- So our next speaker is gonna be Matt Snyder from VMware.
So going from sort of interesting
and different responses that people can take
to ATT&CK techniques,
we have another theme today
of interesting use cases, which we're always intrigued by.
So ATT&CK's focused on the behaviors
of external threat actors,
but our next speaker is putting it to use
in the important space of insider threat.
Please welcome the ATT&CKcon stage, Matt Snyder.
(audience clapping)
- Thank you everyone.
I'm really excited to be here
and discuss this really important topic.
So over the last few days and even into today,
you know, we've heard a lot about external adversaries,
and what they're doing and how we can use ATT&CK
to defend against them.
And I'm here to talk about one of the biggest adversary
in everybody's environment, and that's our insider threat.
So this talk's broken into three sections
and we're gonna build upon each section as we go through.
There's a lot of slides.
I'm gonna fly through some of 'em,
just so we fit our time formatting
and I'm happy to make these slides available after the talk.
So the first thing, like I said,
everybody has an insider threat problem.
It doesn't matter what industry you're in
and it doesn't matter what size your organization is.
And that threat over the last few years
has really grown significantly.
Here I'm showing two reports.
One from Code 42 and one from Hitachi ID.
That's really showing how this threat has evolved.
Since the beginning of COVID,
we've seen this big shift in employee's attitude
towards their body of work.
They now believe that this work belongs to them,
not the company that they work with.
And when they leave that organization,
they feel comfortable taking that information with them.
And we're in the middle of the great resignation.
So as you can see from this other metrics
that over half of companies,
we need to build a program
that's gonna rely on more technical abilities
that we develop ourself.
But sometimes we struggle with getting started
and it looks a little bit like this.
You know, we're looking for that any key
to get our foot in the door so we can start doing this.
And then what ends up happening?
You know, we don't have that framework.
We don't get started, you know, time flies,
and we end up being rolled onto different initiatives.
And before, you know, we know it, nothing was ever done
and the program's left where it continued to be.
But what if we took something like MITRE ATT&CK
and we map that to our insider threats.
'Cause when we look at the insider threat cases,
they're not that different
from the things that we're seeing here.
They operate in similar ways as an adversary,
because what is an adversary trying to do?
They're trying to look like an employee
so they can carry out their ATT&CK longer.
So instead of building our own insider threat program
that's completely devoid of anything that already exists.
You know, we've treated it like this own individual problem
that needed its own solution.
We needed its own tools.
We had to treat this completely differently.
And then we've kind of come to the realization,
at many organizations is,
this is just too complicated of a problem to solve,
so nothing ever gets done with it.
But what if we looked at it like this.
Here we have an insider that's more focused
on exfil trading data.
So some of the threat profiles that this might,
you know, hit against are like the oblivious user,
more importantly, the negative or the negligent
and the data hoarder.
These people know what they're doing.
They're after this information.
And these are the people that are gonna try to take it
when they leave.
And when we zoom in, 'cause I know that's hard to read,
now we can see that the insider,
because they already likely have access to all of this data
they're not that concerned
with initial access and persistence.
They're really just after the data and exfiltrating it.
And these techniques are rudimentary.
It's right click, copy, paste.
You're downloading things from some internal repository
that's easy to get to,
and you're copying it to an external drive.
Most organizations allow a hard drive
to be connected to a device.
They allow things like external file shares
and things like that.
Even if it's against policy, it can still happen.
So we don't have to have these really advanced users
taking advantage of some really easy-to-use techniques.
Getting into the rogue employee.
This one's where it gets really interesting.
This is the one that kind of mimics an adversary.
You know, they're out to create chaos, inflict damage,
maybe they have a score to settle.
And because they're an insider,
they have got this tremendous access
to your organization to carry out any type of attack
that they might want to.
And when we zoom in,
what I think is really important about this threat profile
is persistence and defense evasion.
With this malicious insider, you can look for them
to find ways to stay in the environment.
Expecting that their attack
is eventually going to be discovered,
what can they do to get back in to prolong the attack?
What are the things that they can do
to avoid being discovered?
You know, are they trying to disable things like antivirus?
Are they messing with fogs?
You know, if this is a domain admin
and they have the ability to shut down some tools,
you know, are they trying to do that?
So that's really important that if you suspect,
you know, an employee of being rogue,
you need to find persistence
and you need to make sure that you close those doors
before you take action against that employee.
Now this kind of brings the last example,
is this accident or was this intentional?
This is what I really love about the insider threat,
because you're gonna have one of two outcomes
when you talk to that user.
And I'll zoom in a little bit more.
They're either gonna say, "Oops, that was an accident.
"I didn't mean to do that."
Or they're gonna pretend that it wasn't them,
that they didn't do it.
It doesn't matter what evidence that you bring against them.
You know, you could have video evidence
and you can have your forensic evidence
and then you could have anything else.
You know, you could have a statement
from their mom that said they were there
and they watched this employee do this activity,
and they're gonna still deny it.
So I think what's important for us as investigators
is being able to use a tool like the MITRE ATT&CK framework
to understand all the possibilities.
So when we do these investigations,
and sure enough, when you get that user that says,
"I didn't do it."
And you need to go back with your legal department
and HR department and say,
"Okay, well, they said they didn't do it."
They're not gonna take my word for it.
They're not gonna just accept that.
"Hey, security said they did that."
I think that would be a great addition
to either the detection or maybe the car.
And MITRE just security said so.
And that way we can take a shortcut on some of these
because it happens on, you know, Friday afternoon,
we need that, you know, that MITRE car to say,
"Hey, yeah, this is an official investigative
"because we said so."
So put that in the chat.
Maybe we can get that happening here at ATT&CKcon.
But what I've found was valuable
is I can go back and meet with these business partners
and say, "Hey, these are the things that I've done."
You know, they said they didn't do it.
So let's look at it from an adversary perspective.
We don't see anything from initial access.
That all looks good.
Everything looks in line.
We see no indicators there.
We don't see any indications
that something malicious is being executed
that would give a third party
a foothold to carry it out this attack.
We don't see any lateral movement.
So they're not coming from anywhere else
within the environment.
We don't see any other signs
that would support the claim that they didn't do it.
What we do show is all of these techniques
that indicate that they did it.
We see that some of this activity,
maybe it's aligning with work that they already do.
It aligns with the user's technical capabilities.
Maybe it even aligns with some of the information
that we're finding throughout our investigation,
and these logs that were collected that supports,
that says, "Hey, this person did it."
So now that we've identified these key TTPs,
we need to build intelligent detections.
And I know that everybody here
that's ever built a detection
has done the home or dance of victory
when we think that we've built the perfect detection,
and in the background, the sock is on fire.
So we can't do that.
And Haley talked about this yesterday,
but risk-based alerting is the answer.
And this is an example of what it kind of looks like
when we're mapping it to the insider threat problem.
We've got our user base,
we've got all of our tools and all of our logs,
and then we're doing data analysis on this.
And here you can see we're looking for key techniques.
This is gonna help us understand
the risky behavior that's taking place.
Then we're gonna do our risk analysis
where we can score these events.
And then we can also add in risk modifiers
because maybe this user is on a watch list
because they're on some performance plan
or maybe they're about to leave the company
and that's the prime time for them
to finally act on something.
Same thing with the rogue employee.
We've got all of our logs,
we're applying our risk analysis on top of this,
and we can see the pattern of behavior that allows us
to see a full, clear picture on what's going on,
that, hey, yeah, this aligns
with what that person's saying.
We see the clear signs of the phishing emails.
You know, this is a phishing campaign and we see it
that's pretty widespread that could, you know,
indicate that there's some truth to that statement.
And then we can understand some things like,
hey, is this a repeat offender?
Or is this somebody that should know better?
And they're continuing to act
in these really risky types of endeavors,
and we need to take firmer action on that.
And then lastly, you can have a really simple rule
that's just looking for tactics and techniques.
And if it crosses at a certain threshold,
then you can take action against that.
And that brings me to trying to starting to wrap things up,
is if you're not testing your detections,
you have no idea if they're actually working.
So here's a basic Python script
that'll help you generate a bunch of dummy files.
And in line six through nine,
you can add in some customization
to generate the types of files
and the naming conventions that you want
so you can run this through some testing.
Last thing.
If you've done everything that I've talked about,
this answer should be really clear.
If you get into the situations
where at the end of the your investigation
you're not quite clear, remember your Occam's razor.
The most likely explanation is going to be
what's most likely happening.
Here's some pointers on what Meyer may not be happening.
And then wrapping it up.
You know, prioritize and execute.
There's a lot of tactics
and a lot of techniques that you need to cover.
Start with the ones that are most important to you.
Look at your previous cases, map those to there
so you can start to pay down
some of that technical debt in your investigations,
and then you can grow your program
with the time that you're saving there.
You've gotta work with your business.
You need to understand what's important to them
because you can't bring cases that don't matter.
And then the last thing is follow the ATT&CK pattern.
These are proven techniques of risky behavior.
When we start to align to that, it gives us two things.
It gives us greater confidence in our investigations
that we're finding everything.
And it's allowing us to save time
because we can front load these investigations
by finding these things in our logs
and being proactive versus being reactive.
With that, here's some additional resources and some links.
That brings us to the end.
Thank you everyone.
(audience clapping)
- Thank you so much.
And I think this is a topic that resonates with all of us.
Exactly as you said, whether it's an accident,
or intentional, or rogue employee,
it really is something that we have to really bake
into our own threat models.
And I love what you said in terms of a lot of the practices
and a lot of the operations
and processes we already have apply.
You just have to think about the problem
a little differently.
- Exactly.
- Yeah.
Thank you so much.
- Yeah, thank you.
I'm happy to be here.
Thanks everyone.
(audience clapping)