I’m always on the lookout for good reports or articles about intrusions to evaluate defensive measures.

They are a great source of information to overlay what adversaries are doing to a security architecture. And it doesn’t cost you anything to do it.

Here’s how I like to do this.

Finding a good report

First, I need a good article or report to review.

To be a good report, I’m looking for a high level from how an adversary got initial access to the final impact. They won’t contain the details or every step, but a good one will at least give a good flow of the intrusion.

Usually, this is a report by a security vendor, but it’s not unusual to find articles on news sites that contain enough information to be useful.

Applying the information

Let’s say we find an intrusion that began with a password guessing attack.

These attacks still work too often. The victim experiences a string of login failures and eventually the adversary makes a correct guess. They then login to a service that is exposed to the internet.

These attacks ubiquitous online.

Let’s apply it to an intrusion that began with RDP on the internet without multi-factor authentication.

• Do we have RDP hosted on the internet? No, we don’t.

  • But we do use VPN for remote access...

• Does the VPN allow access with only a username and password?

  • Frequently, the answer is yes.

• What would prevent the attack from being successful?

  • Solid multi-factor authentication. Remove all default accounts.

Now we know we have something to fix, and where the problem is. We fix that and repeat the process, going deeper into the network as we proceed.

Putting it into practice

This process can be as simple as a mental review of what you have in place, or it could be the foundation of a tabletop exercise. Or full attack trees with lots of branching options.

But now we’ve applied what adversaries are doing to what we are defending and have probably learned some lessons in the process.