[Dailydave] Blinken Lights IDS

[dave aitel]

Everyone I know lived through the "Blinken-Lights-IDS" phase. This is
back when you had dial-up or perhaps very early Internet and you were
the only person on your switch, and most importantly, you slept and
lived near your computer and switch because you were a poor college
student or similar. So your entire defense was situated on "Are the
lights blinking when I'm not typing on my computer?"

Ask yourself: How far from that have we come, really?

Honestly, the line that strikes fear into the hearts and minds of all
SOC engineers is "How do you measure your success?". I'm on the Security
Metrics mailing list, which has been around basically forever, and what
they will point out is that good metrics need good data, and we have
about zero of that in almost all aspects of this game. While attackers
have real numbers, the defensive process is literally evolutionary: We
try EVERYTHING and just see which companies fail due to data breaches
and while we don't really learn any lessons directly, maybe the next
generation of companies will be, in some way, similar to whatever
mutation helped.

-dave

[Andre Gironda]

Post by dave aitel
Everyone I know lived through the "Blinken-Lights-IDS" phase.

So your entire defense was situated on "Are the

Post by dave aitel
lights blinking when I'm not typing on my computer?"
Ask yourself: How far from that have we come, really?

We can still use blinkenlights --
https://blog.cobaltstrike.com/2015/11/11/revolutionary-device-detects-mimikatz-use/

Post by dave aitel
Honestly, the line that strikes fear into the hearts and minds of all
SOC engineers is "How do you measure your success?". I'm on the Security
Metrics mailing list, which has been around basically forever, and what
they will point out is that good metrics need good data, and we have
about zero of that in almost all aspects of this game.

Maybe we know how to measure success --
https://www.blackhat.com/docs/eu-16/materials/eu-16-Hovor-Automating-Incident-Investigations-Sit-Back-And-Relax-Bots-Are-Taking-Over.pdf

Post by dave aitel
While attackers
have real numbers, the defensive process is literally evolutionary: We
try EVERYTHING and just see which companies fail due to data breaches
and while we don't really learn any lessons directly, maybe the next
generation of companies will be, in some way, similar to whatever
mutation helped.

Maybe we know how to evolve the defensive process --
http://conf.splunk.com/files/2016/slides/detecting-the-adversary-post-compromise-with-threat-models-and-behavioral-analytics.pdf

dre