Our Approach and Methodology
Through system and network baselining, network and host-based monitoring, and
signature detection and creation, SecureState’s Threat Modeling is successful in
identifying malicious activity and APT communication that suddenly becomes
active or hides within legitimate traffic. SecureState’s Threat Modeling
consists of four primary methodologies:
1. Preparation Controls
- Active end-point and corporate penetration testing
- Active testing of IR procedures and data collection
- Ensure logging and monitoring and alerting are in-place
- Baseline systems and network activity
- Data Discovery and Classification Controls
2. Real-time Monitoring and Intelligence Gathering Controls
- Network and system communication traces
- Incorporate emerging threats and prior IR intelligence
- Data aggregation, correlation and alerting
- Baseline threshold monitoring
- System and Network baseline health checks
3. Real-Time Investigation Controls
- Validation of threat events
- Rapid containment and blocking strategies
- Virtual IRT Deployment
4. Real-Time Host Interrogation Controls
- Rapid investigation response
- Correlation of system artifacts, trends and anomalous patterns
- Evidence collection
Threat Intelligence
Threat intelligence is the heart of Persistent Threat Modeling; without it
there would be no value. Threat Intelligence can be gathered through
several methods: partnerships with law enforcement, government agencies, and
security professionals. Primarily, however, Threat Intelligence should
consist of the collected data and analysis of IR investigations and Penetration
assessments. SecureState employs this primary method to enhance and build
our attacks trends and evolving and emerging threat indicators.
SecureState has a powerful differentiator with intelligence gathering and
analysis: SecureState knows how organizations are compromised and impacted
because we do hacking and IR exercises daily, and incorporate our results and
analysis. SecureState has the ability to use cutting-edge attack
techniques, monitor the attack methods and responses, develop custom threat
indicators, and then correlate and combine with external threat sources and
analysis – providing a dynamic and powerful monitoring solution. The ideal
Threat Intelligence will combine integrated forensic, hacker and risk
perspectives:
- Incident Response Team members should actually sit down with the IT and
security staff to help monitor and identify attacks while performing an
active attack (i.e. penetration test) concurrently. This fosters a vehicle
to monitor, collect and develop attack and compromise indicators.
- Incident response should be augmented from a hacker’s point of view.
- Attack patterns, compromise responses, and C2 communications should be
actively captured and incorporated into evolving Threat Database.
- Intelligence gathering should identify and validate incident’s impact and
an organization’s risk controls concurrently.
- Intelligence should provide an integrated response to determine how, when,
why, and where a compromise or incident occurred.
- Proactively become part of other testing and evaluation professionals, and
state and local responders, who are actively engaged in and manage incidents
–share information, methodologies and intelligence.
All Seeing Solution - ARGUS
The
ability to counter and contain advanced threats requires a solution that can
rapidly reach out to endpoints and within the network to collect evidence and
determine incident scope and business impact. ARGUS is a deployable
solution that integrates within an organization’s environment and provides
forward-reaching capabilities that follow the Persistent Threat Modeling
Methodologies:
- Monitor for rogue activity
- Provide real-time alerts and active blocking
- Provide persistent threat intelligence and trends
- Perform data discovery and mapping
- Perform remote penetration and IR testing
- Provide live analysis of suspect system and network activity
- Provide evidence repository for data collection and correlation
- Monthly system health checks