. eg target entry level non-technical staff (HR) and propagate through the network.
5) installation - install more tools and software to gain greater control in the organisation and propagate across the network.
6) command and control (C2) - got control over a system and propagate.
7) action on objectives - get the info out of the organisation and profit on the information.

Question 15

What are Hutchins et al. 5 defensive steps?

Answer 15

1) Detect attackers exploring the network or accessing systems
2) Deny any attempt to tamper with data
3) Disrupt any outbound transfer of data
4) Degrade the impact on the organisation
5) Deceive the attacker

Question 16

What is the Course of Action (CoA) matrix?

Answer 16

It is the phases of cyber kill chain X Hutchins et al 5 defensive steps.

Question 17

What are ways that an attacker can deliver the malware?

Answer 17

Phishing
Spear-phishing
Malvertisement
Traffic disruption system.

Question 18

What is an insider?

Answer 18

A trusted individual that exploits/intends to exploit access and/or knowledge of enterprise assets for unauthorised purposes.

Question 19

What are common malicious insider actions?

Answer 19

privilege abuse
mishandling of data
use of non-approved hardware
privilege possession

Question 20

What are common non-malicious insider actions?

Answer 20

Phishing
Poor passwords
Devices not properly secured
sharing passwords
networks not properly secured

Question 21

What are the types of insiders?

Answer 21

malicious
compromised insiders
careless insiders

Question 22

Where do insiders come from?

Answer 22

• often disgruntled employees

Question 23

What is the Fraud Triangle?

Answer 23

3 aspects that motivate insiders

1) Motivation - what’s the motivation for an employee to become an insider?
2) Opportunity
3) Rationalisation - insiders justify their actions.

Question 24

What are the goals of insiders?

Answer 24

fraud
sabotage
theft
mistakes
(the list goes on, but these are the most common)

Question 25

What are some common insider attacks?

Answer 25

privilege escalation - either horizontal or vertical
exfiltration attacks - transfer the assets outside the perimeter of the enterprise so you can gain from them
phishing

Question 26

What is the Saxena Cyber Kill Chain Model and what are the phases?

Answer 26

Adapts the original cyber kill chain model to focus on insiders.
Phases are:
Tipping: revealing where an insider is formed.
Reconnaissance: the insider will way to identify valuable data or assets to the enterprise. They may also reveal important roles, project names or sensitive relationships to outsiders.
Exploitation: targeting the weaknesses of the organisation. Insiders could potentially use tools.
Acquisition: tools that are used every day can be used to acquire assets
Exfiltration: get info out of the organisation and into the hands of the attacker.