- In the industry, there are dozens of options for tools
and many documented methods that could be used to
develop how your organization categorize an incident
which is actually core of an incident management practice.
Now, the CCNA cyber ops sec exam was designed to
follow industry best practices.
And Cisco selected the diamond model of intrusion
as a trusted approach to categorizing security incidents.
Now, the reason behind creating the diamond model
was to develop a repeatable way to characterize
and organize threats, and also to consistently, you know
track the identified threats
and eventually develop counter measures.
The diamond model of intrusion provides a structured methods
for cybersecurity analysts to follow
and to protect their organization.
The Diamond model is designed to represent an incident
and is made up of four different core parts,
starting with an adversary,
which is actually targeting a victim
which is a second part,
And then the adversary will use various capabilities
which is a third part, along with some form
of infrastructure, which is the fourth part, to
actually launch an attack against the victim.
Now capabilities are the different tools and techniques
and also the procedures that the adversary actually uses
while the infrastructure is what is actually
connecting the adversary and the victim.
Now, the lines connecting each part, you know
illustrate how an analyst can actually map how
one point reach another.
Right? So moving between each part of an attack is also
called pivoting, right?
And this is actually key for modeling the event
or the incident.
The diamond model also includes additional meta features
of an event such as a timestamp, the kill chain phase
the results of that attack, the direction of that attack.
They actually attack methods and resources that were used
by the adversary.
Now, an example of a meta feature list is a time stamp of
let's say, you know, a log at two o'clock
in the morning that actually highlights communication
to an embar a country, right?
And then the kill chain phase could be the actual
exploitation. You know, the, and the result can be, you know
the successful exploitation of that and the direction
could be the adversary, you know, to the victim itself.
And the attack method could be the, you know
let's say a spear fishing attack and resources
will be a specific vulnerability
on the victim's Hosti system that is actually
being exploited or, you know, taken advantage of, right?
These meta features provide useful context
but they're not core to the model
and can be either disregarded or augmented, you know
as necessary.
Here I'm actually showing a graphical view
of the diamond model with the metadata features, an example
of a technology meta feature could be, let's say DNS, right?
And DNS, as you know, you know
can be used by malware to determine, you know
where is actually the command
and control server that it
should be communicating with right?
Also there's the social political meta feature, right?
And it represents the relationship
between the adversary and the victim.
And this is actually somehow critical
and specifically, you know
in order to determine the intent behind the attack.
So the analyst can actually understand the reason
the victim was selected.
It also helps understand the value the adversaries sees
in the victim and sometimes identify a shared threat space.
In other words, this may be a situation where
multiple victims link back to the same adversary, right?
So in this case, a shared threat space, you know
equates to threat intelligence that can be even be
you know, shared among the victims to successfully
mitigate that attack and respond to that,
to that attack right?
An example of this, you know, can be that, you know
specific threat actors identified
or launching an attack against financial services companies.
So, you know
these companies actually can share threat information
among them in order to one, understand the attack.
And second, of course, remitigate and mitigate that attack.
Now, the relationships between the diamonds are known
as the activity threads
and activity threads can be spread across the same attack
and also can connect other attacks depending
on the threat intelligence gather right.
Here I'm actually showing an example of an activity thread
right?
This visibility into the specific attack
information gives the analyst the ability to
integrate any hypothesis that can be tested
as additional evidence is actually gather right.
Now the activity threat process displays the current
research status, which can help identify knowledge gaps
and adversary campaigns through documentation.
And also by testing proposed attack hypotheses.
Once the incident management team builds a good
activity group, the team can actually better
analyze the data to fill in missing knowledge gaps
and start to potentially predict future attacks path
you know, of course, in the future.
So these threat intelligence can actually be built
into a graph known as the attack graph
and this attack graph represents the path
an adversary could actually take against the victim.
Now, an activity attack graph is useful
for highlighting the attacker's preferences
for attacking the victim as well
as alternative paths that can actually can be
used to carry that attack.
This gives the incident response team a way to focus effort
on defending against the adversary
by knowing where to likely expect the attack
as well as be able to be aware
of other possible risk on the victim's environment.
Right? So the first and by far, the most critical step
into an attack is the quality of the reconnaissance
you know, made by the actual attacker or the adversary.
Right? So reconnaissance in, in short is actually a research
on the target and typically is the most time
consumed yet most rewarding step towards, you know, that
that attack and part of that kill chain, right?
So the goal
for this phase is to identify different targets association
to the targets and as much data
as possible about each of those targets, right?
The more data found, you know
provides options for planning, a more effective attack.
Let's say, for example, you know, if I'm an attacker
and I actually see a multiple web facing servers
then I may actually uncover one, what is the version
of software that is actually installing those servers?
And second, if they're actually vulnerable
to either non vulnerabilities
or I may actually have knowledge
of a zero day attack that I can actually, you know
launch against that environment.
Right. Another thing about reconnaissance is that I
I can not only do it from a technical perspective
and looking at the technical posture of that victim
but also understandings the victim's structure as far as
you know, human structure, right?
The board of directors keep people
within the organization that I can steal data from.
I can leverage things like LinkedIn launch attack against
you know, specific individuals.
And whenever I mention attacks, you know
it can be a, a combination
of social engineering and also technical attacks.