3 ms·

SOC = Security Operation Center ? I still do not fully understand, either "the user" in your diagram is only theoretical, and it is actually the same person as

by jaclaz 4y ago

SOC = Security Operation Center ? I still do not fully understand, either "the user" in your diagram is only theoretical, and it is actually the same person as "the analyst", if so it starts making sense, though the e-mail exchanges become pretty much unneeded or the idea is that there is a dedicated (24/7) service with an analyst available, still I cannot see how "the user" will (should) choose which e-mail(s) to send to "the analyst", either ALL incoming e-mail, or only "suspect" ones [0]. [0] but if "the user" can actually determine that an e-mail is a "suspect" one, very likely he/she won't fall for the phishing anyway, whilst if "the user" is not capable of that, very likely many phishing e-mails won't ever be sent to "the analyst".

emalderson 4y ago
Many emails may be safe and still raise some suspicion. Moreover, if the users who are meant to use the tool are not so tech savvy, then they may send all the emails to the SOC analyst. The safe ones will be usually flagged as safe rapidly, while the analyst should analyze in depth only the suspicious ones.
- jaclaz 4y ago
  OK, so it is the second, in theory all emails should be sent to be analyzed and only those that the software finds suspect will be further checked by "the analyst". I suspect - but I have no idea of the amount/volumes involved - that the service will need lots of analysts even for small organizations. If we assume a perfect human analyst can check (say) 4 mails per hour, and that a "normal" user receives 50 mails per day, of which the automated part clears (or flags) correctly 49, a 24/7 service (that to be covered needs 6-8 people at least) can manage 100 mails per day and we get to some 7 analysts every 100 users. If the users are tech-savvy it doesn't change that much as instead of 50 mails per day per user (of which 49 will be treated by the automated part) the service will be sent (still say) only 2, of which 1 will be treated by the automated part, but 1 (same as before) will need the attention of the human analyst. If my assumptions are in the right ballpark, it seems to me like this whole stuff (while very nice in theory) will have very few real world implementations.
  - emalderson 4y ago
    You're right from the start. Obviously, this is a PoC tool that is not mature enough to be used in a real-world and big-enterprise scenario. I have some ideas on how to make it more usable, like the automatic analysis of all emails by the tool and the creation of a case only when necessary. However, these last ideas will be only implementable when the API for TheHive 5 becomes stable, because of the many new features the latest version of TheHive offers. However, as you may agree, phishing is one of such things that cannot be completely automated. If this wasn't true, there would be no need for a tool like this, since the big tech companies that run email services would have already solved the problem with their automated inbox scanners. Those scanners can help filter some attacks, but they are far from being perfect, and this is why you receive phishing emails in your inbox in the first place. A human analyst should always be needed if you wanted to analyze incoming emails, and this tool is just a way to simplify the job of that analyst, not to completely replace him.
    - jaclaz 4y ago
      I think you had a little slip of the fingers, you mean anti-phishing, phishing in itself is already automated enough ;). I don't want to seem (more than what I actually am) an old, grumpy, bastard and I actually like your idea, it seems to me a very good one in the context of its original development (your dissertation), only that attempting to actually implement it (even once the automation of the analysis will be possible) in the real world is impossible/cost prohibitive for any organization and the few (government?) high risk ones (with unlimited budgets) probably already have something similar. When/if the human analyst will be replaced by some more sophisticated automatic method (maybe the Artificial Intelligence that everyone is babbling about lately) it might become affordable to have this kind of added protection, but until then (as said assuming that my calculations are roughly correct) noone can possibly use this approach as it simply would cost way too much.
      - emalderson 4y ago
        Of course I forgot the word "detection" after phishing, thanks for pointing that out. Apart from that, I repeat that I'm conscious about what you are saying. This is the fundamental problem of phishing and social engineering techniques detection in general. I just can't think of a better way to solve the problem without a human analyst nowadays. Maybe in the future, with the improvement of the AI engines out there, there will be a new way of handling the problem. I appreciate constructive criticism and I know the problems my tool, which was born out of curiosity to automate a SOC + threat intelligence workflow, is subjected to. I may really appreciate also any suggestion or advice on how the workflow could become more usable in the real world.

by jaclaz 4y ago

emalderson 4y ago

Many emails may be safe and still raise some suspicion. Moreover, if the users who are meant to use the tool are not so tech savvy, then they may send all the emails to the SOC analyst. The safe ones will be usually flagged as safe rapidly, while the analyst should analyze in depth only the suspicious ones.

jaclaz 4y ago
OK, so it is the second, in theory all emails should be sent to be analyzed and only those that the software finds suspect will be further checked by "the analyst". I suspect - but I have no idea of the amount/volumes involved - that the service will need lots of analysts even for small organizations. If we assume a perfect human analyst can check (say) 4 mails per hour, and that a "normal" user receives 50 mails per day, of which the automated part clears (or flags) correctly 49, a 24/7 service (that to be covered needs 6-8 people at least) can manage 100 mails per day and we get to some 7 analysts every 100 users. If the users are tech-savvy it doesn't change that much as instead of 50 mails per day per user (of which 49 will be treated by the automated part) the service will be sent (still say) only 2, of which 1 will be treated by the automated part, but 1 (same as before) will need the attention of the human analyst. If my assumptions are in the right ballpark, it seems to me like this whole stuff (while very nice in theory) will have very few real world implementations.
- emalderson 4y ago
  You're right from the start. Obviously, this is a PoC tool that is not mature enough to be used in a real-world and big-enterprise scenario. I have some ideas on how to make it more usable, like the automatic analysis of all emails by the tool and the creation of a case only when necessary. However, these last ideas will be only implementable when the API for TheHive 5 becomes stable, because of the many new features the latest version of TheHive offers. However, as you may agree, phishing is one of such things that cannot be completely automated. If this wasn't true, there would be no need for a tool like this, since the big tech companies that run email services would have already solved the problem with their automated inbox scanners. Those scanners can help filter some attacks, but they are far from being perfect, and this is why you receive phishing emails in your inbox in the first place. A human analyst should always be needed if you wanted to analyze incoming emails, and this tool is just a way to simplify the job of that analyst, not to completely replace him.
  - jaclaz 4y ago
    I think you had a little slip of the fingers, you mean anti-phishing, phishing in itself is already automated enough ;). I don't want to seem (more than what I actually am) an old, grumpy, bastard and I actually like your idea, it seems to me a very good one in the context of its original development (your dissertation), only that attempting to actually implement it (even once the automation of the analysis will be possible) in the real world is impossible/cost prohibitive for any organization and the few (government?) high risk ones (with unlimited budgets) probably already have something similar. When/if the human analyst will be replaced by some more sophisticated automatic method (maybe the Artificial Intelligence that everyone is babbling about lately) it might become affordable to have this kind of added protection, but until then (as said assuming that my calculations are roughly correct) noone can possibly use this approach as it simply would cost way too much.
    - emalderson 4y ago
      Of course I forgot the word "detection" after phishing, thanks for pointing that out. Apart from that, I repeat that I'm conscious about what you are saying. This is the fundamental problem of phishing and social engineering techniques detection in general. I just can't think of a better way to solve the problem without a human analyst nowadays. Maybe in the future, with the improvement of the AI engines out there, there will be a new way of handling the problem. I appreciate constructive criticism and I know the problems my tool, which was born out of curiosity to automate a SOC + threat intelligence workflow, is subjected to. I may really appreciate also any suggestion or advice on how the workflow could become more usable in the real world.