Are You Capturing Indicators of Compromise the Right Way?


In a threat environment, rapid communication of real time threat information is the key to detect, respond to and contain targeted attacks in a short time. Aberrant activities such as port scans, planted malware or spear phishing on the network or miscellaneous hints on system can help enterprises to cite attacks. After the identification of Indicators of Compromise in a process of incident response they can be used for early detection of future attack attempts. Codifying Indicators of Compromise is an impressive step forward in making it easier to share threat data across organizations. It represents a significant leverage point for advancing the state-of-the-art in information security.  An Indicator of Compromise narrows the gap between threat detection and incident response.

How to capture Indicators of Compromise in your networks?

It is necessary to keep an eye on the activity within the network and look for traffic leaving your perimeter. Set your focus on unchecked network traffic which if found in your system could be analyzed for hints before any real damage is done. Aberrations in privileged user account activity are an indicator of compromised networks. Keep a track on them to be vigilant of insider attacks and account takeover. If a system is inexplicably patched without a reason, that could be a sign that an attacker is locking it down or making it invisible to detection systems. Identifying a bundle of data in unexpected place is another telltale sign. Unfamiliar web traffic that does not seem to be induced by human behavior is a palpable evidence of possible network breach and exfiltration.

  • Implementing a security information and event management system (SIEM) is the most effective method to measure an unusual event (any possible threat/breach) that can be happened or happening in the corporate infrastructure. SIEM system collects data from numerous types of log sources and enables the analyst to evaluate the data by correlating it. If something unusual has been detected a notification is sent out so that countermeasures can be initiated.
  • Intrusion Detection System (IDS) attempts to identify unauthorized, illicit and anomalous behavior based on network traffic, specific device or physical systems such as security cameras, firewalls, man traps etc. Aggregating Indicators of Compromise collected from different systems and trails can help to capture a clear picture of the current threat landscape of attacks and attackers.
  • NetFlow analysis is capable of summing up information about network traffic into precise records providing a running history of network connections that may be referenced during incident response and forensics. NetFlow facilitates a head start to analyze every system on the network to find the extent of the breach.
  • In Network Behavior Analysis, the network traffic statistics in the NetFlow format is used to analyse the patterns in network-traffic structures to identify possible attacks without compromising user data privacy. The detection method uses the history of traffic observations to build a model of acceptable, relevant characteristics of network behavior. NBA is capable of detecting attacks that are difficult to discover using IDS systems based on the identification of known malicious patterns in the content of the packets.
  • Continuous Infrastructure Monitoring enables information security professionals to see a continuous stream of risk to their network security, data and even cloud devices and applications. Determining the necessary security controls as well as monitoring the efficiency of security controls is directly facilitated by real time monitoring.

Unified visibility is a critical asset that can ensure that hidden threats are detected in time and future threats are predicted and blocked with ease. By creating and sharing Indicators of Compromise among organisations, the defences will be bolstered and the ability to withstand attack will be significantly enhanced. The only challenge is that perceptive algorithms must complement the automated capabilities of security monitoring systems, which depends on the vastness and accuracy of the threat intelligence available.

The foreseeable end result is that attackers will have to spend considerably more resources in order for their exploits to be successful since organisation’s networks will no longer be an easy target for them owing to their active defences.

By building a strong base for recording Indicators of Compromise, organisations will be able to take a more active defence stance and take automated mitigation steps to eliminate even the most advanced threats.


Leave a Reply

Your email address will not be published. Required fields are marked *

* Please enter the Characters - [Case Sensitive]