Five Lies & a Truth: Attacking the Defender's Dilemma

There’s an old saying in security: “Attackers only have to be right once; defenders have to be right every time”. We call this “the Defender’s Dilemma”, and many organizations have built their entire security programs around it. But the Defender’s Dilemma is based on a very narrow slice of the attack lifecycle: the initial point of entry. When you look at the full scope of both the attacker’s and the defender’s activity, you see that the assumptions underlying the Defender’s Dilemma are misleading at best, and often entirely wrong. In this presentation, we’ll examine each of those assumptions and demonstrate that they are untrue. In fact, defenders have many advantages that they often fail to realize, and by exploiting them we can create a beneficial situation known as “the Attacker’s Dilemma”.

By the end of this session, attendees will not only realize the fundamental untruths of the Defender’s Dilemma and their negative impacts on security, but also understand how the Attacker’s Dilemma can increase morale, raise attackers’ costs, and improve the security posture of their organizations.

Transcript

1. © 2022 SPLUNK INC. Five Lies and a Truth Attacking the Defender’s Dilemma David J. Bianco Staff Security Strategist SURGe by Splunk dbianco@splunk.com @DavidJBianco
2. © 2022 SPLUNK INC. About Me He/Him Staff Security Strategist, SURGe SANS Certified Instructor Security Researcher • The Pyramid of Pain • Threat Intelligence • Threat Hunting
3. © 2022 SPLUNK INC.
4. © 2022 SPLUNK INC. “Defenders have to get it right every time. Attackers only need to be right once.” – Literally everyone in security at one time or another The Defender’s Dilemma
5. © 2022 SPLUNK INC. The Defender’s Dilemma: Actively Harmful Wrong Premise Bad Decisions Wasted Resources Bad Security Outcomes Demoralized Defenders
6. © 2022 SPLUNK INC. Lie #1: Defense & Offense are Separate When you detect an adversary’s use of a particular indicator and respond to it quickly, you force them to expend effort to replace it. By imposing cost, you turn a defensive program into an offensive one! https://bit.ly/PyramidOfPain
7. © 2022 SPLUNK INC. Lie #2: Defenders Must be on Duty 24/7 Kind of true… BUT! Automation and SOAR can mitigate the worst of this asymmetry. What is each side doing between attacks? • Attackers plan their next operation • Defenders learn skills and improve defenses
8. © 2022 SPLUNK INC. Lie #3: Defenders Have to Play Fair There’s no such thing as cheating for the Blue Team! Attackers have needs, goals and habits. Take advantage of them. Deception technology makes it quite easy to lie and cheat at scale.
9. © 2022 SPLUNK INC. Lie #4: You Can’t Defend Against 0-Days An exploit is only a foothold. What comes after is the important bit. Look for exploits, but concentrate on behaviors! MITRE ATT&CK is a great start for cataloging behaviors.
10. © 2022 SPLUNK INC. Lie #5: Defenders Have to Get it Right Every Time Attacks are not single events. Attack lifecycle models imply structure and time. You have a lot of chances to detect the attack over its entire lifetime. Attackers have to evade your detection at every phase! Lockheed-Martin Cyber Kill Chain
11. © 2022 SPLUNK INC. Attackers have to get it right through their entire attack. Defenders only need to detect them once. The Truth: The Attacker’s Dilemma
12. © 2022 SPLUNK INC. The Attacker’s Dilemma is Beneficial Correct Premise Good Decisions Efficient Use of Resources Better Security Outcomes Engergized, Empowered Defenders
13. © 2022 SPLUNK INC. The Defender’s Dilemma Sits on a Throne of Lies Defense & Offense are Separate Defenders Must be on Duty 24/7 Defenders Have to Play Fair You Can’t Defend Against 0-Days Defenders Have to Get it Right Every Time
14. © 2022 SPLUNK INC. Five Lies and a Truth Attacking the Defender’s Dilemma David J. Bianco Staff Security Strategist SURGe by Splunk dbianco@splunk.com @DavidJBianco