Cyber threat analytics: Putting the human back in the loop

Cyberattacks have been increasing in speed and scope, demonstrating capabilities that are challenging the ability of even the fastest machines to respond. Security organizations in the government and the private sector alike have begun to realize that machine analytics alone cannot substitute for real-time communication between human analysts when confronting the current threat environment.

By any estimate, the WannaCry attack in May was the fastest-spreading self-propagating worm ever detected. It spread through unpatched Windows machines around the world in a matter of hours, with the Financial Times reporting that it affected more than 200,000 machines in the first round of attacks. The discovery of a “kill switch” prevented the payload from executing in most situations, but the worm caused significant damage as it propagated through unpatched networks. Security researchers continued to report “rebound” infections inside vulnerable Windows networks for several weeks. The attack exploited a vulnerability for which a patch existed, and defense consisted of a “fire drill” to deploy the patch in any vulnerable network.

A far more serious threat (and the first view into what type of damage can occur from a true zero-day attack) occurred with the Petya  or NotPetya virus that took down the Ukrainian economy and several major international corporations in June. Petya exploited a vulnerability in software used by the Ukrainian government to handle tax and other financial transactions with individuals and businesses. Pharmaceutical giant Merck and Danish shipping company Maersk were both incapacitated by the virus within hours. Although the initial infection exploited a vector in the Ukrainian software, it spread throughout Windows networks in a manner that Microsoft has yet to explain.

Different from WannaCry, Petya’s purpose was destruction, not ransom. Affected machines in the management systems of Merck and Maersk were bricked, unrecoverable, and front-office functions were shut down within hours, according to Forbes. Maersk lost the ability to move its ships in or out of international ports for several days, effectively crippling a major part of the transportation network. Merck is still trying to recover production and packaging capabilities. According to sources familiar with the attack, the virus spread at machine speed, hitting tens of thousands of Windows systems within minutes of gaining access to a network, successfully defeating end-point sandboxing technologies by crashing the boxes before analytics could be completed.

The total impact was so shocking that on Sept.  20, the House Energy and Commerce Committee issued letters to Merck requesting testimony on the scope of the damage.  The committee also has asked the Department of Health and Human Services to explain what the government intends to do about the situation.

A small hint of one solution was shown by the role played by the Healthcare Cybersecurity Communications and Intelligence Center (HCCIC), a fledgling threat analytics center that played a central role for HHS during the WannaCry incident.

HHS Senior Advisor for Healthcare Public Health Sector Cybersecurity Leo Scanlon, testifying at a June 8 hearing of the Oversight and Investigations Subcommittee of the Energy and Commerce Committee, described the role that a small threat-sharing watch floor played in supporting emergency response capabilities that the agency typically brings to natural disasters.

The watch floor supported a group of analysts who were tracking events in real time and communicating with private-sector partners through the National Healthcare Information Sharing and Analysis Center. This network provided real-time updates on current intelligence and was able to dispel rumors and bad guidance that proliferated on the internet. Organizations with capabilities to reverse engineer malware samples made their findings known hours and days ahead of official information from other government sources, putting HHS out in front of other government agencies in responding to the crisis.

The secret to the watch floor idea is that it puts the human back in the analysis loop. Automated sharing of threat indicators has been widely heralded as the “silver bullet” to defend against automated attacks. The Department of Homeland Security, for example, has a much-publicized program called Automated Indicator Sharing, which provides threat indicator reports to its subscribers. The reports are formatted and transmitted using protocols that can be consumed by network defenses and deployed at machine speed. The problem with this effort, and the many commercial variants that provide enormous amounts of similar threat data, is that there is no way to ingest and consume the information without analyzing it to determine if it is valid, or relevant to a particular environment.

That type of analytical work can only be done by highly trained specialists who know their networks and who can compare notes with colleagues in real time. Linking those groups of analysts to each other is a primary goal of the HCCIC, according to its director, Maggie Amato. Speaking at the (ISC)2 CyberSecureGov conference in June, Amato said the agency was building links with DHS, the Defense Department and private sector partners that would strengthen resilience for the entire sector. “We really do want to get to a place where we are collaborating with each other and cooperating across the board, having dynamic threat sharing and not just automated indicators,” he said.

Cybersecurity watch floors are being integrated with state and local level emergency response fusion centers. New Jersey has established the NJCCIC, California has numerous centers that serve as hubs for universities and localities and the Los Angeles Integrated Security Operations Center is recognized globally as a leader in municipal cybersecurity.

The trend is clear with these developments -- defenders must share and crowdsource the same way the attackers do -- the machines can’t do that on their own. The most important outcome of this human analytical activity will be much-needed context about new attack mechanisms and how they are used to exploit vulnerabilities in ways specific to different sectors. This understanding of tactics and techniques, in context, will add a critical degree of resiliency that is now lacking.