3 ms·
"Attackers" usually have a single mission in mind (exfiltrate juicy data, destabilize the target, hold juicy data for ransom, etc.) and have the privilege of ex
by nunez 2y ago
"Attackers" usually have a single mission in mind (exfiltrate juicy data, destabilize the target, hold juicy data for ransom, etc.) and have the privilege of exploring as deeply as needed until the mission is accomplished.
"Defenders" (like the SOC) have to think in lists because they're tracking many signals and threat vectors at a time and need to prioritize which ones warrant their attention/require action because a regulator told them so (think high-scoring CVEs against code that's been deprecated forever ago).
Without having "defenders" post in random places along the graph looking for interesting activity, I don't know how they'll be able to "think in graphs". To wit, the suggestions that the author made would be, you guessed it, signals in a list that a "defender" would check against!
- beardedwizard 2y agoI disagree with this. In my experience we saw the red team use graph techniques to plot paths to high value assets over and over, where defenders were not even thinking about this approach. As soon as they did, they identified potential attacks before the red team launched them. Smart teams will immediately adopt the red team technology that, for example, crawls AWS as a graph looking for paths to from low to high value accounts. Its not a zero sum or sea change thing, but defenders absolutely can think more like attackers and leverage attacker tools more often in the act of defense.
- uberman 2y agoHow do you define and track high values assets? Perhaps in a list?
- Jerrrrrrry 2y agoHigh values can exist on different dimensions. The CEO is worth more in some ways than the HR lady. The HR lady is worth much, much more than the CEO in other ways. This added dimension turns the 1D list into a 2D map, or a graph.
- deleted 2y ago[deleted]
- soulofmischief 2y agoThis is why I think having separate red/blue teams or roles in a cybersec outfit is best, allow each individual or unit to fully utilize each technique most effectively and synthesize the results.
- obscurette 2y ago> "Attackers" usually have a single mission in mind ... No. This is a very common misconception, but in reality a vast majority of attacks is carried out as "lets look around what we can find and will see how we'll use it". The same actually applies to a lot of attacking activities – intelligence, influence operations, propaganda etc.
- galacticaactual 2y agoNo.
- hodgesrm 2y agoLet's take an example: protecting a car. There are countless possible attacks on the software that runs automobiles, but the most common attacker goal is to steal the car. That means you want to protect the paths to that goal, regardless of what they look like or whether they are even specific to software. Sure, attackers can also exploit CVEs to DOS the entertainment system but who really cares if that happens?