As the Lead Consultant at Quantum Risk Solutions and a certified expert in the field, I regularly analyse the evolving landscape of cyber security threats. The recent disclosure by MITRE, an organisation renowned for maintaining the highest standards of cyber security, about its cyber security breach is a stark reminder that no organisation is immune to cyber threats, not even those at the forefront of the cyber security field.
This incident underscores the persistent and evolving nature of cyber threats and highlights the necessity for continuous improvement in cyber security practices. This blog aims to dissect the incident, understand the tactics, techniques, and procedures (TTPs) used by the attackers, and provide strategic advice for organisations looking to fortify their defences against sophisticated threats.
Cyber Security Incident Analysis
In April 2024, MITRE identified a breach that was meticulously executed through the exploitation of two zero-day vulnerabilities in Ivanti Connect Secure, impacting their VPN services. Subsequent incident analysis dissects the key attack vectors utilised by the cyber adversaries:
Initial Entry via Zero-Day Vulnerabilities:
The attackers exploited previously unknown vulnerabilities in the Ivanti Connect Secure platform. Zero-day exploits represent one of the most dangerous vectors as they target flaws that are not yet publicly disclosed, giving defenders no time to patch or prepare defences.
The critical role of VPNs in maintaining secure remote access means that the compromise of such systems can provide attackers broad access to an organisation’s network.
Bypassing Multi-Factor Authentication (MFA) Through Session Hijacking:
The attackers were then able to circumvent MFA, a core security measure, indicating a high level of sophistication. Session hijacking typically involves stealing or forging session tokens that can trick systems into granting unauthorised access. This suggests that the attackers had a deep understanding of MITRE's authentication mechanisms.
Lateral Movement and Deep Network Penetration:
After gaining initial foothold, the attackers exploited a compromised administrator account to access the VMware infrastructure, showing the attackers had reached a level of access where they could manipulate and potentially control core network functions.
The use of compromised high-level credentials highlights a critical vulnerability in the management of administrative privileges and the necessity for robust detection mechanisms to monitor unusual activities tied to high-risk accounts.
Employment of Advanced TTPs:
The sophistication of the techniques used suggests that the adversaries were not only well-equipped but also possibly had a prior understanding of MITRE’s network architecture. The ability to move laterally and manipulate infrastructure indicates premeditation and advanced planning.
The strategic use of backdoors and web shells for maintaining persistence within the network further emphasises the need for comprehensive network monitoring and the deployment of advanced endpoint detection and response (EDR) systems.
The table below outlines initial ATT&CK tactics, techniques, and procedures to offer a thorough understanding of the attack. It should be noted that the list may be incomplete as the investigation is still ongoing and evolving.
MITRE's Response and Strategic Actions
In response to the breach, MITRE demonstrated swift and strategic action, underlining the effectiveness of their prepared incident response protocols. This section explores the series of steps MITRE took to manage and mitigate the incident's impact, serving as a model of effective crisis management.
Immediate Containment Measures
System and Network Isolation: MITRE acted promptly to isolate affected systems and network segments to prevent further spread of the attack. The complexity of their network, which includes extensive connectivity across various labs, required more than simple changes to firewall rules. It necessitated comprehensive shutdowns and isolation of critical infrastructure, supported by a well maintained network inventory.
Strategic Governance and Oversight
Formation of an Ad-Hoc Committee: In the aftermath of the breach, MITRE's board of trustees established a specialised committee to provide oversight for the response. The Chief Technology Officer spearheaded this initiative, ensuring cohesive action across multiple departments, including IT, security, business units, communications, and legal teams, emphasising the importance of integrated governance in crisis situations.
In-Depth Forensic Analysis
Understanding the Breach: To fully assess the extent and mechanics of the breach, MITRE launched several forensic investigations. These efforts were crucial in tracing the adversaries’ actions and understanding their techniques. The use of trusted log aggregation was pivotal in piecing together the attack narrative, providing a foundation for robust forensic scrutiny.
Remediation and System Reinforcement
Securing New Infrastructure: Post-containment, MITRE focused on securing alternative computing environments. They conducted rigorous security audits and swiftly established new operational platforms for their priority projects, minimising downtime and ensuring a secure transition.
Transparent Communication Strategy
Stakeholder Engagement: Maintaining open lines of communication with all stakeholders was a priority. MITRE carefully managed the dissemination of information to ensure transparency while balancing the sensitivities of an ongoing investigation, reflecting their commitment to integrity and public trust.
Enhanced Monitoring and Future Preparedness
Deployment of Advanced Monitoring Systems: The breach highlighted the need for enhanced surveillance capabilities. MITRE rapidly deployed new sensor technology to improve data collection from affected systems. They also leveraged indicators of compromise from the breach, enhancing their threat detection and response capabilities across the network.
Strengthening Defences: Proactive Defence and Continuous Improvement
Building a resilient security posture requires a comprehensive strategy that encompasses immediate hardening tactics and ongoing improvements. The MITRE incident underlines the necessity for a dynamic approach to cyber security that not only reacts to threats but also proactively strengthens defences against future risks. Here are key areas of focus for any organisation committed to enhancing their cyber security:
Incident Review and Continuous Assessment
Regular Security Assessments: Conducting regular vulnerability assessments and penetration testing is critical. These should be comprehensive, examining not only technical systems but also organisational processes to uncover potential weaknesses.
Review Security Incidents: After any security incident, a thorough review should be conducted to update and refine the organisation's cyber security posture based on the insights gained from the incident. This includes revisiting incident response plans to reflect new threats and vulnerabilities discovered during post-incident analyses.
Ongoing Training and Awareness
Enhanced Training Programs: Continuous training and awareness programs are essential for keeping security at the forefront of every employee’s responsibilities. These programs should evolve to address new cyber security trends and common pitfalls, ensuring that all personnel are equipped to recognise and respond to security threats effectively.
Implementation of Advanced Security Measures
Strengthening Defences: Beyond immediate tactical adjustments, it’s crucial to implement additional security measures that address vulnerabilities exposed by recent incidents. This might include enhancing network segmentation, improving identity and access management protocols, and adopting more sophisticated data encryption methods. Each measure should be tailored to the specific threats and vulnerabilities experienced and anticipated.
Adaptive Security Architecture: Building an adaptive security architecture that can adjust to the landscape of emerging threats is vital. This involves employing technologies and methodologies that not only defend against attacks but also provide the flexibility to adapt quickly as attack vectors evolve.
Feedback Loops and Continuous Improvement: Establishing feedback loops within security processes can ensure continuous improvement and agility. These loops should involve regular security audits, real-time monitoring, and incident response drills, paired with analytics to assess the effectiveness of current security measures and identify areas for enhancement.
Conclusion
MITRE’s experience serves as a potent reminder of the sophistication and persistence of cyber adversaries. It underscores the need for all organisations to enhance their cyber security practices, adopt a threat-informed defence strategy, and engage in continuous learning and adaptation to combat these evolving threats effectively.
At Quantum Risk Solutions, we leverage our expertise to help organisations implement these recommendations through tailored security solutions and strategic advisement. As cyber security professionals, we draw valuable lessons from such incidents and collaborate to advance our defences against increasingly sophisticated cyber threats. This collaborative spirit is essential for building a resilient cyber security posture that can withstand and adapt to the dynamic nature of cyber threats.
Commentaires