As noted in Chapter 1, the basic approach is:

We have discussed most of these points, but some discussion is in order. A critical point about detection is that you would rather not rely on detection to protect you from problems. The reason for this is that by the time you detect a problem, it has already either begun to happen or has happened. It would be better to not let the problem occur in the first place. In a perfect world, you would have enough information and foreknowledge so that you could prevent problems from occurring before they became problems. However, this is not a perfect world. Because of that, problems do occur and it is important to understand how to think about the detection process in order to most effectively recognize when a problem has occurred and to contain the problem in a timely manner. There is a side benefit from this, as when you understand the detection process, you also develop an intuition as well as detailed understanding of how problems potentially occur and that gives you the ammunition to actually prevent many problems from occurring and to quickly contain what problems sneaked through your defenses. In this section, we will start with discussing the detection timeline, which includes all the elements that go into detecting and containing a problem, and then go back to discussing what can be done prior to an event occurring in order to mitigate problems before they become problems.

A good defense from the human element should begin with some element of situational awareness. Situational awareness simply means being aware of what is going on around you. For example, when you drive, you are (or should be) aware of all the other cars in your driving zone and what they are doing. You are aware of cars that are being driven by people who are talking on their phones, cars that are weaving in and out of traffic, and cars that have turn signals illuminated. Each of these cars is a potential threat and being aware of their behavior patterns is a critical part of defensive driving. Similarly, while you are “driving” through cyberspace, you should have some level of situational awareness. This does not necessarily mean that you need to be a security professional but that it is useful to be aware of the threats and strategies used by attackers. Thinking about what can go wrong is a great first step in creating and maintaining situational awareness.

Detection is an important foundation for other technical mitigation strategies. Detection helps us develop the knowledge to prevent pending attacks and warn others. Detection is more than the act of catching an attack in progress. It can be thought of as including three general stages: pre-, mid-, and post-attack detection activities. This is useful in distinguishing the three distinct opportunistic time frames in which threats of an attack or a problem can be identified, analyzed, and understood.

When we talk about recognizing a malicious message, what we are really talking about is detecting the probability that something might be wrong with a message and then taking the appropriate steps to verify, characterize, and neutralize the problem. Actually, this process is true for every detection problem, but we will limit our discussion to the challenge at hand. So let us walk through the process.

We talk about the detection challenge in terms of a timeline. Certain events precede other events in absolute time, but the steps taken in detecting and reacting to a problem only partially follow that timeline. The goals of the detection process should be to minimize the time between steps, so that the aggregate time from problem occurrence to solution is as fast as possible. This can help minimize the damage overall and it certainly helps you get back to normal faster.

In the “pre-attack” stage, there may be few indicators that a problem is about to happen. If you have robust network monitoring tools, which is typical of large organizations, some analytics reports may indicate that some form of reconnaissance has transpired. These reports can be hard to interpret and are not always completely accurate. In this stage, it is important to recognize that detection is not as much about detecting active attackers as it is about detecting the probability that problems might be building and then considering them against the known vulnerabilities in your environment.

It is in the “mid-attack” phase of detection that technology can be most helpful. In this phase, technology can be used to great effect to discover and filter out suspect or problematic activities, such as filtering computer viruses. A lot of work has been done in this phase to more efficiently and effectively discover and report malicious messaging. This can include automatically analyzing the contents of messages, including links and attachments.

The final “post-attack” phase of detection is done primarily through analysis. Analysis is nothing more than examining what happened and seeing what evidence can be recovered. For example, a computer forensics investigation can reveal how a network attack happened, why it happened, and what could be done to prevent a similar attack in the future. Look at systems logs and traffic logs, if they exist, might also reveal elements of a previously unknown attack. This type of post-mortem review can provide great detail about threats and vulnerabilities that can help you close the doors to future attacks. Of course, all of this is predicated on capabilities and resources: large firms can afford to do a lot of investigation while individuals can only do what they can do. You have to manage your problem to your scale.

While we talk about pre-, mid-, and post-attack phases, it is important to realize that the detection of a new attack or problem does not follow these phases chronologically. Instead, detection generally starts mid-attack and then splits into two analytical phases that encompass the pre- and post-attack phases. The lessons learned can then be integrated into your overall defensive posture so that detection of future attacks or problems can occur earlier and faster.

Typically, the first indicators that something has happened or that something might be wrong can be best characterized as symptoms or clues. This first step is the discovery that something is wrong. Looking at the depiction in the following figure, you can see that the indicators occur after the problem event: this can be a tricky issue, especially if there are very few indicators that something might be wrong or if the indicators are misleading.

The “something wrong” could range from noticing a weird subject line on an email to getting complaints from your Facebook friends about links you have been posting to their timelines. Acting on the indicator is the first step towards defeating potential malicious activity. If you notice a weird subject line and treat the subject email with caution, you might well avert a larger problem from happening. This, of course, is the best outcome: stopping malicious activity before it becomes a real problem, as it clearly has become in the second example. This second sample indicator, the complaints from friends, tells you that the problem, whatever it might be, has already gotten beyond your immediate control. For the rest of this discussion on the detection timeline, we will use that example to illustrate.

This leads to the second step in the detection process: characterizing the event. In this step, you take the clues that you are provided and try to figure out what happened, when it happened, and if the problem is ongoing.

When you start this process, you have several facts at hand, which are the immediate observables. For our example, you start with two facts: first, that your Facebook profile has been used to post links that you were unaware of, and that you did not in fact post those links so therefore someone else must have. This very small set of facts gives you at least a starting point in discovering what exactly happened. It also helps you collect data on two very important other questions, namely when exactly did the problem occur or begin occurring, and is it still occurring or has it stopped. Each of these questions is important know for you to understand in order to proceed on to the next step in the detection timeline.

Once you have gathered the information on what is going on, when it probably began occurring, and whether it is still occurring or has stopped, you have to determine how to react. You now know what has happened, probably, you have a small set of facts from which to work with, and you are faced with a series of decisions on how to respond. Your response, of course, is going to directly reflect the nature of the problem and the extent of the problem.

Your reaction activities will, of course, be commensurate with the nature of the problem. If it is a very large problem, then a lot of reaction activities will need to occur. If it is a very small problem, then fewer reaction activities will need to be launched.

Types of reaction activities that may need to be considered include things such as crisis management, containment of damage, investigation, perhaps forensics data collection, perhaps making criminal complaints with the police, possibly suing negligent parties, and continuity of operations in degraded modes. Obviously, for a single individual, the reaction is simpler than for a large organization. For a single individual, reaction may be limited to a cursory investigation, with indefinite results, an apology or explanation to other affected contacts, a password reset, and moving on. For groups of individuals, reaction may encompass much more coordinated response options, such as collecting and comparing information on when and where problems occurred. For large enterprises, frequently more intense investigation is warranted, both to characterize what the extent of the problem and to devise approaches to contain it.

Once you have figured out what the damage might be and whether the damage has stopped occurring—a very tricky issue if your identity has been stolen or your financial credentials have been compromised—you are then faced with the question of whether you should notify anyone. For individuals, that answer is usually “no.” The answer turns to “yes” when there is potential for cascading effects, such as if your email account has been compromised and malicious messages are being sent under your name from your account. The answer is also “yes” if your computer has been compromised and you need help fixing the problem. For larger organizations or for enterprises in regulated industries, there may well be a mandated reporting requirement. Organizational policy will be of assistance in this case, even if the problem occurred on a home computer, since trusted access to an enterprise network has the potential for causing wide spread issues.

Once everything has been handled, then you have the opportunity to ask the most important question of all: what the heck happened and why did it happen to me? As illustrated in the following figure, before any attack is actually executed, the bad guys need to figure out who to target and how to target. These activities are known as pre-attack activities.

For untargeted malicious messaging, the answer to this question may simply be “Because I exist.” Phishing schemes may be sent to every person that the attacker can find with an address or destination on social media. As the attack becomes more individualized, the pre-attack activities become more significant and sometimes even detectable. These are important elements to consider: did something weird happen before the attack? Was something introduced to my environment, like a USB stick that someone found on the ground? Did I get strange phone calls? Did I sign up for a new service? Asking these types of questions can provide a great deal of insight into potentially avoiding problems in the future and help you provide guidance to friends, family, and colleagues.