Actionable Information for Security Incident Response Study

Actionable Information for Security Incident Response November 2014 European Union Agency for Network and Information Security www.enisa.europa.eu Actionable Information for Security Incident Response November 2014 About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Authors: This document was created by the CERT capability team at ENISA in consultation with CERT Polska / NASK (Poland)1 Project Manager: Cosmin Ciobanu (ENISA) Acknowledgements: Luc Dandurand (NATO) Mark Davidson (MITRE) and STIX / TAXII team Bernd Grobauer (Siemens) Pavel Kácha (CESNET) Aaron Kaplan (CERT.at) Andrew Kompanek (CERT/CC) Maarten Van Horenbeeck (FIRST) Additionally, our “thank you” goes to all participants of the Birds of a Feather session Finding & Sharing Actionable Information, co-organized by CERT Polska, US-CERT, and Microsoft during the 26th annual FIRST conference in Boston.2 Contact For contacting the authors please use [email protected] For media enquires about this paper, please use [email protected]. 1 Paweł Pawliński, Przemysław Jaroszewski, Piotr Kijewski, Łukasz Siewierski, Paweł Jacewicz, Przemysław Zielony, Radosław Żuber 2 See http://first.org/conference/2014/program#pbof-finding-sharing-actionable-information PageII Actionable Information for Security Incident Response November 2014 Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2014 Reproduction is authorised provided the source is acknowledged. ISBN: 978-92-9204-107-6 doi: 10.2824/38111 Catalog number: TP-05-14-107-EN-N PageIII Actionable Information for Security Incident Response November 2014 Executive summary In the world of incident response, information is everything. The sooner incidents and vulnerabilities are detected and understood, the faster they can be handled and the less damage is caused. Accurate and timely information may help incident handlers reduce the number of infections, or address vulnerabilities before they are exploited. Unfortunately, although security information sharing is now commonplace, it has not always improved the situation for incident response teams. Extracting timely information, that can be immediately acted on from vast amounts of all types of data flowing in, remains a challenge. This type of information is referred as “actionable information” and identified as one of the fundamental building blocks of successful incident response. This document is intended as a good practice guide for the exchange and processing of actionable information. The report is relevant to incident response in all types of organizations, the primary audience of this study isnational and governmental CERTs. The scope of the study is purposefully broad. Many of the issues related to making information actionable for CERTs have not been adequately explored in previouspublications. The goal for this report was to touch on a wide variety of challenges that should be addressed in the area of processing information. Another goal of the study is also to outline a general framework that could be used as the basis for future, more detailed, studies. The main contributions of this study are as follows: A definition of actionable information for CERTs and identification of its 5 key properties: relevance, timeliness, accuracy, completeness, ingestibility. Introduction of a generalized information processing pipeline for the processing of actionable information. This pipeline consists of 5 stages: collection, preparation, storage, analysis and distribution. Each stage is discussed in detail with recommendations on how to approach implementation. A set of 3 detailed case studies that cover various aspects of handling actionable information by CERTs: “Using indicators to enhance defense capabilities,” “Improved situational awareness through botnet monitoring, ” “Effective data exchange on a national level.” A hands-on exercise that expands on these case studies by walking a student through a concrete information processing and sharing scenario. An inventory of 53 information sharing standards and 16 information management tools relevant to the concept of actionable information. This inventory is available as a separate document, titled “Standards and tools for exchange and processing of actionable information”. Identification of gaps and recommendations in the exchange and processing of actionable information. In particular, despite the improvement ingeneral awareness of the issues involved, the emergence of new standards such as STIX/TAXII, and new tools, the exchanges have not yet reached full maturity. Based on this study, it is recommend CERTs abide by the following three general principles when building an information-sharing capability: Establish a doctrine to set expectations among the CERT community. Define clear sharing rules and labels on the data exchanged, as well as expectations for handling and any specific actions that should be taken by the recipient. Try not to start from scratch. Consider what has already been developed and can be leveraged immediately. Explore the possibility of applying additional processes that can provide more context and make the information more actionable. PageIV Actionable Information for Security Incident Response November 2014 As a set of general recommendations to CERTs and the following are suggested: If possible, standard data formats and transports mechanisms should be used. The accompanying inventory document contains a reference to standards that are currently in use within the incident handling community. For some recipients, standard formats may be less helpful for distributing actionable information since they lack the capability to process them. Simpler methods should be used in these cases (e.g., human-readable text). Alternatively, a CERT may consider providing automatically-generated, human-readable reports along with the original data in a structured standard format. Adjust the way the information is processed and distributed based on the requirements and constraints for each data type. Be sensitive to the overhead of data formats for large volumes of data, and use more elaborate formats for less frequent reports. The assumptions are that this study will be of help to CERTs and the information security community in general to better understand the issues involved in the creation, sharing, and processing of actionable information as well as aid the development of tools in this area. PageV Actionable Information for Security Incident Response November 2014 Table of Contents Executive summary iv 1 Introduction 1 1.1 Audience and scope 1 1.2 Definition of “actionable information” 2 1.3 Properties of actionable information 2 1.3.1 Relevance 3 1.3.2 Timeliness 3 1.3.3 Accuracy 3 1.3.4 Completeness 3 1.3.5 Ingestibilty 4 1.4 Levels of information 4 1.4.1 Low-level data 6 1.4.2 Detection indicators 7 1.4.3 Advisories 8 1.4.4 Strategic reports 8 2 Processing actionable information 10 2.1 Collection 11 2.1.1 Sources of information: internal vs. external 11 2.1.2 Level of automation 12 2.1.3 Properties of data collection methods 12 2.1.4 Evaluation of data sources 14 2.1.5 Recommendations 14 2.2 Preparation 15 2.2.1 Parsing 15 2.2.2 Normalization 17 2.2.3 Aggregation 19 2.2.4 Enrichment 20 2.2.5 Automation 21 2.2.6 Recommendations 22 2.3 Storage 22 2.3.1 Retention time 23 2.3.2 Scale 23 2.3.3 Dataset management 24 2.3.4 Technologies 25 2.3.5 Recommendations 26 2.4 Analysis 27 2.4.1 Fundamentals 27 2.4.2 Investigation 29 2.4.3 Situational awareness 32 2.4.4 Metrics 39 PageVI Actionable Information for Security Incident Response November 2014 2.4.5 Meta-analysis and source evaluation 39 2.4.6 Recommendations 40 2.5 Distribution 41 2.5.1 Recipients of information 41 2.5.2 Technical aspects of information distribution 43 2.5.3 Sharing policy 45 2.5.4 Recommendations 46 3 Case studies 48 3.1 Using indicators to enhance defense capabilities 48 3.1.1 Collection 48 3.1.2 Preparation 48 3.1.3 Storage 48 3.1.4 Analysis 48 3.1.5 Distribution 51 3.1.6 Summary 52 3.2 Improving situational awareness through botnet monitoring 52 3.2.1 Collection 53 3.2.2 Preparation 53 3.2.3 Storage 53 3.2.4 Analysis 53 3.2.5 Distribution 57 3.3 Effective data exchange on a national level 58 3.3.1 Collection 58 3.3.2 Preparation 59 3.3.3 Storage 59 3.3.4 Analysis 60 3.3.5 Distribution 60 4 Gaps and recommendations 61 5 Conclusion 64 6 References 65 PageVII Actionable Information for Security Incident Response November 2014 1 Introduction In the world of incident response, information is everything.

Load more