Researching Organizational Capabilities and Constraints and Determine Trade-Offs

00:00

This is module four, less than three.

00:03

Researching organizational capabilities and constraints and determining trade offs.

00:13

This lesson. We have three objectives for you to learn how to identify your organizational capabilities and constraints.

00:20

Identify how to tailor tradeoffs for your enterprise

00:24

and understand how to make customized defensive recommendations.

00:32

So this is Step three of our process research, organizational capabilities and constraints.

00:39

Every organization is going to have

00:43

different aspects that are easy or harder for them, depending on some of the things that they already have in place

00:51

things about their workforce and the organization itself.

00:56

So these are going to be things like

00:59

what data sources, defenses, mitigations are already collected in place.

01:04

So if you're already doing something already doing something that's almost able to take care of how an adversary is using a technique, it may be really inexpensive or simple.

01:15

So maybe something like if you're already collecting the right data sources, possibly some new analytics on your existing sources. So just adding something to your sin

01:26

so you can also take a look at tools What products are already deployed that might have additional capabilities.

01:34

So do you have products in your enterprise

01:37

that are already able to take some of these defensive measures or match things that we've said are going to work for a particular technique. But maybe a feature isn't turned on or it just needs to be tuned to match the particular thing.

01:51

So this could be something like It's able to gather new data sources or implement new mitigations if we add on the right feature or if we turn on the right capability for it.

02:04

Are there things about the organization that may preclude responses? Are there things that are just not on the table for us? Because the organization maybe rules we have on data, we are not allowed to collect

02:17

maybe something about our users, where their patterns may make something impossible or easy,

02:24

and this could be stuff like user constraints and usage patterns.

02:30

So we've we've gone through with this user execution example.

02:36

So I'm going to give some notional capabilities and constraints for our fake organization so that we can work through this process.

02:46

So national capabilities.

02:49

Let's say that our organization already has Windows events, so Windows event logs already collected two assim but not process info.

02:59

So we we've got sort of the right types of data sources, but not necessarily what we actually need. Uh, the organization is currently looking at application control tools.

03:09

It's a highly technical workforce, so ones that already understand maybe some of the threats there's already an email file detonation appliance in place. So this has already been bought already been installed,

03:22

like most organizations going to assume that we already have in a virus and all endpoints.

03:29

Okay, so these are the things that we have in hand

03:31

that are going to enable certain responses and make certain responses more easier than others.

03:39

So some notional constraints for our fake organization.

03:44

Let's say that our sin is close to our license limit

03:47

that in order to get a lot more events coming in to add new Windows, event log types might be prohibitively expensive to get up to the next level of license.

03:59

A large portion of our organization. Let's say our developers, so people who run arbitrary binaries

04:06

and that our files and transmit are usually encrypted at the point that they go past a new network intrusion prevention system.

04:17

These are all notional. These are just getting so that we can actually take a look at how some of these would fit into specific trade offs.

04:27

Your organization is going to be different.

04:30

How do we take those? So how do each the options we identified in earlier steps now fit into our organization

04:41

so we can look, at example, positives and negatives for how each of these options will work with our organization?

04:49

So things like maybe the options we came up with are able to leverage existing strengths, tools and data sources.

04:58

So some of that information we were just thinking about about our organization.

05:02

It also could very well fit with a specific threat.

05:05

If we've got an option that exactly matches up with one adversary is trying to do to us. Well, maybe that wants to rise to the top of our priorities.

05:17

There are also some negatives that can come up as we're going through each of these options. So maybe it's something that's going to be really expensive for us but doesn't really mitigate much risk, you know, it's not actually helping us all that much.

05:32

It could also be a poor cultural fit with our organization. It could be something that is going to make it so that our users can't get their job done or is extra bad in our particular industry.

05:46

Each option is going to be highly dependent on your specific organization.

05:53

So continuing to work through the example we have and the defensive options we've gathered and some of the constraints that we've put together for our notional organization.

06:05

So defensive option that we came up with is increased user training around clicking on attachments.

06:13

Okay,

06:14

this covers the most common use case. It covers spearfishing where we're trying to keep people from clicking on attachments. We said that we have a technical workforce, so they may be very likely to understand this and may make good sensors for incoming malware.

06:31

Uh, as a con, though,

06:33

is you know, our our workforce. We're putting through more training.

06:39

People are sick of security training. They don't want one more. You know, we've already given them some training on spear fishing in the past,

06:46

and so you may may or may not work as a trade off.

06:50

We said we can do enforcement of application control

06:54

now. This sounds great on paper, you know, we're already looking at a solution for this uh, we said in our notional, uh, most of the binaries are concerned that are coming in from malicious actors are not familiar binaries their their new hashes, their brand new things. And so application control is likely going to stop them.

07:15

Well, we mentioned that we have a lot of developers.

07:18

Developers are creating a lot of their own binaries, and so we might heavily impact our population.

07:25

If we prevent our population from running arbitrary binaries, we may have a high support cost. In order to add these developers binaries into our application control solution.

07:38

Mhm.

07:39

We give us an option monitoring command line arguments to create an analytic, looking at the information coming in

07:46

what we said. We are collecting Windows events already.

07:48

So we've got you know, where those are going to feed into already feeding into a sim.

07:55

But we also said in our constraints earlier

07:59

that we really couldn't add more logs to our existing license. It probably was going to be an unacceptable cost.

08:07

Uh, it's a virus. Well, we've we've already got it. So you know, there's no no reason to get rid of it.

08:13

But the downside is we already have it in place, and it it wasn't working out. Limited, limited coverage

08:22

we suggest, as a possibility, installing end point detection response product.

08:26

This could give us excellent endpoint visibility without greatly increasing log volumes,

08:33

but we don't already have it. This is gonna be a big procurement, and it's possibly going to be a really expensive one. You know, if we want to go there.

08:43

We said we have a email detonation appliance

08:46

as a pro, it's already in place.

08:50

But as Khan, we also said that data is encrypted in places where it's going past our appliances, so we might not have full visibility into our inbound email.

09:03

So we've now built up

09:05

most of the information we need to get to the finish line.

09:09

Learned how to identify organizationally unique capabilities and constraints, the sorts of information that are going to impact, how we can respond and detect different techniques and sub techniques.

09:22

You've talked a bit about how to tailor trade offs for your enterprise. What sorts of things to look for that are going to impact. What's easy, what's hard, what's doable and what's not doable for your organization