Blog

Ransomware

OT

Thought Leadership

米国連邦政府へのインシデント報告をDarktraceのCyber AI Analystが加速

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
12
Apr 2022
12
Apr 2022
This blog explains how Darktrace helps defenders abide by US federal laws on reporting cyber security incidents, featuring a real-world example of a ransomware attack investigated by Cyber AI Analyst.

2022年3月15日、バイデン大統領は、議会オムニバス歳出法案の一部に含まれるCyber Incident Reporting for Critical Infrastructure Act(重要インフラに対するサイバーインシデント報告法)に署名しました。この法律は、重要インフラの所有者および運営者が、ランサムウェアの支払いや大きなサイバー攻撃についてCyber and Infrastructure Security Agency(CISA)に対し速やかに通知することを義務付けています。

このCyber Incident Reporting for Critical Infrastructure Actにより2つの新しい報告義務が生まれました。

  1. 特定のサイバーインシデントについてDHS CISAに72時間以内に報告すること
  2. ランサムウェアの支払いについて24時間以内に報告すること

DarktraceのAIはサイバーインシデントの報告プロセスを加速してこの新しい法律に対応します。具体的には、DarktraceのCyber AI Analystが個別のセキュリティインシデント間のつながりを教師あり機械学習により理解し、NLP(Natural Language Processing)を使って人間が読める言語でインシデントレポートを自律的に記述します。これらのDarktraceインシデントレポートに基づいて人間のアナリストがCISAに迅速かつ効率的に報告書を送付することができます。

以下のケーススタディでは、重要インフラを管理する組織がランサムウェアおよび悪意あるデータ抜き出しの被害に遭った際にCyber AI Analystがシームレスな報告書作成を促進した実際の事例を紹介します。人間のアナリストの行動に基づいてトレーニングされたAIテクノロジーは、調査をマシンスピードかつマシンスケールで再現することにより、関連のあるイベントを数分で洗い出し、セキュリティチームは何が起こったのかを正確に理解しこの情報を関連当局に共有することができます。

以下の脅威調査レポートは重大な脅威の検知結果をステップバイステップで技術的詳細とともに解説し、Cyber AI Analystの威力とスピードを実証しています。

Cyber AI Analystのインシデントレポート

ランサムウェアがこの組織を襲った時、Cyber AI Analystはインシデントの全貌を自律的に調査し、攻撃の進行を明確に示した自然言語で記述されたサマリーを生成し、きわめて有益でした。

図1:Cyber AI Analystがインシデントの全貌を明らかに

この攻撃の後、さらにDarktraceのテクノロジーは攻撃のタイムラインを整理し、どのファイルが侵害されたかを識別してアナリストを支援しました。これによりセキュリティチームはランサムウェア攻撃に関連した悪意あるアクティビティを特定することができました。

図2:Cyber AI Analystは侵害されたデバイスが経験した攻撃チェーンの各段階を表示

Darktrace AIからの情報を使って、チームは容易に攻撃のタイムライン、影響を受けたデバイス、使用された認証情報、アクセスされたファイル共有、抜き出されたファイル、そして接触された悪意あるエンドポイントを特定することができ、攻撃の規模を開示して必要な当事者に知らせることができました。

この事例は、Cyber AI Analystがどのように重要インフラの所有者および運用者を支援し重大なサイバー攻撃について連邦政府への迅速な報告を可能にしたかを実証しています。重大なインシデントについては報告の期限が72時間 — ランサムウェアへの支払いは24時間 — であることを考慮すると、Cyber AI Analyst は重要インフラにとってもはや、あったら良い程度の機能ではなく、必須のものとなったと言えるでしょう。

攻撃の詳細:ランサムウェアおよびデータ抜き取り

Cyber AI Analystは上に示したインシデントレポートにも見られるように、最も重要な情報を読みやすいレポートとして、人間の関与をまったく必要とせずに提供しました。次に、この攻撃をさらに分解してDarktraceの自己学習型AIが攻撃のライフサイクル全体を通じて不審なアクティビティをどう理解したのかを見ていきます。

この二重恐喝ランサムウェア攻撃において、攻撃者は22日間に渡ってデータを抜き出していました。Darktraceの自己学習型AIによる検知結果、および並行して行われたCyber AI Analystによる調査は、攻撃チェーンをマッピングし、どのデータがどのように抜き出され暗号化されたかを特定するのに使われました。

この攻撃は大きく分けて3つのイベントグループから構成されていました:

  • ブルガリアにある未知の悪意ある外部エンドポイントへの非暗号化 FTP (File Transfer Protocol) データ抜き出し (May 9 07:23:46 UTC – May 21 03:06:46 UTC)
  • ネットワークファイル共有内のファイルのランサムウェア暗号化 (May 25 01:00:27 UTC – May 30 07:09:53 UTC)
  • 未知の悪意あるエンドポイントへの暗号化 SSH (Secure Shell) データ抜き出し (May 29 16:43:37 UTC – May 30 13:23:59 UTC)
図3:攻撃のタイムラインとDarktraceモデル違反

まず、ブルガリアにある未知の悪意あるエンドポイントへの内部データのアップロードがネットワーク内で観測されました。データ抜き出しに先立って内部ファイル共有のSMB読み取りがありその後FTPを使っておよそ450GBのデータが抜き出されました。

DarktraceのAIはこの脅威アクティビティを単独で発見し、組織はどのデータが抜き出されたかをすばやく特定することができました。これらには‘人材獲得’や、‘エンジニアリングおよび建設’などのマーキングでカモフラージュされたファイルや、法務および財務関係文書も含まれており、これらは機密性の高い文書であったことが推察されます。

図4:FTPを使った外部アップロードについての2つのモデル違反を示すスクリーンショット
図5:FTPアップロードに先立ってのファイル共有からのSMB読み取りを示すスクリーンショット

モデルブリーチ:

  • Anomalous Connection / Unusual Incoming Data Volume
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Compromise / Ransomware / Suspicious SMB Activity
  • Compromise / Ransomware / SMB Reads then Writes with Additional Extensions
  • Unusual Activity / Anomalous SMB Move & Write
  • Unusual Activity / High Volume Server Data Transfer
  • Unusual Activity / Sustained Anomalous SMB Activity
  • Device / SMB Lateral Movement

このアクティビティが観測された4日後、DarktraceのAIはランサムウェアが展開されたことを検知しました。感染した複数のデバイスが通常アクセスしないファイル共有に対して異常なSMB接続を行い同じようなボリュームを読み取りおよび書き込みし始め、SMBを使ってファイル拡張子を書き込むなどをしていることが観測されました。ファイル拡張子はランダムな文字列で構成されこの標的となった組織固有のものと見られました。

Darktraceを使って、この顧客は暗号化されたファイルすべてのリストを取得しました。このリストは‘Accounts’ファイル共有に格納された財務上の記録と思われるものも含まれていました。

図6:ランサムウェア暗号化の際に追加の拡張子が書き込まれたことを示すモデル違反

モデルブリーチ:

  • Anomalous Connection / Unusual Incoming Data Volume
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Compromise / Ransomware / Suspicious SMB Activity
  • Compromise / Ransomware / SMB Reads then Writes with Additional Extensions
  • Unusual Activity / Anomalous SMB Move & Write
  • Unusual Activity / High Volume Server Data Transfer
  • Unusual Activity / Sustained Anomalous SMB Activity
  • Device / SMB Lateral Movement

これと同時に、未知の悪意あるエンドポイントへの内部データのアップロードがネットワーク内で観測されました。アップロードはすべて暗号化されたSSH/SFTPを使って行われていました。合計で、約3.5GBのデータがこの方法で抜き出されました。

攻撃者はデータの抜き出しに暗号化チャネルを使いましたが、Darktraceは外部アップロードの前に異常なSMBファイル転送を検知しており、これがどのファイルが抜き出されたかを示していました。このように、Darktraceの「時間をさかのぼる」能力がきわめて有用であることが実証されました。暗号化を使って抜き出されていたにも関わらず、どのファイルが抜き出されたかをアナリストが知る助けとなったのです。

図7:SSHを使ったアップロードの前の異常なSMBアクティビティを示すモデル違反

モデルブリーチ:

  • Anomalous Server Activity / Outgoing from Server
  • Compliance / SSH to Rare External Destination
  • Unusual Activity / Enhanced Unusual External Data Transfer
  • Device / Anomalous SMB Followed By Multiple Model Breaches
  • Device / Large Number of Model Breaches
  • Anomalous Connection / Uncommon 1 GiB Outbound
  • Anomalous Connection / Data Sent to Rare Domain
  • Anomalous Connection / Data Sent To New External Device

攻撃は他のセキュリティスタックをどのようにすり抜けたか?

ネットワーク内で権限を昇格し悪意あるアクティビティを実行するために既存の管理者認証情報が使われました。

もしDarktrace RESPONDが有効に設定されていれば、的を絞った自律的な対処を実行してこのアクティビティを早い段階で封じ込めていたはずです。RESPONDはこの異常なSMBアクティビティに関与していたデバイスに対して通常の「生活パターン」を強制し、普段接続しないファイル共有からのファイル読み取りや、ファイルへの拡張子の追加などのアクティビティを封じ込め、未知の外部エンドポイントへの接続をブロックしていたことでしょう。

しかしこのケースでは、Antigenaはアクションを実行するよう設定されていませんでした。人間の確認を必要とするモードに設定されていたのです。このインシデントはDarktraceにより明確に警告され、セキュリティチームのワークフロー上には最優先アイテムとして表示されていました。しかし、セキュリティチームはDarktraceのユーザーインターフェイスを監視しておらず、他のツールにより実行されたアクションもなかったため、攻撃は進行を許され、この組織はインシデントの詳細を開示しなければならないことになりました。

報告書作成プロセスを効率化

現在の脅威環境においては、動きの速い高度な攻撃に対し、AIを利用してマシンスピードおよびスケールで阻止することはきわめて重要です。今回の事例が示しているように、このテクノロジーは攻撃の後始末としての報告義務を果たすのにも役立ちます。

新しい法律はタイムリーな開示を求めています。多くの従来型セキュリティアプローチでは、攻撃に遭った後、組織はその詳細をすべて調べる手段を持っていません。これに加えて、これらの情報を相関づけるには何日も、あるいは何週間もかかります。重要インフラを運営する組織にとってDarktraceがもはや「あったら良い」レベルではなく、「なくてはならない」ものとなったのは、こうした理由によります。新しい法律によって重大インシデントについて迅速に報告しなければならなくなったためです。

DarktraceのAIは悪意あるアクティビティを発生次第検知し、侵害のタイムラインおよび攻撃者によりアクセスされ抜き出されたファイルについてすばやく理解する助けとなります。これにより組織は最も高度な攻撃に対しても抵抗する準備ができるだけでなく、データ侵害について報告するプロセスを加速し大幅に容易化します。

セキュリティチームは開示プロセスの手間を一人で抱える必要はありません。攻撃はあっという間に起こり、その後始末は面倒です。失われたデータを遡及的に調査することは従来のアプローチでは徒労に終わることもあります。Darktraceを使うことにより、セキュリティチームは突然の破壊的な攻撃に対して、正確かつ俊敏なデータ特定手法、そしてリスク検知および緩和策により対抗することができます。そして、その必要が生じれば、イベントについての迅速かつ正確なレポートをAIがすべて揃えて提示してくれます。

INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Justin Fier
SVP, Red Team Operations

Justin is one of the US’s leading cyber intelligence experts, and holds the position of SVP, Red Team Operations at Darktrace. His insights on cyber security and artificial intelligence have been widely reported in leading media outlets, including the Wall Street Journal, CNN, The Washington Post, and VICELAND. With over 10 years’ experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Sally Kenyon Grant
VP, Darktrace Federal

Sally Kenyon Grant is Vice President of Federal at Darktrace, working with the US Department of Defense, the Intelligence Community and Federal Civilian Agencies.

Book a 1-1 meeting with one of our experts
この記事を共有
PRODUCT SPOTLIGHT
該当する項目はありません。
COre coverage

More in this series

該当する項目はありません。

Blog

Eメール

Looking Beyond Secure Email Gateways with the Latest Innovations to Darktrace/Email

Default blog imageDefault blog image
09
Apr 2024

Organizations Should Demand More from their Email Security

In response to a more intricate threat landscape, organizations should view email security as a critical component of their defense-in-depth strategy, rather than defending the inbox alone with a traditional Secure Email Gateway (SEG). Organizations need more than a traditional gateway – that doubles, instead of replaces, the capabilities provided by native security vendor – and require an equally granular degree of analysis across all messaging, including inbound, outbound, and lateral mail, plus Teams messages.  

Darktrace/Email is the industry’s most advanced cloud email security, powered by Self-Learning AI. It combines AI techniques to exceed the accuracy and efficiency of leading security solutions, and is the only security built to elevate, not duplicate, native email security.  

With its largest update ever, Darktrace/Email introduces the following innovations, finally allowing security teams to look beyond secure email gateways with autonomous AI:

  • AI-augmented data loss prevention to stop the entire spectrum of outbound mail threats
  • an easy way to deploy DMARC quickly with AI
  • major enhancements to streamline SOC workflows and increase the detection of sophisticated phishing links
  • expansion of Darktrace’s leading AI prevention to lateral mail, account compromise and Microsoft Teams

What’s New with Darktrace/Email  

Data Loss Prevention  

Block the entire spectrum of outbound mail threats with advanced data loss prevention that builds on tags in native email to stop unknown, accidental, and malicious data loss

Darktrace understands normal at individual user, group and organization level with a proven AI that detects abnormal user behavior and dynamic content changes. Using this understanding, Darktrace/Email actions outbound emails to stop unknown, accidental and malicious data loss.  

Traditional DLP solutions only take into account classified data, which relies on the manual input of labelling each data piece, or creating rules to catch pattern matches that try to stop data of certain types leaving the organization. But in today’s world of constantly changing data, regular expression and fingerprinting detection are no longer enough.

  • Human error – Because it understands normal for every user, Darktrace/Email can recognize cases of misdirected emails. Even if the data is correctly labelled or insensitive, Darktrace recognizes when the context in which it is being sent could be a case of data loss and warns the user.  
  • Unclassified data – Whereas traditional DLP solutions can only take action on classified data, Darktrace analyzes the range of data that is either pending labels or can’t be labeled with typical capabilities due to its understanding of the content and context of every email.  
  • Insider threat – If a malicious actor has compromised an account, data exfiltration may still be attempted on encrypted, intellectual property, or other forms of unlabelled data to avoid detection. Darktrace analyses user behaviour to catch cases of unusual data exfiltration from individual accounts.

And classification efforts already in place aren’t wasted – Darktrace/Email extends Microsoft Purview policies and sensitivity labels to avoid duplicate workflows for the security team, combining the best of both approaches to ensure organizations maintain control and visibility over their data.

End User and Security Workflows

Achieve more than 60% improvement in the quality of end-user phishing reports and detection of sophisticated malicious weblinks1

Darktrace/Email improves end-user reporting from the ground up to save security team resource. Employees will always be on the front line of email security – while other solutions assume that end-user reporting is automatically of poor quality, Darktrace prioritizes improving users’ security awareness to increase the quality of end-user reporting from day one.  

Users are empowered to assess and report suspicious activity with contextual banners and Cyber AI Analyst generated narratives for potentially suspicious emails, resulting in 60% fewer benign emails reported.  

Out of the higher-quality emails that end up being reported, the next step is to reduce the amount of emails that reach the SOC. Darktrace/Email’s Mailbox Security Assistant automates their triage with secondary analysis combining additional behavioral signals – using x20 more metrics than previously – with advanced link analysis to detect 70% more sophisticated malicious phishing links.2 This directly alleviates the burden of manual triage for security analysts.

For the emails that are received by the SOC, Darktrace/Email uses automation to reduce time spent investigating per incident. With live inbox view, security teams gain access to a centralized platform that combines intuitive search capabilities, Cyber AI Analyst reports, and mobile application access. Analysts can take remediation actions from within Darktrace/Email, eliminating console hopping and accelerating incident response.

Darktrace takes a user-focused and business-centric approach to email security, in contrast to the attack-centric rules and signatures approach of secure email gateways

Microsoft Teams

Detect threats within your Teams environment such as account compromise, phishing, malware and data loss

Around 83% of Fortune 500 companies rely on Microsoft Office products and services, particularly Teams and SharePoint.3

Darktrace now leverages the same behavioral AI techniques for Microsoft customers across 365 and Teams, allowing organizations to detect threats and signals of account compromise within their Teams environment including social engineering, malware and data loss.  

The primary use case for Microsoft Teams protection is as a potential entry vector. While messaging has traditionally been internal only, as organizations open up it is becoming an entry vector which needs to be treated with the same level of caution as email. That’s why we’re bringing our proven AI approach to Microsoft Teams, that understands the user behind the message.  

Anomalous messaging behavior is also a highly relevant indicator of whether a user has been compromised. Unlike other solutions that analyze Microsoft Teams content which focus on payloads, Darktrace goes beyond basic link and sandbox analysis and looks at actual user behavior from both a content and context perspective. This linguistic understanding isn’t bound by the requirement to match a signature to a malicious payload, rather it looks at the context in which the message has been delivered. From this analysis, Darktrace can spot the early symptoms of account compromise such as early-stage social engineering before a payload is delivered.

Lateral Mail Analysis

Detect and respond to internal mailflow with multi-layered AI to prevent account takeover, lateral phishing and data leaks

The industry’s most robust account takeover protection now prevents lateral mail account compromise. Darktrace has always looked at internal mail to inform inbound and outbound decisions, but will now elevate suspicious lateral mail behaviour using the same AI techniques for inbound, outbound and Teams analysis.

Darktrace integrates signals from across the entire mailflow and communication patterns to determine symptoms of account compromise, now including lateral mailflow

Unlike other solutions which only analyze payloads, Darktrace analyzes a whole range of signals to catch lateral movement before a payload is delivered. Contributing yet another layer to the AI behavioral profile for each user, security teams can now use signals from lateral mail to spot the early symptoms of account takeover and take autonomous actions to prevent further compromise.

DMARC

Gain in-depth visibility and control of 3rd parties using your domain with an industry-first AI-assisted DMARC

Darktrace has created the easiest path to brand protection and compliance with the new Darktrace/DMARC. This new capability continuously stops spoofing and phishing from the enterprise domain, while automatically enhancing email security and reducing the attack surface.

Darktrace/DMARC helps to upskill businesses by providing step by step guidance and automated record suggestions provide a clear, efficient road to enforcement. It allows organizations to quickly achieve compliance with requirements from Google, Yahoo, and others, to ensure that their emails are reaching mailboxes.  

Meanwhile, Darktrace/DMARC helps to reduce the overall attack surface by providing visibility over shadow-IT and third-party vendors sending on behalf of an organization’s brand, while informing recipients when emails from their domains are sent from un-authenticated DMARC source.

Darktrace/DMARC integrates with the wider Darktrace product platform, sharing insights to help further secure your business across Email Attack Path and Attack Surface management.

結論

To learn more about the new innovations to Darktrace/Email download the solution brief here.

All of the new updates to Darktrace/Email sit within the new Darktrace ActiveAI Security Platform, creating a feedback loop between email security and the rest of the digital estate for better protection. Click to read more about the Darktrace ActiveAI Security Platform or to hear about the latest innovations to Darktrace/OT, the most comprehensive prevention, detection, and response solution purpose built for critical infrastructures.  

Learn about the intersection of cyber and AI by downloading the State of AI Cyber Security 2024 report to discover global findings that may surprise you, insights from security leaders, and recommendations for addressing today’s top challenges that you may face, too.

参考文献

[1] Internal Darktrace Research

[2] Internal Darktrace Research

[3] Essential Microsoft Office Statistics in 2024

続きを読む
著者について
Carlos Gray
Product Manager

Blog

該当する項目はありません。

Managing Risk Beyond CVE Scores With the Latest Innovations to Darktrace/OT

Default blog imageDefault blog image
09
Apr 2024

Identifying Cyber Risk in Industrial Organizations

Compromised OT devices in ICS and SCADA environments pose significant physical risks, even endangering lives. However, identifying CVEs in the multitude of complex OT devices is labor-intensive and time-consuming, draining valuable resources.

Even after identifying a vulnerability, implementing a patch presents its own challenges limited maintenance windows and the need for uninterrupted operations strain IT and OT teams often leading organizations to prioritize availability over security leading vulnerabilities remaining unresolved for over 5 years on average. (1)

Darktrace’s New Innovation

Darktrace is an industry leader in cybersecurity with 10+ years of experience securing OT environments where we take a fundamentally different approach using Self-Learning AI to enhance threat detection and response.

Continuing to combat the expanding threat landscape, Darktrace is excited to announce new capabilities that enable a contextualized and proactive approach to managing cyber risk at industrial organizations.

Today we launch an innovation to our OT Cybersecurity solution, Darktrace/OT, that will add a layer of proactivity, enabling a comprehensive approach to risk management. This industry leading innovation for Darktrace/OT moves beyond CVE scores to redefine vulnerability management for critical infrastructure, tackling the full breadth of risks not limited by traditional controls.  

Darktrace/OT is the only OT security solution with comprehensive Risk Management which includes:

  • Contextualized risk analysis unique to your organization
  • The most realistic evaluation and prioritization of OT risk
  • Effectively mitigate risk across your OT infrastructure, with and without patching.
  • The only OT security solution that evaluates your defenses against Advanced Persistent Threat (APT) Groups.

The most comprehensive prevention, detection, and response solution purpose built for Critical Infrastructures

Darktrace’s Self-Learning AI technology is a cutting-edge innovation that implements real time prevention, detection, response, and recovery for operational technologies and enables a fundamental shift from the traditional approach to cyber defense by learning a ‘pattern of life’ for every network, device, and user.  

Rather than relying on knowledge of past attacks, AI technology learns what is ‘normal’ for its environment, discovering previously unknown threats by detecting subtle shifts in behavior. Through identifying these unexpected anomalies, security teams can investigate novel attacks, discover blind spots, have live time visibility across all their physical and digital assets, and reduce time to detect, respond to, and triage security events.  

  • Achieve greater visibility of OT and IT devices across all levels of the Purdue Model.
  • The industry's only OT security to scale threat detection and response, with a 92% time saving from triage to recovery.  
  • The only OT focused security solution to provide bespoke Risk Management.

To learn more about how Darktrace/OT approaches unique use cases for industrial organizations visit the Darktrace/OT Webpage or join us LIVE at a city near you.

Read more below to discover how new innovations to Darktrace/OT are bringing a new, contextualized approach to Risk Management for Industrial organizations.

For more information on the entire Darktrace/OT Solution read our solution brief here.

Darktrace/OT and New Risk Management

Risk Identification

Leveraging the visibility of Darktrace/OT which identifies individual systems throughout the Purdue Model and the relationship between them, Darktrace/OT identifies high-risk CVEs and presents potential attack routes that go beyond techniques requiring a known exploit, such as misuse of legitimate services. Each attack path will have a mathematical evaluation of difficulty and impact from initial access to the high value objectives.  

Together this gives comprehensive coverage over your real and potential risks from both an attacker and known vulnerability perspectives. OT attack paths as seen here even leverage insights between the industrial and corporate communications to reveal ways threat actors may take advantage of IT-OT convergence. This revelation of imperceptible risks fills gaps in traditional risk analysis like remote access and insider threats.

Figure 1: Darktrace/OT visualizing the most critical attack paths at an organization
Figure 1: Darktrace/OT visualizing the most critical attack paths at an organization
Figure 2: A specific Attack Path identified by Darktrace/OT

Risk Prioritization

Darktrace/OT prioritizes remediations and mitigations based on difficulty and damage to your unique organization, using the established Attack Paths.

We ascertain the priorities that apply to your organization beyond pure theoretical damage answering questions like:

  • How difficult is a particular vulnerability to exploit considering the steps an attacker would require to reach it?
  • And, how significant would the impact be if it was exploited within this particular network?

This expanded approach to risk prioritization has a much more comprehensive evaluation of your organization's unique risk than has ever been possible before. Traditional approaches of ranking only known vulnerabilities with isolated scores using CVSS and exploitability metrics, often leaves gaps in IT-OT risks and is blind to legitimate service exploitation.

Figure 3: Darktrace/OT leverages its contextual understand of the organization’s network to prioritize remediation that will have the positive impact on the risk score

Darktrace provides mitigation strategies associated with each identified risk and the relevant impact it has on your overall risk posture, across all MITRE ATT&CK techniques.

What sets Darktrace apart is our ability to contextualize these mitigations within the broader business. When patching vulnerabilities directly isn’t possible, Darktrace identifies alternative actions that harden attack paths leading to critical assets. Hardening the surrounding attack path increases the difficulty and therefore reduces the likelihood and impact of a breach.

That means unpatched vulnerabilities and vulnerable devices aren’t left unprotected. This also has an added bonus, those hardening techniques work for all devices in that network segment, so apply one change, secure many.

Figure 4: Darktrace prioritizes mitigation reducing accessibility of vulnerability and the overall risk score when patches aren’t available

Communicate Board Level Risk with APT Threat Mapping

Darktrace/OT bridges theory and practice as the only security solution that maps MITRE techniques, frequently used by APT Groups, onto AI-assessed critical Attack Paths. This unique solution provides unparalleled insights including sector and location intelligence, possible operating platforms, common techniques, exploited CVEs, and the number of potential devices affected in your environment, supporting holistic risk assessment and proactive defense measures.

Ultimately, this becomes a power dashboard to communicate board level risk, using both metric based evidence and industry standard threat mapping.

結論

Darktrace/OT is part of the Darktrace ActiveAI Security Platform a native, holistic, AI-driven platform built on over ten years of AI research. It helps security teams shift to more a productive mode, finding the known and the unknown attacks and transforming the SOC with the various Darktrace products to drive efficiency gains. It does this across the whole incident lifecycle to lower risk, reduce time spent on active incidents, and drive return on investment.

Discover more about Darktrace's ever-strengthening platform with the upcoming changes coming to our Darktrace/Email product and other launch day blogs.

Join Darktrace LIVE half-day event to understand the reality versus the hype surrounding AI and how to achieve cyber resilience.

Learn about the intersection of cyber and AI by downloading the State of AI Cyber Security 2024 report to discover global findings that may surprise you, insights from security leaders, and recommendations for addressing today’s top challenges that you may face, too.  

参考文献

1. https://research-information.bris.ac.uk/ws/portalfiles/portal/313646831/Catch_Me_if_You_Can.pdf

続きを読む
著者について
Mitchell Bezzina
VP, Product and Solutions Marketing
Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

無償トライアルを開始
Darktrace AI protecting a business from cyber threats.