Do you ever play laptop video games equivalent to Halo or Gears of Battle? In that case, you’ve undoubtedly observed a sport mode referred to as Seize the Flag that pits two groups towards one another – one that’s answerable for defending the flag from adversaries who try to steal it.
This kind of train can also be utilized by organizations to gauge their skill to detect, reply to, and mitigate a cyberattack. Certainly, these simulations are key for pinpointing weaknesses in organizations’ programs, individuals and processes earlier than attackers reap the benefits of them. By emulating sensible cyberthreats, these workouts let safety practitioners additionally finetune incident response procedures and beef up their defenses towards evolving safety challenges.
On this article, we’ve have a look at, in broad brush phrases, how the 2 groups duke it out and which open-source instruments the defensive facet might use. First off, a super-quick refresher on the roles of the 2 groups:
- The pink staff performs the position of the attacker and leverages techniques that mirror these of real-world risk actors. By figuring out and exploiting vulnerabilities, bypassing the group’s defenses and compromising its programs, this adversarial simulation supplies organizations with priceless insights into chinks of their cyber-armors.
- The blue staff, in the meantime, takes on the defensive position because it goals to detect and thwart the opponent’s incursions. This includes, amongst different issues, deploying numerous cybersecurity instruments, preserving tabs on community site visitors for any anomalies or suspicious patterns, reviewing logs generated by completely different programs and purposes, monitoring and amassing information from particular person endpoints, and swiftly responding to any indicators of unauthorized entry or suspicious habits.
As a facet observe, there’s additionally a purple staff that depends on a collaborative strategy and brings collectively each offensive and defensive actions. By fostering communication and cooperation between the offensive and defensive groups, this joint effort permits organizations to determine vulnerabilities, check safety controls, and enhance their general safety posture via an much more complete and unified strategy.
Now, going again to the blue staff, the defensive facet makes use of quite a lot of open-source and proprietary instruments to meet its mission. Let’s now have a look at a couple of such instruments from the previous class.
Community evaluation instruments
Arkime
Designed for effectively dealing with and analyzing community site visitors information, Arkime is a large-scale packet search and seize (PCAP) system. It options an intuitive net interface for looking, looking for, and exporting PCAP information whereas its API permits you to immediately obtain and use the PCAP and JSON-formatted session information. In so doing, it permits for integrating the info with specialised site visitors seize instruments equivalent to Wireshark through the evaluation stage.
Arkime is constructed to be deployed on many programs directly and may scale to deal with tens of gigabits/second of site visitors. PCAP’s dealing with of enormous quantities of knowledge is predicated on the sensor’s obtainable disk house and the size of the Elasticsearch cluster. Each of those options might be scaled up as wanted and are underneath the administrator’s full management.
Supply: Arkime
Snort
Snort is an open-source intrusion prevention system (IPS) that screens and analyzes community site visitors to detect and forestall potential safety threats. Used extensively for real-time site visitors evaluation and packet logging, it makes use of a sequence of guidelines that assist outline malicious exercise on the community and permits it to seek out packets that match such suspicious or malicious habits and generates alerts for directors.
As per its homepage, Snort has three fundamental use instances:
- packet tracing
- packet logging (helpful for community site visitors debugging)
- community Intrusion Prevention System (IPS)
For the detection of intrusions and malicious exercise on the community, Snort has three units of worldwide guidelines:
- guidelines for neighborhood customers: these which are obtainable to any consumer with none value and registration.
- guidelines for registered customers: By registering with Snort the consumer can entry a algorithm optimized to determine far more particular threats.
- guidelines for subscribers: This algorithm not solely permits for extra correct risk identification and optimization, but additionally comes with the power to obtain risk updates.
Supply: Snort
Incident administration instruments
TheHive
TheHive is a scalable safety incident response platform that gives a collaborative and customizable house for incident dealing with, investigation, and response actions. It’s tightly built-in with MISP (Malware Info Sharing Platform) and eases the duties of Safety Operations Heart (SOCs), Laptop Safety Incident Response Group (CSIRTs), Laptop Emergency Response Group (CERTs) and another safety professionals who face safety incidents that have to be analyzed and acted upon shortly. As such, it helps organizations handle and reply to safety incidents successfully
There are three options that make it so helpful:
- Collaboration: The platform promotes real-time collaboration amongst (SOC) and Laptop Emergency Response Group (CERT) analysts. It facilitates the mixing of ongoing investigations into instances, duties, and observables. Members can entry related info, and particular notifications for brand new MISP occasions, alerts, e-mail studies, and SIEM integrations additional improve communication.
- Elaboration: The instrument simplifies the creation of instances and related duties via an environment friendly template engine. You possibly can customise metrics and fields by way of a dashboard, and the platform helps the tagging of important information containing malware or suspicious information.
- Efficiency: Add wherever from one to hundreds of observables to every case created, together with the choice to import them immediately from an MISP occasion or any alert despatched to the platform, in addition to customizable classification and filters.
Supply: TheHive
GRR Fast Response
GRR Rapid Response is an incident response framework that permits reside distant forensic evaluation. It remotely collects and analyzes forensic information from programs with the intention to facilitate cybersecurity investigations and incident response actions. GRR helps the gathering of varied kinds of forensic information, together with file system metadata, reminiscence content material, registry info, and different artifacts which are essential for incident evaluation. It’s constructed to deal with large-scale deployments, making it notably appropriate for enterprises with numerous and in depth IT infrastructures.
It consists of two components, a shopper and a server.
The GRR shopper is deployed on programs that you just need to examine. On every of those programs, as soon as deployed, the GRR shopper periodically polls the GRR frontend servers to confirm if they’re working. By “working”, we imply executing a selected motion: obtain a file, enumerate a listing, and so forth.
The GRR server infrastructure consists of a number of parts (frontends, staff, UI servers, Fleetspeak) and supplies a web-based GUI and an API endpoint that enables analysts to schedule actions on purchasers and to view and course of the collected information.
Supply: GRR Rapid Response
Analyzing working programs
HELK
HELK, or The Looking ELK, is designed to supply a complete atmosphere for safety professionals to conduct proactive risk looking, analyze safety occasions, and reply to incidents. It leverages the ability of the ELK stack together with extra instruments to create a flexible and extensible safety analytics platform.
It combines numerous cybersecurity instruments right into a unified platform for risk looking and safety analytics. Its main parts are Elasticsearch, Logstash, and Kibana (ELK stack), that are extensively used for log and information evaluation. HELK extends the ELK stack by integrating extra safety instruments and information sources to boost its capabilities for risk detection and incident response.
Its goal is for analysis, however attributable to its versatile design and core parts, it may be deployed in bigger environments with the precise configurations and scalable infrastructure.
Supply: HELK
Volatility
The Volatility Framework is a set of instruments and libraries for the extraction of digital artifacts from, you guessed it, the unstable reminiscence (RAM) of a system. It’s, subsequently, extensively utilized in digital forensics and incident response to research reminiscence dumps from compromised programs and extract beneficial info associated to ongoing or previous safety incidents.
Because it’s platform-independent, it helps reminiscence dumps from quite a lot of working programs, together with Home windows, Linux and macOS. Certainly, Volatility also can analyze reminiscence dumps from virtualized environments, equivalent to these created by VMware or VirtualBox, and so present insights into each bodily and digital system states.
Volatility has a plugin-based structure – it comes with a wealthy set of built-in plugins that cowl a variety of forensic evaluation, but additionally permits customers to increase its performance by including customized plugins.
Supply: Volatility
Conclusion
So there you could have it. It goes with out saying that blue/pink staff workouts are important for assessing the preparedness of a corporation’s defenses and as such are important for a strong and efficient safety technique. The wealth of knowledge collected all through this train supplies organizations with a holistic view of their safety posture and permits them to evaluate the effectiveness of their safety protocols.
As well as, blue groups play a key position in cybersecurity compliance and regulation, which is very vital in extremely regulated industries, equivalent to healthcare and finance. The blue/pink staff workouts additionally present sensible coaching eventualities for safety professionals, and this hands-on expertise helps them hone their abilities in precise incident response.
Which staff will you join?
