Is Your Cybersecurity Answering the Right Question?

by: Vasu Nagendra – Chief Product Officer

I am a big fan of Doctor Who, the British science fiction TV series. So much so, that I didn’t just watch the show, I read most of the books that were available when I was in high school. A scene from one of these books stands out in my memory: Doctor and his friend Sarah are trapped in a maze. In thinking his way out of the conundrum, The Doctor states something to the effect of: “Every question has an answer. It’s just a matter of asking the right question.” This is a lesson that’s stuck with me all my life and I constantly ask myself (and those around me): “What problem are we trying to solve?”

Technology is a consequence of a problem. That’s why explaining the technology by itself doesn’t really paint the entire picture. To clarify the value (or lack thereof) inherent in a technology, it’s very helpful to start with some basic problem statements to understand and solidify you’re really getting what you pay for when it comes to cybersecurity.

Defining the problem

I was fortunate enough to be around since the inception of our Zero Trust Analytics Platform (ZTAP). This platform underpins the value of our  Managed Detection and Response (MDR) service. We had specific questions that guided us down the technology path we are currently on:

• How can we resolve every single alert by a limited set of security systems?
• If we were to build this platform, how can we ensure it delivers the quickest time-to-value to our customers?
• How can we make sure whatever we do is incredibly transparent to our customers?

The magic of ZTAP

Let’s be clear here: There is no magic! Whether we or our customers investigate alerts, the cost per alert investigated is approximately the same.  What differentiates us is that our knowledge is aggregated across all our customers allowing us to deliver on a decision we made early-on to investigate every alert exactly once.

Event ingestion

We support ingesting data into our platform through multiple mechanisms. The mechanism of ingestion is primarily driven by the system we are ingesting data from. This (and only this) part of our system is similar to a Security Information and Event Management (SIEM) system that may ingest the data for compliance or other purposes.

We ingest data using Syslog, Web-hooks, Polling, and various forms of queues. The primary difference, however, is the content of what we are ingesting. A SIEM or other system stops at ingesting data, but we are ingesting information. By the time something gets to our system, the sender (Carbon Black Response, Cylance, Microsoft Defender for Endpoint, Azure Sentinel, etc.) has already determined this data to be noteworthy and something that needs to be acted upon.

Assuming this alert is something we’ve never seen before and is entirely new, it’s going to be presented to our SOC analyst just exactly the same way that the sender would present the alert.

Alert investigation

ZTAP is what our SOC analysts use to conduct investigations of an alert. In practice, this means any security event that is part of the alert is investigated. (Remember, the alert is a consequence of one or more events.) Due to our decision to investigate every single alert that is generated by a security system, we had to ensure:

Event categorization

As part of investigation, the analyst has gone through a series of steps such as asking questions of the security system or a third-party system (Ex: VirusTotal). A very simplistic example of this could be something like:

• Is the instigating process Microsoft Word?
• Are all the network connections made by this instigating process going to “*.microsoft.com”; would this be considered normal?
• If yes, this is a perfectly safe, but previously unknown behavior of Microsoft Word.

The analyst captures these simple steps in what we call a Categorizing Playbook. These Playbooks are reviewed (two-person integrity) and applied. Once applied, these are forever run by ZTAP during event ingestion. They are also run historically for any alerts that are still “open” in the system.

And this is what we call the Trusted Behavior Registry.

All these Playbooks are audited for every change made from the beginning and are 100% transparent to our customers (which answers one of our founding questions above). They can see who and why a Playbook was created, as well as understand how many of their recent events are categorized.

Over a period of many years, and processing 6 Billion+ alerts, we have 70,000+ Trusted Behaviors in our system. Every single event passes through this system and well over 98% are categorized automatically. We continue to add to this 24x7x365. Remember another of our founding questions: How can we resolve every single alert by a limited set of security systems? Now, through this process, we have the right answer to the right question.

Time to value

And remember the question about time-to-value? This is what we’ve observed:

This technology stack leads to a brand-new customer receiving 80%+ of their events being investigated and resolved on day 1.

A new customer onboarding with us is now gaining a much deeper understanding of the specifics in their environment, including their critical assets, their domain administrators and more. We use Playbooks for this as well.

All the technology outlined above runs in the cloud. From a customer’s perspective this makes it incredibly easy to consume — delivering value on the first day. It’s not without its challenges, be it availability, integration testing, or throughput. We’ve been early adopters of DevOps practices, going back to 0.5.x of Terraform and early adopters of Docker as well. But this effort is well worth the investment, as when you start asking the right questions, and you build a platform around those questions, then the answer becomes a highly secure environment that evolves to match any new threat it faces.

Additional Resources:

• Are you considering a Managed Detection and Response Service as part of your overall security infrastructure?  Learn how to deploy an MDR platform that can protect any business in the guide to Managed Detection and Response. 
• Dive into Infosec Reborn, a new playbook to understand, adapt, and overcome in the hyper-sophisticated threat environment of today’s world. 
• Looking for a career change? Join the revolution, CRITICALSTART is reinventing cybersecurity.