The 10 commandments of attack detection

Not all recommended security investments close the most important gaps to adequately secure companies. (Image source: Christian Arlt, net-select GmbH)

In the jungle of standards and legislation, the term “attack detection systems” is often used. References are made to the “state of the art”, to the BSI's basic protection compendium or to vaguely formulated objectives for measures. As a result, I come across many companies that are confused and faced with a mountain of opaque tasks. In order to deal with this in a sensible, structured way and without extensive investment, I would like to describe ten “commandments” below that can bring some clarity and structure. I would like to point out that, like the biblical commandments, they do not cover every conceivable scenario. But they do help to find the famous common thread.

Commandment 1: Focus on the actual goal

The first step should be to take a somewhat broader perspective. If the security team is tasked with working through ISO 27001 point by point, a lot of detailed work, many documents and, over time, contradictory overlaps will arise. But the further you get lost in the forest of paragraphs, the more you lose focus on the actual goal: protection against a cyber attack! Because what is the protection against? From strict auditors? Or from the shutdown of activities?

It is important to always keep in mind why a measure should be implemented. A focus on realistic attack scenarios and pragmatic approaches is worth much more than a lot of paper in the filing cabinet. And even if an audit only certifies maturity level 2 due to a lack of documentation, the economic damage that can result is less than a plant shutdown due to ransomware or the disruption of critical services to supply the population with water or energy.

2nd commandment: Visibility

The 2nd commandment is much more technical, as it deals with visibility. Cyber attacks take place in several steps and each of these steps has its own type of traces. But in order to recognize them, it is important to create a structure in which they can appear at all. A flat network makes it difficult to find traces in the network. Many distributed logs require a lot of transfer work in order to see connections. If normal users are also administrators, malicious administration processes are difficult to differentiate. Therefore, centralizing information and administration and finely differentiating IT areas and users/user groups brings high added value.

3rd commandment: A look at the existing tools

This in turn represents another mountain of tasks! This is probably also linked to larger investments and not at all easy to implement. It is therefore worth taking a look at the existing tools. There are certainly infrastructure devices that generate logs, but only locally. Anti-virus solutions and mobile device management already centralize certain aspects. There may already be a control center for certain messages, but it does not yet look at IT/OT in detail. It is therefore worth taking a closer look at the implemented technologies, understanding them and then using them more intensively. In order to pass an audit, it is a valid argument that nobody in the company can (yet) have a holistic overview. So instead of procuring an expensive centralized SIEM, it is much more efficient - commandment number 3 - to have the tools used by individual specialists: The server administrator monitors the servers, the network specialist checks firewalls, etc. Of course, centralization should not be lost sight of in the long term. Initially, however, e-mail notification in a central mailbox, which is easy to implement with most tools, is sufficient.

4th commandment: Messages must be read!

This e-mail notification leads directly to the 4th commandment: These messages must be read! For many, this is the critical point that needs to be crossed. Because so far nobody has the time (or inclination) to look at the messages. But many of the attacks are hidden in the messages that are generated anyway. If there is a lack of expertise, then at least a change in the number of notifications - both significantly more and significantly fewer than usual - should be an indicator that the warnings received should be addressed.

5th commandment: Keep the entire staff in view

This often opens up the discussion area “Man or machine?” Whether artificial intelligence can handle the reports and whether its judgment can be trusted is a complex risk assessment. In better security operation centers, a machine's judgment is therefore always questioned by a human. However, no matter how this is weighted, humans are involved in another area, namely as an entry point for the attacker.

The defense against phishing, business email compromise, bad passwords and similar issues can only be partially addressed with technical measures. Nor are they related to highly paid analysts, but also to a Peter Mayer from facility management. And Mr. Mayer only reports anomalies if he knows the reporting processes, they work and he is not afraid of an unfriendly response. Essentially, the 5th commandment means that a security strategy must be pursued equally for all staff and discussed on an equal footing. Cooperation and understanding achieve much more than video training and a ban on private smartphones in the company WLAN.

By focusing on the right security gaps, companies can defend themselves against cyber attacks with manageable effort. (Image source: Christian Arlt, net-select GmbH)

6th commandment: Security is real, genuine work

In addition to technical email alerts, there are now also personal user messages. In security circles, the term “alert fatigue” is often used in such an environment: Too many messages that are then no longer investigated in detail. On a small scale, this is often a problem of responsibility: if security is assigned to employees who are already at the limit of their capacity with IT/ OT operations, the first alerts fall through the cracks a few months later. An assignment must therefore be serious and not just a formal item on a list. This means that resources in the form of time and possibly also tools must be created. The core of the sixth recommendation is that security is a real and individual activity!

7th commandment: Lack of orientation

Nevertheless, the amount of information can be too much. Even if it only comes in seventh place in this article, the lack of orientation in the flood of information is related to one of the first steps in a cyber security strategy: risk assessment. If you are not starting from scratch when it comes to security, you have already created it for your own assets or at least have an idea in your head of which components should not fail. This list, which is hopefully already documented anyway, belongs in the hands or at least in the heads of the professionals who process the reports. This helps with the “triage” of events, i.e. in case of doubt, the targeted ignoring of reports that concern less critical assets. Without such a definition, it would be hopeless to keep an overview of the situation in the long term, even with suitable tools such as a SIEM.

8th commandment: Patch management

A somewhat unrelated aspect that I unfortunately encounter time and again in real customer environments is patch management. Updates always have risks and in the absence of test processes - ultimately time - there is often a basic fear of update problems. The small updates

are postponed and after a year, an update is really a risky business because a lot of individual steps change at once. If the development of a comprehensive patch strategy is still a long way off, at least the 8th commandment is that regular patch windows are much more manageable than the great unknown “someday”. Because in the networked world, every patch is actually security-relevant, even without its own CVE.

9th commandment: Use existing tools in a targeted manner

Just like patch management, a prompt response is also part of a comprehensive security strategy. The BSI's “Guidance on attack detection” prescribes very fast response times and mentions automation. Even if there seems to be a great temptation to use automation and even AI here - perhaps even the expensive Network Detection and Response (NDR) that manufacturer X advertises - it makes sense to take another look at the existing tools. After all, even normal anti-virus software does exactly this job: an immediate response to a detected attack! An ad blocker in the web browser can also block phishing sites immediately and many firewalls have an unused Intrusion Prevention System (IPS) on board, which has comprehensive network-based capabilities. Similar to the detection area, the 9th commandment is therefore to understand existing tools and use them in a targeted manner.

10th commandment: Rehearse the emergency

This leaves only one last commandment, which should be familiar in a backup strategy in a similar form: Only a tested backup is a real backup. The same applies to the response: the perfect response to a cyber security incident only emerges from experience after an incident. As it is not expedient to wait for the disaster to occur in order to acquire the experience, it is essential to rehearse an emergency. Similar to a fire drill, this usually feels somewhat unreal and superfluous, but in a simulation game that is taken seriously, many questions arise that were not considered in theoretical considerations. And, of course, their answers.

If you have followed this up to this point and played through the simulation game with attack scenarios tailored to you, you will discover the gaps that go beyond the ten commandments. This is where it really pays off to invest - and not necessarily always in the places recommended by the paper tigers of standards and laws.

Article by Christian Arlt (net-select GmbH)