Getting Started with Active Defense Tools

There is a lot of confusion around how to implement Active Defense tools. Part of the reason is because there is little guidance from governing bodies on how to actually use tactics such as denial and deception (D&D), counterdeception (CD), counterintelligence (CI), and offensive countermeasures (OCM). The other is a fear of legal action, since organizations are not protected if they use countermeasures to go after intruders. As we discussed in our previous blog post, there are ways to mitigate the risk of using Active Defense tools, and, in general, these are an effective, low-cost, low-risk way to better secure your network.

In terms of how to use Active Defense tools for your organization, know that you can use them to counter wholly external threats—those that do not yet have access to your internal network—as well as those that have already penetrated your network. External tactics can include things like fake employer profiles attached to a fake corporate email account that are placed on social networking sites to monitor for spear-phishing attempts. That said, we recommend focusing on addressing the threat of an intruder, detected or undetected, who has successfully penetrated your organization’s network.

The Three Most Important Active Defense Tool Tactics

Getting started with Active Defense tools will help you with three important goals when it comes to protecting your network against bad actors, including:

Better intelligence gathering and attribution capabilities

Organizations must continuously improve their ability to gather intelligence and obtain attribution. It is essential that organizations know and understand who their adversaries are, their capabilities, their intent, and the specific threats they present to the network. The ability to identify the source and analyze the extent of a compromise is crucial to quick and effective incident response, mitigating damage, and restoring normal services.

Intelligence gained can also be used to both improve an organization’s security strategy and improve information sharing with law enforcement to ensure the parties responsible do not evade civil and criminal penalties. Security incidents resulting in the intruder being identified and held responsible for their attack serve as excellent deterrents to other potential actors in search of an easy target. Authorities are both technologically and legally ill-equipped to seek justice for victims of cybercrimes, so it is essential that organizations improve their ability to gather information on intruders by gathering data such as IP address, geographic location, mission objectives, and tactics and provide that info to the authorities.

Faster, more accurate incident response

It’s also important for organizations to improve their incident response capabilities and ensure they can successfully mitigate damage from ongoing intrusion while also continuing their core business processes uninterrupted. The ability for an organization to protect their systems, critical data, and customer information is more important now than ever before.

Early detection of an incident can prevent or limit potential damage to systems and data and reduce the time and effort required to contain, eradicate, and restore normal network operation. Rapid, focused incident response can stop an intruder from reaching their objective without affecting customer services and other business processes. This results in better protection of systems, critical data, and customer information, which is closely tied with business reputation and customer confidence. This also prevents your organization from being caught up in yet another high-profile data breach.

More efficient security strategy

Organizations must develop a time-, effort-, and cost-efficient security strategy for defending the network and mitigating intrusions. This provides advantages to network defenders and ultimately deters intruders from continuing their mission. Here’s why: When organizations leverage automation and open-source Active Defense tools, it increases the time, effort, and cost for actors. Simultaneously, it decreases the time, effort, and cost for organizations. Essentially, when organizations take advantage of these tools, they gain the upper hand against bad actors.

Our Approach to Implementing Active Defense Tools

For organizations looking to get started with Active Defense tools, we are here to help. Our approach was selected for its simplicity, scalability, and low cost. We start by providing guidance and reference materials to organizations that introduce Active Defense tools and techniques and the many advantages they offer. We do this by explaining the threats organizations are currently facing, and then walk through guidelines and examples of placement, configuration, and operation to help organizations understand how they can more easily use these valuable tools and gain the skills and experience to maximize security and their organizational performance.

This guide can be used by organizations of all types and all sizes as it is not tailored to specific network types or workforce skill sets. Each tool’s description, configuration, and recommended uses are provided for easy setup and implementation.

How our approach works

First, know that there are three general variables involved in cyber attacks, commonly referred to as detection time, response time, and attack time. The formula Dt + Rt > At states that for an attacker to succeed, the time required to complete the attack must be less than the time needed for detection plus the time needed for response. This means that organizations want to decrease detection times, decrease response times, and increase the time required for an attack.

We provide a small suite of tools which can be used to change all three of these variables to bring about a significant improvement in overall security posture. More in-depth approaches focusing on only one aspect of the solution do not properly arm an organization with the tools needed to succeed or allow them to take action immediately.

With our approach, an organization can gain an understanding of the role these technologies play in reducing security risks and can then take steps to implement these technologies at once, without significant cost or experience.

Hands-on training

Security personnel are provided with tool-specific, hands-on training that results in an even greater understanding of tool uses and configurations. The low cost and general availability of Active Defense Harbinger Distribution (ADHD) is yet another reason why organizations will be more likely to take action with this approach. All that is needed to begin using these tools on an organization’s network is the guide provided, virtual software, and internet access.

Learning exercises

Routine scenario-driven exercises are needed following initial training to improve the speed and efficiency of response procedures. Organization security and incident response teams must practice identifying, attributing, and neutralizing threats in the organization’s network under various circumstances.

Continuous assessment and evaluation of coordinated responses will reveal processes and systems that require additional training and improvement. New developments in attacker technology and strategy will change the effectiveness of countermeasures, which is why security teams must stay abreast of current cybersecurity defense techniques and practices.

Why this approach to implementing Active Defense Tools works to better protect your network

Modern actors can operate anonymously with cheap and efficient tools and have no fear of retaliation. Without the threat of attribution, countermeasures, rising operational costs, or resulting legal action, adversaries will continue testing business technical capabilities, defeating their security controls, and achieving their objectives.

This approach is low-cost and effective at curbing cyber attacks. No extra manpower is needed, and the cost for deploying the tools and training team members is extremely low compared to the cost of a successful, undetected network intrusion.

The one big risk is financial loss from downstream liability and lawsuits. This is why it’s important to involve your legal team every step of the way when it comes to the implementation and use of Active Defense tools. Yes, legal issues are a concern, but it’s a necessary risk (and one you can mitigate with proper measures) that you need to take to protect your network. Read our previous post for more insight into the business impacts associated with Active Defense tools.

Contact us now to discuss implementing Active Defense tools within your organization.