Five Lies and a Truth: Attacking the Defender's Dilemma

There’s an old saying in security: “Attackers only have to be right once; defenders have to be right every time”. We call this “the Defender’s Dilemma”, and many organizations have built their entire security programs around it. But the Defender’s Dilemma is based on a very narrow slice of the attack lifecycle: the initial point of entry. When you look at the full scope of both the attacker’s and the defender’s activity, you see that the assumptions underlying the Defender’s Dilemma are misleading at best, and often entirely wrong. In this presentation, we’ll examine each of those assumptions and demonstrate that they are untrue. In fact, defenders have many advantages that they often fail to realize, and by exploiting them we can create a beneficial situation known as “the Attacker’s Dilemma”.

By the end of this session, attendees will not only realize the fundamental untruths of the Defender’s Dilemma and their negative impacts on security, but also understand how the Attacker’s Dilemma can increase morale, raise attackers’ costs, and improve the security posture of their organizations.

Transcript

1. © 2021, David J. Bianco Five Lies and a Truth Attacking the Defender’s Dilemma David J. Bianco DavidJBianco@gmail.com @DavidJBianco
2. SANS Instructor Principal Engineer, Cybersecurity Target Corporation Incident Detection & Response Researcher • The Pyramid of Pain • Threat Intelligence • Threat Hunting About Me
3. “Defenders have to get it right every time. Attackers only need to be right once.” 3 Defenders Attackers
5. The Defender’s Dilemma is Actively Harmful 5 Wrong Premise Bad Decisions Wasted Resources Tired, Demoralized Defenders Bad Security Outcomes
6. Lie #1: Defense & Offense are Separate 6 When you detect an adversary’s use of a particular indicator and respond to it quickly, you force them to expend effort to replace it. By imposing cost, you turn a defensive program into an offensive one! https://bit.ly/PyramidOfPain
7. Lie #2: Defenders Must be On Duty 24/7 7 Kind of true… BUT! Automation and SOAR can mitigate the worst of this asymmetry. What is each side doing between attacks? • Attackers plan their next attacks • Defenders learn skills and improve defenses
8. Lie #3: Defenders Have to Play Fair 8 There’s no such thing as cheating for the Blue Team! Attackers have needs, goals and habits. Take advantage of them. Deception technology makes it quite easy to lie and cheat at scale.
9. Lie #4: You Can’t Defend Against 0-Days 9 An exploit is only a foothold. What comes after is the important bit. Look for exploits but concentrate on behaviors! MITRE ATT&CK is a great start for cataloging behaviors.
10. Lie #5: Defenders Have to Get it Right Every Time 10 Attacks are not single events. Attack lifecycle models imply structure and time. You have a lot of chances to detect the attacker over its entire lifetime!
11. The Truth: The Attacker’s Dilemma! 11 Defenders Attackers “Attackers have to get it right through the entire attack. Defenders only need to detect once.”
12. The Attacker’s Dilemma is Beneficial 12 Correct Premise Good Decisions Efficient Use of Resources Energized, Empowered Defenders Better Security Outcomes
13. A Throne of Lies 13 Defense & Offense are Separate Defenders Must be On Duty 24/7 Defenders Have to Play Fair You Can’t Defend Against 0-Days Defenders Have to be Right Every Time. Attackers Only Have to be Right Once.
14. Attacking the Defender’s Dilemma Questions? David J. Bianco DavidJBianco@gmail.com @DavidJBianco