Which cybersecurity problems are addressed by BRSE?
Management: 16 issues with 4 critical and 6 serious
Defense: 16 issues with 1 critical and 6 serious
Posture (former RAP): 10 issues with 3 critical and 2 serious
Protect: 8 issues with 2 critical and 2 serious.
88% of all problems related to breach.
60% of all problems related to preparation for breach response.
70% of all management related problem can be solved with the correct approach (like BRSE).
Security Engineering aka Protect holds only 16% of all challenges.
Breach types aren't predefined
Breach Response does not have priority - it's the other way around.
SOC refuses to take ownership of breach response
Breach response types aren't predefined
Preparation to beach response does not have priority
Cybersecurity in its modern state runs on terminology which does not consistently describe the reality. - > Mismatched objectives -> Poor performance
Cooperation between cybersecurity roles and functions is very weak which leads to response team lacking context knowledge during breach -> delays the breach disruption to unbearable times -> breach spreads too broad -> cost of the damages from the breach becomes too high -> collateral damage from response is also high.
the most sophisticated breach types are faced by the least trained security analyst and then escalation hierarchy as per ITIL -> missed breaches - > delays -> poor performance
Requirements to the end state for the breach response are unclear -> objectives not achieved
Lack of formalized client | IT Estate onboarding methodology which is based on relevant breach types, associated TTPs, in-depth IT Estate discovery.
Lack of preparedness for response through anticipation modeling and testing which is "compensated" by reliance on the "investigation" DURING the breach. -> time loss when needed most -> higher cost of the breach
Lack of preparedness for the response to the breach in its entirety: how pivoting and lateral movement map into the current network design. - > missed persistence implants and miscalculated blast radius
Lack of standard response procedures based on TTPs
Lack of predeployed tools specifically for manual disruptive breach response
Lack of pre-established and approved communication tools for security ops and IT Ops to work together in real time as a team.
Lack of proper and tested access for manual breach disruption by SOC analysts for pre-approved responses
Lack of formalized process for establishing breach blast radius based on the attack tree of the breach and lack of preparation and modeling
Lack of formalized process for tracking down implants which ensure persistence
No established relationship and tested recovery from the breach by IT Ops | SRE | DevOps
Lack of the Blue | Green deployment model for the production, which leads to uncertainty during recovery. Instead of patching prod - updating blue env and switching over
Lack of architecture focus on the splitting data and code which accelerates response and recovery
Lack of Infrastructure as Code which removes direct privileged access by IT Ops
Response team is not fully enabled thus is not prepared to the reachable levels which contributes to poor performance during the actual breach. Analysts burnout due to lack of authorization and preparedness for the "Real thing".
Response is not tested and readiness is not measured
Collateral damage during the response is neither optimized nor managed
Obsession with default rules. Detection coverage mostly mismatches the relevant TTPs
Weak "client| IT Estate" onboarding focused on "log sources" instead o relevant breach types and TTPs and creating holistic model of the environment for the breach type modeling and preparing for detection and response
Threat Hunting is used as one-time side gigs instead of being focused on detection engineering, especially during during onboarding and later on in order to keep everything up to date.
Overreliance on built-in correlations. Detection is not designed against its breach steps in the context of the entire breach and defense-in-depth as per OSFI B-13.
Large portions of IT Estate and telemetry types are excluded completely from the detection tools as unfeasible sources which were never considered like application, access and endpoint (AV/EDR) telemetry -> detection blind spots -> late detection -> incomplete attack chain visibility -> delayed response and missed persistence implants.
Detection does not take into account types of detection: direct| indirect.
Detection is not linked to the response through standard response procedures: response should dictate not only the case of alert about the particular TTP being used, but to try to spot the smallest target for the response to strike out. MINIMIZING COLLATERAL DAMAGE OF THE RESPONSE through precise (either with direct detection or by using reverse tracking in case of indirect - N+1 layer or intermediary media between the layers of the defense in depth during pivoting or lateral movement) detection as well.
Analysts burnout by wasting most of their time "handling| managing" false positives brought up by default alerts
Detection is not tested and its coverage is not measured
Relevant TTPs are often not selected
Breach is not defined correctly
Taxonomy of severity of the situation can't present reality adequately
No doctrine to ensure consistent QoS for cybersecurity, PPT isn't enough
Excessive log collection leads to overloading production environment which leads to capital cost increase to accommodate security monitoring
Vulnerability and threat management programs are too broad and disconnected from relevant TTPs
Hardening programs are too generic and disconnected with relevant TTPs
Reporting is focused on busyness and doesn't provide clarity
Overcomplicated asset prioritization methodology which are based on risk-based ALE calculations instead of straight-forward crown jewel prioritization matrix.
Contextual information about the environment is lacking when needed and it's needed for narrowing the list of relevant TTPs
Security solutions are deployed without proper integration into unified response to relevant TTPs
Security solution - coverage shrinking due to lack of run and maintain & operate function (engineering deployed and walked away)
Security solutions have low and unmeasurable RoI due to lack of RATIONALE provided by clear and direct hierarchy of objectives (denial and disruption of relevant TTPs) -> overlapping portfolio -> excessive costs
No formal initiative to achieve 80/20 ratio between auto-response and manual response for relevant TTPs leveraging hardening and security solutions as part of the holistic breach response approach as a key objective of cybersecurity -> low-hanging fruit type TTPs response to which could've been automated are overwhelming security analysts in charge of manual response - > burn out -> lack of time to prepare properly
No breach modeling done holistically as per their kill| attack chains
Cybersecurity resources are spread thin with irrelevant tasks like ensuring CIA Triad, compliance, availability-HA, recovery etc.