The article describes the problem of insufficient methodical practice in the field of effective countermeasures development against cyber-threats. The knowledge about potentially dangerous adversaries` activity and their methods of action can be applied to find appropriate solution of the issue. Adversary profiling and activity emulation are considered as possible methods for further effective evaluation of the potential information security threats landscape for defended information systems in practice.
Information security measures effectiveness depends on the overall level of information security maturity in the organization. The international practices, developed by state regulators with the support of experts and research laboratories, are aimed at minimizing information security risks and neutralizing the greatest number of cyber-threats that can be implemented in the conditions of applied technologies. This approach makes it possible to select basic security measures and tools to reduce the likelihood of mistakes that can be made by information security specialists during the process of determining cyberthreats landscape to information security.
For example, the SANS Institute presents the top 18 CIS Controls (Critical Security Controls) which
are a recommended group of measures with additional prioritization between them [
Methods for assessing risks and cyber security threats are also applied by specialists in order to determine supplementary defensive measures in addition to existing requirements, which must be implemented firstly. However, these methods of assessing risks and cyber security threats are intended for independent expert analysis of the most harmful vulnerabilities, potentially dangerous adversaries, their tactics and techniques of action and used tools.
At the same time, there is a question of insufficient methodical practice to assessing adversaries` skills and capabilities for further definition of potential threats landscape to the protected information infrastructure. Besides, the formed list of cyber security threats affects the approaches for configuration of applied software, hardware devices, security tools and the overall countermeasures structure against computer attacks and any other malicious activity.
At this moment, potential threats landscape for many types of information systems in Russia is
evaluated according to new methodic, developed by Russian government regulator [
Information security threat modeling includes the identification of possible adversaries (attackers,
malicious users) and their potential. Adversaries are divided into external and internal. External
adversaries usually include state intelligence services, competing organizations, unscrupulous partners,
criminal groups (criminal structures) and external entities (individuals). Internal adversaries include
users, system administrators, service personnel, persons providing maintenance and repair of technical
devices, etc. [
Taking into account the knowledge about attacker actions during cyber-attacks, the existing approach can be improved. This will provide comprehensive approach to the problem described in this paper and helps to develop an information security threat model that is valuable in practice.
As an example, there is considered the category "criminal structures". It can be divided into several
groups that have a certain set of characteristic features. In practice, there are the following names of
groups that are widely used in publications, annual and quarterly reports in the field of information
security: hackers, hacktivists (groups with political motives), cyber terrorists, script kiddies [
It is proposed to build an adversary profiles (threat profiles), which will make the description of each
adversary more complete and meaningful for further evaluation of threat landscape to protected
information infrastructure. Recommendations for adversary profiling are based on the best practices of
SANS [
An attacker's profile can contain the following attributes [
Table 1 illustrates an example of adversary profile.
The Sandia National Laboratory in the document [
In this approach, eight categories of adversaries (eight levels) are distinguished without differentiation into internal and external. For implementing this approach, known categories of adversaries (hackers, APT-groups, external entities, etc.) can be associated with the values of special parameters and put in accordance with eight levels.
In total, there are seven parameters, which determine the level of adversary:
Threat danger from the possible consequences point of view (intensity).
Ability to remain undetected (persistence, stealth (ability to hide)).
Time of activity until the attack is detected or ended (time).
Number of group members (technical personnel).
Level of knowledge and skills in the field of information technologies and information security,
which allows implementing attacks (cyber knowledge).
Level of knowledge in the field of activity of the organization under consideration (kinetic
knowledge, in document [
In addition, in document [
The importance of objectivity and completeness of the adversaries’ assessment can be illustrated by the following example.
One of the protected objects in the organization is a website that operates on the basis of a Content
Management System (CMS). Type of action in attack (targeted attacks or mass attacks), capability for
writing exploits and other attributes influence the methods of defense [
If mass attacks are considered as potentially dangerous, then target organization needs to implement timely security updates of the CMS and installed plugins and control the unavailability of the configuration file containing passwords from databases. Meanwhile, as a method of analyzing the initial security of the website, it will be enough to use a security scanner to search for and eliminate vulnerabilities.
If there is high probability of implementing targeted attacks to information system, then the company's website should be checked with usage of automation tools: for collecting information about the CMS from the internet: CMS version, open directories, configuration files, installed plugins, vulnerabilities; for availability of ready-made exploits for the identified vulnerabilities.
It is recommended to make an attempt to crack the administrator's password, to exploit the identified
vulnerabilities, in other words, to conduct a penetration test for this entry point into the company's
infrastructure [
development emulation for further threat countermeasures
The dependence between methods of attacks used by adversaries and goals of their activity, as well as with possible effective countermeasures, exists for a large number of information security threats. Such dependencies are identified by research laboratories during the process of information security incidents analysis and can be presented in a systematic form.
The most complete and detailed classification was presented by MITRE Corporation in the form of
ATT&CK (Adversarial tactics, techniques & common knowledge) matrices [
The ATT&CK matrices contain hundreds of methods (techniques) of malicious actions that can be used in attack scenarios for realization of information security threats. This concept provides opportunity to form a list of information security threats, which definitely may be implemented by adversaries.
The main task for the first stage of working with the adversary techniques taxonomy is to analyze initial list of techniques from ATT&CK and determine those that are probably executable in protected system. The author has previously considered this issue; the results are presented in articles [15] and [16].
Then, the list of information security threats is studied thoroughly in order to determine the necessary defensive measures. At the same time, defensive measures may depend on adversary profile. 3.1.
In order to ensure the practical significance of the process of determining information security threats landscape, it is reasonable to analyze the initial security level of information system by emulating selected tactics and techniques of adversary actions.
To emulate in this context means to imitate exact tactics and techniques, that attackers use against protected information infrastructure. Emulation provides opportunity to ensure that information security system can detect and defend against the exact type of attacks, which may be expected from real-world attackers.
Emulation of adversary activity can be carried out by building respective plans/chains of techniques for implementation. This approach is the most appropriate, since it allows evaluate possibility of implementing previously successfully carried out attacks in the world that have become known and information about which has been entered in ATT&CK.
In addition, selective emulation of techniques for any tactic can be carried out in order to check individual defense subsystems for resistance to possible actions of attackers.
The tactics in ATT&CK are related to each other. To emulate one tactic, specialist may need the
results obtained when emulating another. Figure 1 shows an example of sequential emulation of
techniques for the Credential Access [
It is recommended to take into account results of the Tripwire expert analysis of exploiting techniques complexity from the ATT&CK Enterprise matrix [17]. It is more difficult to emulate some techniques than others are. The Tripwire experts proposed the TEACH classification and laid out a table with a color gradation of techniques in accordance with this classification.
The TEACH approach presents the following complexity levels of adversary activity emulation: Techniques Only (those techniques that are not represented by an independent exploit and in general don`t need special actions to achieve tactic); Exploitable to Anyone (easily implemented techniques that do not require specialized tools and scripts, can be implemented with built-in services); Additional Steps Required (easy-to-use techniques using PowerShell/cmd/bash scripts, Metasploit and other emulation tools); Cost Prohibitive (more complex ways of performing actions, it may be necessary to model the real information infrastructure (Active Directory, network and switching equipment, DNS server, DHCP server) [18]; Hard (the most difficult to implement technologies that require customized libraries and executable files).
Considering these recommendations, emulation of techniques scenarios can be performed starting with the most easily implemented chains of adversary tactics and techniques. It is useful to implement multi-stage threats based on the analysis of criminal group activities that used emulated techniques [19]. Such actually used techniques by adversaries with examples are called procedures in terms of ATT&CK matrices.
To sum it up, at the current stage of work, recommendations have been formed for building adversary profile reflecting valuable attributes of criminal group activity. Implementation of adversary activity emulation provides opportunity to evaluate whether possible adversary may actually conduct computer attack using different techniques.
In future work author plans to conduct a research on the questions of mitigation measures
implementation against techniques and existing practical issues in application of new threat evaluation
methodic [
Golushko, M. N. Zhukova. [16] Systematized adversary techniques knowledge implementation in the process of assessing information security system effectiveness. Materials of the XXIII International Scientific and Practical Conference, dedicated to in memory of the general designer of rocket and space systems, Academician M. F. Reshetnev (November 11-15, 2019, Krasnoyarsk): Krasnoyarsk, 2019. - part 2, pp. 418-419. A. P. Golushko, V. G. Zhukov. [17] Tips on how to implement and use the MITRE ATT&CK framework, 2019. URL: https://ethhack.com/2019/05/how-to-implement-and-use-the-mitre-attck-framework/. [18] Setting up a Threat Hunting Lab, 2017. URL: https://cyberwardog.blogspot.com/2017/02/settingup-pentesting-i-mean-threat.html. [19] MITRE ATT&CK groups, 2021. URL: https://attack.mitre.org/groups/. [20] Five Clear Steps to Enhance SecOps with MITRE ATT&CK, 2021. URL: https://enterprise.verizon.com/resources/reports/2021-data-breach-investigations-report.pdf. [21] Atomic Red Team, 2021. URL: https://github.com/redcanaryco/atomic-red-team.