Cyber Defense eMagazine May 2019

Your Security Teams are Destroying Critical Evidence
Why Stopping Siloed Attacks is No Longer Enough
By Erik Randall, Security Engineer, Exabeam
Gone are the days of smash-and-grab cyberattacks: Cybercrimes are now sophisticated sequences that
take place over hours or days. Resolving the attack sequences requires SOC analysts to see the
complete picture. But far too many security analysts responsible for triaging events lack the
understanding and tools to give them proper situational awareness to the activities of modern attacks.
Seeing the Whole Attack Chain and Destroying the Evidence
With so many alerts to handle, Tier 1 SOC Analysts need to pick the most severe cases to deal with first
and get to the others when they have time. These “triage specialists” must balance volume, judgement
on severity, and like any position, performance metrics. Performance is often measured in ticket
resolution rates and median time to response (MTTR), so there is pressure to resolve quickly.
Many SOCs provide their Tier 1 analysts with runbooks—a set of standard procedures for resolving
common incidents. While theoretically prudent, runbooks can have a detrimental impact: while they often
aid in resolving a particular alert, they can also end up destroying evidence that might be needed to
investigate a more serious security incident.
Analysts typically take action against discrete Indicators of Compromise (IoCs) then close the ticket and
move on. But an attacker is not done once the machine is infected with malware; that’s just a foothold
toward larger goals.
Think of a laptop infected with malware. A common SOC runbook procedure is to remove the threat by
re-imaging the machine. Threat removed. MTTR low. But while the threat is gone, so too are all the
artifacts that would have helped a Tier 2 or Tier 3 analyst find the source of the attack. You might even
go so far as to say the analyst is helping the attacker by deleting all the evidence for them!
47