Contact Us

Responsibility Allocation

blue

Managed Detection & Response (MDR) Service

Cloud Vendors and Shared Cyber Security Responsibility


While cloud vendors usually have their own stringent cyber-security measures in place, organisations are still responsible for protecting their networks. If sensitive customer data is leaked or an organisation falls victim to a phishing or ransomware attack, it is the organisation that is ultimately culpable. 

Furthermore, while data may be protected within the cloud, organisations are still vulnerable to endpoint attacks. This is because many of these endpoint devices do not have adequate levels of security protection, offering threat actors a multitude of entry points to attack. 

The security threats related to cloud services are usually related to authentication and public APIs. While a strength of cloud services is their ability to make data sharing easy across organisations, this has simultaneously made it harder to identify unauthorised third parties.

Cloud Service Models and Responsibility Allocation


There is often confusion surrounding how much responsibility cloud service providers have for their customer’s cyber security. Below is a breakdown of the different types of cloud service provider and the associated allocation of responsibility for cyber security. 

IaaS is a form of cloud computing where the provider manages IT infrastructures such as storage, server and networking resources, providing virtualized computing resources via the internet. IaaS services usually allocate the least amount of responsibility onto vendors compared to other cloud service models.

The responsibility between customer and provider tends to vary but can be summarised by the following:

: Endpoints, user and network security, workloads and data, any application installed on the infrastructure. 

PaaS is a form of cloud computing where the customer has access to the complete cloud platform, including hardware, software, and infrastructure. This allows customers to develop, run and manage applications. This allows customers to avoid investing in expensive IT infrastructure and software licenses. 

Similar to IaaS, the responsibility between customer and provider tends to vary but can be summarised by the following:

: Platform security (hardware and software)

: Endpoints, user and network security, workloads, applications developed on the platform.

SaaS is a form of cloud computing that provides customers with applications over the internet, allowing organisations to use an application without the cost of investing in the infrastructure.

While SaaS usually attributes more security responsibility on the vendor compared to IaaS and PaaS, organisations are still responsible in securing multiple areas as summarised below:

: Endpoints, user and network security, misconfigurations, workloads, and data.


With the threat of cyber-attacks continuing to grow exponentially, cyber security should be a top priority for organisations of all sizes. While cloud vendors do secure and protect data to an extent, they should not be relied upon entirely as a means of ensuring organisations are protected. Therefore, it is vital that organisations firstly understand the level of protection that their cloud vendors offer and, secondly, that they secure those areas of cyber security that are not included in their cloud service. 


With responsibility for cyber security ultimately still lying on the organisation, it is vital that a comprehensive security solution is adopted to mitigate the risk of cyber threats. Our 

 for Cloud service provides complete visibility across public clouds, SaaS, and hybrid IT infrastructures. The service is run from our UK-based Security Operations Center (SOC) and manned 24/7 by our team of highly skilled Cyber Analysts. By utilising our service, we can help protect your organisation from:

Suspicious User, Account and Application Activity

Our analysts can threat hunt across multiple cloud vendors including, but not excluded to, Amazon AWS, Microsoft, and Google.

Rapid Alerting – in as little as 15 minutes

By adopting our unique MDR service, you can feel reassured that your network is being monitored 24/7 by our highly skilled Cyber Analysts. While many cyber security services tend to rely on automation, our service combines technological intelligence with human expertise and intuition, leading to the ultimate cyber security solution that leaves no stone unturned.

Secure your network today with Telesoft by contacting us at: 

The allocation of cyber security responsibility between cloud vendors and their customers is commonly misunderstood. We take a look at clarifying some misconceptions and explore how our MDR for Cloud service can help bolster your cyber security.

Cloud-Based Cyber Security: Understanding the Shared Responsibility Model

In December 2021, a new remote access trojan (RAT) was discovered and investigated by cyber security firm Intezer. 

 is an advanced RAT which has been written to infect Mac OS, Windows, and Linux operating systems, meaning most modern-day networks are at risk. Once infected, SysJoker can install additional malware onto the network, run commands and eventually remove itself from the infected network. These vulnerabilities can lead to a wide range of security problems for businesses as the attacker can use these commands to exfiltrate specific data or cause a denial of service on critical systems. The malware is tailored, meaning it will act differently depending on the OS in use, which indicates this has been written by an experienced hacker. Excellent anti-virus evasion techniques built into the malware allows the RAT to remain undetected on networks until it is called upon through its command and control (C2) infrastructure.


 to hunt for known and unknown threats, including SysJoker. Intezer released a list of indicators of compromise (IoC) which assist in this threat hunt. Firstly, the malware uses a Command and Control (C2) infrastructure, Telesoft can use bespoke hunting techniques and custom dashboards on the TDAC to highlight botnet communications. This returns all connections that seem suspicious, such as communicating routinely throughout the day on an IRC port. In addition, it highlights connections that only happen between the same addresses indicating that an infected IP is signalling back to the C2. The TDAC can search through an entire network for an IP associated with the malware by using its advanced built in query engine. Depending on how the TDAC has been configured, this search can look back through at least 3 months of flow data to see if this IP has communicated with the network in any form. 

Once a connection has been discovered by Telesoft’s 24/7 Threat Hunting Team, a case will be created, and rigorous investigation will begin. Telesoft can provide both active and passive response methods which can be pre-determined and tailored to the customer. Timing is a huge factor when it comes to breaches and so threat hunting is a critical tool to help minimise damage to the network, systems, and business reputation. 

Find out more about how you can better protect your business with our 

In December 2021, a new remote access trojan (RAT) was discovered and investigated by cyber security firm Intezer. SysJoker, is an advanced RAT which has been written to infect Mac OS, Windows, and Linux operating systems, meaning most modern-day networks are at risk.

How to Detect Emerging Threats on your Network? 

Detecting threats in network communications

Significant volumes of data are generated every second of every day as we go about our daily lives. This data is generated by a number of devices which we either directly or indirectly use, from smartphones and smartwatches, laptops and computers, to smart enabled machinery and autonomous vehicles. Whatever the device is, it generates significant amounts of data which is shared across a network during normal communications. And if these devices have been compromised in some way, these communications can be vital in identifying the anomalous activity and potentially preventing a data breach.

With an ever-growing focus on the importance of cybersecurity, many of these devices will have some kind of endpoint security solution installed on them, such as firewalls or anti-virus software, but these are primarily designed to focus on what is happening on the device itself. But what about the communications between these devices?

The data shared in these communications can be key in helping to identify anomalous or unknown malicious activity that is evading endpoint security solutions before a malicious actor is able to cause an effect. But storing this voluminous data mass can be expensive, whilst sifting through the data can be challenging.

The solution? Extracting communications metadata can be a crucial capability when it comes to enhancing your existing security posture, offering a number of benefits to an organisation.

Metadata can be described as the ‘data about data’ and is often considered in the concept of photography. For example, an image taken on a digital camera can capture the related metadata, which could include information such as the date and time when the photo was taken, camera model, resolution, settings used, and the location of the photo. This is valuable information to the right person, but often rarely seen.

The same can be said for metadata within network communications. We don’t always need to know the content of what was said, but knowing who was talking to who, how they were communicating and when can be valuable information. Specifically, the metadata within network communications relates to information such as the IP addresses from which the communication was sent from and received, which protocols were used, the ports the data was sent and received by and even the applications used to send the information. This information is highly valuable to threat hunting and incident forensics teams, enabling analysts to piece details together to understand a much more comprehensive picture. Metadata makes searching and storing information simple, and because every file includes metadata from the time it was created, it can be modified or destroyed with the right tools.

This metadata can be very valuable when it comes to identifying anomalous or malicious activity within a network. Even sophisticated threat actors, capable of successfully evading endpoint security solutions will find it very challenging to hide their external communications to command and control or staging servers. This activity will always leave a trail, and threat hunting teams can use this to understand and map their activity.

What are some of the latest threats to be identified? What impact have they caused? How have they been identified? If at all?

New network threats are being discovered and exploited all the time, whether it be attributed to massive corporations’ software, or a small vulnerable program written by one person that’s used to run malicious code.

Possibly the largest threat that was identified recently has been the Log4Shell vulnerability.

Log4J is a very common logging system written in java and distributed by the Apache Software Foundation as open-source software. Back in 2013, a patch was created to add the use of the Java Naming and Directory Interface (JNDI). This allows potential threat actors to run a very specific string using JNDI to talk to their Lightweight Directory Access Protocol (LDAP) server and retrieve a malicious file from it. The file is then put onto the victim system and run. This vulnerability was not discovered until late 2021 and was given a severity score of 10/10 by the National Vulnerability Database.

Since its discovery, threat actors from all over the world, whether they are state-sponsored, hacktivists or script kiddies, have been utilising the vulnerability to pass malicious code to a specific system to steal data or cause serious damage to a company. The impact of this vulnerability is enormous as it’s determined that around 3 billion devices could be using Log4J and any unpatched systems are under threat of DDOS, Ransomware, Crypto-mining and Data theft attacks, to name a few.

A recent (white hat) vulnerability has also included a virus that affects Apple phones. This virus, named ‘NoReboot,’ was discovered in early January. It is stored in the RAM so should be wiped when the device is switched off. However, it stops the phone from being switched off and clears the virus from the memory. When the user attempts to switch the device off, the malicious code activates and mimics the process that turns the phone off, e.g. making the appropriate vibrations and making the screen black. The phone is still on at this point and the virus can continue to operate. It also mimics the phone turning back on, showing the logo, and waiting a certain time, to not draw attention from the user to something out of the ordinary. This vulnerability is impossible to identify physically as it perfectly mimics the shutdown and boot up procedure. This virus was developed and tested by ZecOps but could pose a threat if used by external actors to spy on users as the camera and microphone will remain active.

This is of particular concern following the rapid and widespread adoption of remote working over the past few years, likely resulting in many employees using their devices more for business purposes or being provided work phones. This has increased the threat landscape significantly, offering many more potential targets for threat actors to exploit.

Why is it important to identify these threats? 

2021 saw a record number of identified vulnerabilities with 20141 CVEs generated. Nearly 2000 more than the previous record year of 2020. So far in 2022, 2136 vulnerabilities (as of the start of February) have been identified. Whilst the number of CVEs being identified will no doubt continue to increase, the impact of these vulnerabilities can vary from essentially not being a threat at all, to crippling companies and halting food/fuel supplies. This has been highlighted in recent events such as the ransomware attack against KP snacks, a large snack distributor in the UK which is highly likely to result in a shortage of supply for 6 – 8 weeks. Last year we saw another ransomware attack against JBS Meat Supplier in the US, resulting in a negative impact against America’s meat supply chain.

Whilst the victims of such attacks will inevitably brace the main impact of such an attack, resulting in financial damage, loss of revenue, damage to reputation and stocks, the impact of such attacks are also felt much wider than the company itself. In regard to both of the attacks above, food and snack supplies to the hospitality and retail industry were affected, causing a knock-on impact to the retailers and bars or restaurants who fell short on supply, as well as individuals.

How can the Telesoft Product Suite help detect threats by monitoring network communications?

Telesoft’s TDAC Platform is comprised of a number of intelligent hardware and software components. Sensors capture every communication in your network, providing full visibility whilst a data lake ingests and records all of this data.

Every flow record captured is enriched with threat intelligence. IP and domain reputation lists enable alerting of known threats. Geographic location and ASN mappings allow unexpected endpoints to be quickly identified and flagged. Signature-based intrusion detection alerts on suspicious activity, whilst buffering allows for packet data to be captured and recorded, even before the potential threat occurs.

To provide further analysis capability, the sensors support automated detection of tunnelled traffic, including GRE, GTP, MPLS and IP-in-IP, enabling visibility of the encapsulated flows. In addition, encrypted flow fingerprinting methodologies are utilised to identify threats within encrypted traffic without decrypting it, reducing latency and maintaining the privacy and integrity of the communication.

TDAC also utilises machine learning, behavioural analytics and historical baselining to monitor and identify anomalous flows, alerting the user with full flow analysis in real time. Combined with high-rate flow monitoring and intrusion detection capabilities, the TDAC Platform provides the full suite of tools to support Incident Response, Digital Forensics and 

Metadata within network communications relates to information such as the IP addresses from which the communication was sent from and received, which protocols were used, the ports the data was sent and received by and even the applications used to send the information.

The value of analysing metadata for threat hunting

Data rates are increasing day by day. Threat actors are constantly evolving their Tactics, Techniques and Procedures (TTPs). A perfect storm is brewing for security analysts and outsourcing security elements, like threat hunting, can benefit more than just security.

It is becoming increasingly challenging to comprehensively monitor networks; the traffic generated on a daily basis is at an all-time high and threat actors are using ever more sophisticated defence evasion techniques. This helps them to not only maintain persistence in the network for a prolonged period of time, but also ensures they have sufficient time to understand their target infrastructure to exact the maximum effect. And the same is true for all networks, from small or medium enterprises, up to CSP/ISP and network operators – if we are connected to the internet, then we are a potential target, it is all a matter of time. But how can we identify these evolving TTPs if they continue to evade endpoint security solutions? More importantly, how can we identify them within our network before they carry out their malicious actions?

Security needs to be considered from a more holistic approach. There is no ‘one size fits all’ or ‘silver bullet’ in cyber security and, consequently, a multitude of platforms and capabilities are required to provide a more complex and comprehensive security posture, creating a more challenging environment for threat actors to navigate.

Most organisations utilise a number of security solutions such as endpoint security, antivirus, firewalls and so on. Unfortunately, as we continue to witness in the news despite these security solutions, threat actors are still conducting successful operations. So, are these solutions ineffective? Of course not, but it has to be acknowledged that cyber criminals continue to evolve their understanding of our environments and defensive capabilities in order to bypass them and compromise a network more effectively. To bolster their cyber security, organisations should consider augmenting their existing infrastructure with tools that provide enhanced visibility that existing solutions may not provide.

Network security solutions are vital in enhancing an organisations’ security posture. Being able to see what is happening within a network is crucial to detecting threats, but being able to identify anomalous communications or beaconing outside of a network is vital to see what the endpoint solutions often miss.

Visibility into an organisations’ network traffic enables detailed analysis to be conducted by security analysts, enabling identification of changes in traffic patterns of behaviours that could indicate malicious activity, such as communications with Command and Control (C2) servers. This can often initiate the start of an investigation into a device of interest, enabling the identification of a compromised device before malware has been able to have an effect.

This proactive identification of anomalous communications activity can help an organisation to not only identify previously unknown malicious activity within their network, but it can also help to plan a response and mitigate the attack efficiently before it can have a negative impact, reducing costs associated with remediation, reputational damage and so on.

Additional tools, however, also require additional training, recruitment or upskilling existing analysts to make the most benefit from it. Consequently, this leads to additional costs, making it another barrier to entry for many small to medium enterprise organisations.

Outsourcing these requirements to service providers who can provide a comprehensive network security monitoring and threat hunting solution can be an attractive and cost-effective solution for enterprise organisations. Not only does it enable an organisation to strengthen their monitoring capabilities across all the growing data volumes, but it also enables them to proactively identify malicious activity before threat actors can exploit the network.

There is no 'one size fits all' when it comes to protecting your network

56% of organisations admit that it is highly unlikely they would be able to detect a sophisticated cyber attack. In the past year, 78% of organisations were victims of cyber-attacks which were able to access crucial data and put the companies and their customers at risk. 

This is why Telesoft has developed the Threat Hunting Service, to ensure any security incidents are minimised and identify suspicious activity as it attempts to evade detection from automated security systems.

What is a managed threat hunting service? 

A managed threat hunting service defends your organisation against potential cyber-attacks by proactively responding to security threats. 

Threats can bypass the perimeter, but we should also focus on sophisticated evasion techniques to prevent detection. This requires trained security analysts to hunt for threats to support the existing defences, creating ‘defence in depth’ or an enhanced security posture.

How does a managed threat hunting service work? 

A managed threat hunting service consists of qualified and highly trained security analysts who enhance the security posture while the enterprise can continue with business as usual. The analysts use advanced intelligence platforms to monitor every aspect of the company’s infrastructure. The enterprises are provided with actionable intelligence – the analysts will ensure every threat is validated before reaching out to the business about the severity of the impact.

Security analysts also conduct weekly and monthly reports to keep the company updated on various security issues and set up an action plan in motion to minimise the risks. The team works 24/7 and proactively responds to all incidents to make sure the company isn’t overloaded with security alerts. 

What is the average cost to set up a 24/7 security team? 

According to the 2021 Hiscox Cyber Readiness Report, the average UK business devoted 21% of its overall IT budget to cyber security, showing a 63% jump from the budgets allocated in 2020. 

Companies often set up an in-house cyber security team – the average UK salary of a Security Operations Center (SOC) analyst is £49,955 per year. Depending on the size of the company and the severity of the attacks, a business may need to hire multiple SOC analysts who are a part of a large security operations team. If an enterprise wishes to set up a 24/7 security team, they would need to hire at least six SOC analysts. 

The Infosecurity Magazine reported that C-level security executives receive 10,000 cyber threat alerts each month. There are 52,000 false-positive threats reported each year. It takes a SOC analyst 10 minutes to assess a single threat, which means they require 866 hours, or around 5 working months to assess all false-positive threats received. 

Based on this data, a company could spend £400,000 or more on hiring their SOC analyst team. 

The benefits of a managed threat hunting service

By using an outsourced managed threat hunting service, companies can reduce hiring costs while improving the quality of monitoring and overall security control. Companies can install 24/7 cloud-managed security without having to maintain their own security operations centre and spend money on hiring and training. Instead, an already-experienced security analyst takes care of your organisation’s cybersecurity needs. 

A strong monitoring and threat hunting platform will be able to help protect your business from data breaches, DNS hijacking, crypto-jacking, ransomware, and many more cybersecurity threats. 

A managed threat detection service also ensures clear communication and provides a steady stream of information to make sure no threat remains undetected. 

By using a managed threat detection service you can: 

* Proactively identify new threats with advanced analytics

* Improve threat intelligence and conduct future insights 

* Receive expert advice and intuitive reports 

The importance of having virtual & cloud security 

Virtual security solutions such as the Telesoft TDAC Enterprise provide actionable cyber intelligence, network visibility, and digital forensics. They can enhance threat detection, deep investigations, mitigation capabilities, event orchestration, and much more. They also protect global assets through the creation of an intelligence mesh connecting the whole network for full visibility.

By using virtual & cloud security, enterprises benefit from readily deployable and highly scalable software which provides accurate and enriched threat hunting across the entire infrastructure. By connecting the core network to IoT (Internet of Things) devices and the edge, the TDAC Enterprise enables real-time network visibility across the estate, including its physical, virtual, and hybrid networks. 

To see how Telesoft can help protect your company with a managed threat detection service, read more about our Threat Hunting Service and book a demo with our team today.

By using an outsourced managed threat hunting service, companies can reduce hiring costs while improving the quality of monitoring and overall security control. Companies can install 24/7 cloud-managed security without having to maintain their own security operations centre and spend money on hiring and training.

The Benefits of a Managed Threat Hunting Service

The view of the cyber threat landscape is very different depending on your perspective, this perspective is defined by what type of network you are protecting. Targeted cyber-attacks use an increasing catalogue of clever tactics and innovative attack vectors that are reshaping corporate and governmental security strategies, while wreaking havoc in consumer markets. Remaining secure in 2019 depends on many factors but ultimately defenders who will see the most success will be those who are able to identify and mitigate threats at a more granular level. The constant and ever increasing number of cyber-attacks facing organisations requires cyber security analysts and forensic specialists to detect, analyse and block cyber threats in almost real-time.

In order to adequately protect networks, defenders need access to tools and techniques that provide advanced multi-layered threat detection and agile automated mitigation in real-time to remediate cyber security incidents. And speed up the collection and analysis of cyber security incident related information for accurate forensic investigations. This, however, is easy to map out at a corporate level but at a practical level is much harder to implement.

 and mitigation? The fundamental starting point should always be network visibility. The ability to see and understand network traffic is crucial to a defenders ability to block an attack, the most efficient and effective way is to use unsampled network flow data such as NetFlow, IPFIX or sFlow collected from probes, switches/routers and network infrastructure. This good practice rule is applicable whether your 
network size is 1GbE or 400GbE, network visibility is all about creating a stable platform for your security infrastructure such as intrusion 
detection systems, analysis tools and SIEM’s to work from.

Another important weapon in a defenders toolkit is Cyber Threat Intelligence, this accumulated data gives valuable context and relevance to large amounts of data, enabling agile and improved detection of advanced threats. The UK’s National Cyber Security Centre (NCSC) categorises four types of threat intelligence; tactical, technical, operational and strategic. Together these four segments provide a clear view of the threat landscape from attacker methodologies, tools, and tactics to indicators of specific malware, details of a specific incoming attack and high-level information on changing risks.

Threat intelligence platforms built on ‘Cyber Threat Intelligence’ have become a critical security tool, using global security intelligence to detect malicious activity e.g. identifying known and zero-day threats such as protocol and application misuse, data exfiltration, DDoS attacks, malware and crimeware, botnet activity and network misuse/contamination inside a network. Defenders should look out for tools that consolidate threat intelligence from multiple sources, automate identification and containment of new attacks, security analytics, and integration with other security tools.

A smart cyber security strategy combines network visibility with threat intelligence but also the ability to block potential security incidents and risks as they happen, ideally this function should be automated to reduce resource requirements and maximise investigation work flow for post attack analysis. The question is how do you go from alert to triage to fix? The process of triaging or sorting the alerts in to relevancy is often made difficult by the vast amounts of alerts that
a network can generate, add in to this mix, false positives and alerts that aren’t grouped together, making it difficult to get any real value from alerts and potentially missing important incidents.

One way around this is to use tools such as the 

 fromTelesoft that can categorise and group network infrastructure by area according to IP address, service, application, physical or logical attribute, creating silos or entity sets of network information and alerts. Defenders can use entity sets to prioritise and automate response to incidents and gain contextual insight about an alert, accelerating the reaction time of a threat intelligence platform. This enables rapid correlation of key indicators of compromise (IOCs) such as vulnerability scoring, attack density and destination IP etc.

Executing smart alert triaging using entity sets allows defenders to identify a priority alert and keep key infrastructure functioning in the face of an attack. In most organisations a cyber emergency response team (CERT) will be responsible for this action, automating some of this activity will allow them to focus resources in other areas. One way to do this is to deploy next generation security tools that utilise Border Gateway Protocol (BGP) Flowspec, BGP-FS is the protocol all internet 
routers use to talk to each other. BGP Flowspec uses the BGP protocol to distribute flow specification filters to network routers, so when a threat is identified, the entity set or infrastructure inputs a rule to block or deny traffic related to the threat by its source, destination and a number of other characteristics. The malicious traffic is systematically and temporarily filtered off the network, blocking threats globally before they have time to form fully or scale and affect users.

When total network visibility, global threat intelligence, smart alert triaging and the ability to block cyber-attacks are combined they create a proactive agile multi-layered security strategy that keeps day-to-day operations running smoothly and important data safe. Telesoft offers a number of 

 for flow monitoring and cyber threat visibility, talk to us to about detecting and blocking threats in your network 

Want to know more? Email us to find out more

What is Multi-layered Threat Detection and Mitigation?

Telesoft’s TDAC provides security and network operations teams with a threat hunting tool that enables them to query and investigate data, to identify and neutralise threat actors within their network before they strike.

 provides highly accurate, unsampled network metadata, which is stored in Telesoft’s petabyte data lake. With access to this extensive data lake of metadata, raw network traffic and real-time Indicators of Compromise, TDAC enables network operators to carry out proactive threat hunting and identify malicious actors within their network.

Data is analysed, enriched, correlated and presented in real-time, reducing time and resources to act on events and observations. Read further to understand the benefits of Telesoft’s threat hunting solution.

When it comes to cyber security, companies use a variety of methods to protect their systems from malicious attacks. From firewalls and antivirus software to endpoint security, these are all reactive cyber security methods.

However, many companies are beginning to understand the benefits of proactive threat hunting. Below we’ve laid out the three main benefits of proactive cyber security as an element of your cyber security strategy.

1. IDENTIFY THREATS IN YOUR NETWORK BEFORE THEY ACT

Reactive cyber security methods work by detecting what are referred to in the industry as “known knowns” – something that has already been identified as a threat, such as a bad IP address or domain. With reactive cyber security, the malicious actor must threaten your network in some way in order to be identified. 

But the average threat actor has a dwell time of 180 days. That means an attacker could be hiding dormant in your network for months before taking any malicious action. In this time they could be learning about your network in depth and understanding any weaknesses before mounting an attack. 

Proactive threat hunting techniques have developed as a way to detect and identify what the industry calls “unknowns” – malicious actors that haven’t yet launched malicious activity, and therefore have yet to be uncovered by reactive methods. While attackers dwell in your network, security teams have an opportunity to proactively identify the threat and learn more about it using Telesoft TDAC.

Network anomaly detection with Telesoft TDAC allows operators and security teams to identify malicious actors lurking within networks before they have the opportunity to carry out their objectives, whether that’s delivering malware or ransomware or exfiltrating data. Once identified, the threat can either be removed immediately, or security teams can choose to monitor it in order to gain a better understanding of its behaviour. 

2. GAIN BETTER UNDERSTANDING OF CYBERCRIMINAL TACTICS, TECHNIQUES AND PROCEDURES (TTPS)

Once an “unknown” is identified through threat hunting, most companies’ immediate response would be to remove it from the network. However, there is a benefit to monitoring and observing its behaviour before responding. This helps network operators gain a unique perspective on malicious actors’ Tactics, Techniques and procedures (TTPs), and in doing so, the unknown becomes a “known known.” Understandably, this type of monitoring can only be done up until a point where they need to intervene to prevent damage.

Learning from the TTPs of threat actors in this way makes it easier to identify, track and remove similar activity in future. Any intelligence gathered from monitoring the previously unknown threat’s behaviour can then be shared with threat intelligence communities, helping to advance the field and protect more networks from attack.

By analysing the meta-data from all mobile and internet communications, TDAC allows security teams to store and analyse huge amounts of data over long periods of time. This allows them to track the behaviour patterns of threat actors from the point at which they first infiltrated the network, even when the threat has been identified at a much later date.

Being able to identify malicious activity within a network prior to the threat actor having an effect minimises the damage done to a company, both financially and reputationally. 

Cyber attacks have been characterised into seven stages, known as the Cyber Kill Chain:

Reconnaissance – a target is identified and researched to identify vulnerabilities.

Weaponization – malware is created to exploit the target’s vulnerabilities.

Delivery – the weapon is transmitted to the target through methods like email attachments.

Exploitation – the malware starts the action to exploit the target’s vulnerabilities

Installation – malware installs an access point for the attacker. 

Command and Control – Malware gives the attacker to the network.

Actions on Objective – The attacker takes action to fulfill their objective, such as encryption for ransom. 

Telesoft threat hunting enables network operators to identify and break the Cyber Kill Chain from stages 3 to 6, before the malicious actor can reach stage 7. 

Stages 3 to 6 of the cyber kill chain are all points at which the threat actor has gained access to a network and is actively moving around and trying to understand the environment prior to conducting stage 7. Monitoring activity throughout these stages can enable a more effective removal of the threat actor prior to stage 7, mitigating any real damage being done.

HOW TELESOFT’S THREAT HUNTING SOLUTION PREVENTS CYBER ATTACKS

Our threat hunting solution has numerous benefits to companies who want to proactively prevent cyber attacks, including:

Storing large amounts of data is fundamental in retaining the required data to be able to proactively hunt for threats. Some networks are seeing over 10Tbps of data, resulting in large storage requirements. Many solutions cannot scale to this – but Telesoft offers petabyte storage through our data lake. 

When it comes to proactive threat hunting, looking at everything and capturing data from every flow is the only way to see the complete picture. Many competitors sample data, but this does not allow for comprehensive visibility required for the most effective threat hunting. Telesoft offers unsampled visibility, meaning full visibility of the entire network for thorough analysis. 

Many solutions that retain data do so but for short periods – such as a week or a month. But what if something happened three months ago? Our data lake can scale to retain data for months, and even in excess of a year in some cases, meaning you’ll have long-term visibility of data to enable thorough analysis of past anomalies to identify threats which have been dormant on the system for long periods.

Investigating and analysing the vast data is an additional challenge. TDAC’s flexible interface, based on regular expressions, enables the user to define specific behaviours they want to search for across definable timeframes. By iteratively adjusting rules and analysing returned data, users can hone in on potential threats within their historical network data. Once threat characteristics are identified, these can be added to TDAC’s automated detection algorithms for detection in real time.

These four points are key to enable threat hunting to take place for network operators; they can’t hunt for a potential threat if they haven’t seen it (due to sampling) or simply don’t have the records as the retention period is too short.

Ready to start threat hunting in your network? 

 with Telesoft today to discuss our threat hunting solution. 

Proactive Threat Hunting

Over the past year the security industry has seen a change in the threat landscape. Attacks are being targeted more towards smaller organisations with lower security budgets which offer an opportunity for threat actors to gain initial access. They then move laterally through the network and connected third parties to find an alternative means of entry into the network of their primary target. This is known as a supply chain attack and has resulted in several high-profile attacks in recent months, including the attacks against SolarWinds in 2020 and the more recent exploit of the vulnerability within Kaseyas’ Virtual System Administrator (VSA) solution.

Both attacks have been widely reported and have shown the reach and potential impact that threat actors can have by successfully exploiting the supply chain, with many organisations and some 

One way in which organisations can help to identify potential supply chain attacks is through 

, enabling a comprehensive understanding of the communications happening on a network. By understanding these communications, or the communications which appear to be normal network activity, security and network operations teams can more readily identify the anomalous, suspicious, or malicious activity. By identifying this activity earlier, organisations and network providers can put mitigations into action at the earliest opportunity, reducing the potential damage and disruption caused.

This visibility is key to protecting IP and mobile networks of today, embracing the challenges that come with the increasing data rates associated with a rise in IoT devices and the rollout of 5G, whilst simultaneously ensuring protection is considered for legacy signalling networks.

5G IS DRIVING FURTHER INVESTMENT IN CORE NETWORK SECURITY

 globally, mobile carriers will benefit from significant revenue opportunities driven by growth in the mobile market, from better customer service to new 5G-enabled business models. However, the industry also recognises that 5G will dramatically raise the stakes for those who are tasked with ensuring the security and reliability of these networks. A recent report by the Business Performance Innovation (

) Network highlighted that 5G is driving current security investment in core network security products and DDoS protection.

Carriers understand overwhelmingly the importance of upgrading and integrating scalable security solutions, as recent increases in traffic rates and connected devices has significantly expanded the scale of the attack landscape for cyber criminals. The foundation of an effective network security strategy at this scale is visibility, but the perspective from which defenders look at a network that is hauling petabytes of traffic is different to that of someone who has for example 1Gbps traffic to process. Adding another layer of complexity at carrier scale is that the network will typically be spilt over multiple global locations, be a combination of core and edge networks and contain both legacy and new equipment.

SCALING NETWORK VISIBILITY WITH NETOFLOW SECURITY MONITORING

Network visibility at this level requires a hardware solution that can be deployed at multi-100Gbps and that can scale as the network expands. Universally, flow analysis tools like NetFlow probes and sensors are the most commonly deployed network security monitoring solutions, initially developed for enterprise-level security they also sometimes find themselves in the infrastructure of 

, ISP and carrier networks. However, they are simply not fit for purpose and cannot handle the sheer amount of traffic at that scale and provide accurate network flow monitoring.

Talos/Cisco technical breakdown of a recent IoT botnet attack – VPNFilter

Deep packet inspection, which can lead to bottlenecks and massive processing power requirements

Active monitoring, which as the name implies introduces an unnecessary load on the network

Sampled data, which can result in threats being missed.

The biggest advantage to using flow analysis is that there is almost certainly NetFlow or IPFIX support on existing infrastructure in the carrier’s core network anyway — which makes configuration much easier.

Visibility attained via flow data which could include NetFlow, IPFIX monitoring, J-Flow, sFlow or NetStream is ideal for extracting key information that is critical to a Network Security Operations (NOC) and/or a Security Operations Centre (SOC) team’s daily functions and long-term security strategy. Network visibility allows defenders to answer questions like:

Who or what is monopolising bandwidth and slowing down the network?

How can we spot botnets, APTs, zero-day malware, SS7 attacks, and other threats if they bypass perimeter defences?

How can we identify and track which IP’s and countries the network is exchanging data with?

How can I detect tunnelled traffic and gain visibility into encapsulated traffic that may be carrying threats?

How can I identify malicious activity within encrypted traffic such as TLS 1.3?

The ability to troubleshoot in real-time to ensure availability and improve user experience.

This type of granularity and behavioural analysis provides the ability to hunt for threats, which at scale can be difficult not least because of the sheer amount of data to search but also the categorisation and identification of the types of threats that are a risk to your network security. Typically, a carrier network defender will not be interested in ‘Credential Stuffing’ for instance because that threat is quite specific to website security, so that attack vector is likely more important to a SecOps team within a Content Delivery Network (CDN).

For a Carrier, DDoS and large scale IoT botnets like the recent Prometei and Flubot would constitute a significant threat. Specific alarms or events provided by flow monitoring and meta-data security enrichment enables threat hunters to visualise, analyse, and investigate contextual data relating to every transaction and network conversation, which means that these types of attacks can be caught before they cause irrevocable damage.

Threat Hunting and Network Monitoring with NetFlow at Scale

Threat hunting is the term used for proactively searching for cyber threats that could be present undetected within a network. The benefits of threat hunting as part of a holistic cyber-crime prevention strategy means that companies have an additional and proactive line of defence against malicious actors that may have breached endpoint security defenses, and are more likely to identify and prevent threat actors within their network before they strike. 

People often confuse proactive threat hunting with threat intelligence or threat monitoring, which are different yet important aspects of cyber-crime prevention. 

 is information an organisation uses to understand the threats being targeted at it. Threat hunting is often supported by threat intelligence, and the results and findings from threat hunting can be shared as additional threat intelligence. Threat monitoring is a passive technique utilising tools to observe your landscape, identifying suspicious activity as it happens.

There are several methodologies that threat hunters use in order to search for potential threats within a network: 

Threat hunters will analyse threat intelligence in search of potential suspicious activity – known as Indicators Of Compromise (IOC). If they find abnormal activity which could be evidence of malicious activity, this is used as a basis for investigation.

 Hypothesis-based threat monitoring often takes place when a new threat is identified in crowdsourced attack data, or in the case of well-documented attacks, in the news. Information shared will include attackers’ tactics, techniques and procedures (TTP) which threat hunters can search for in their own networks. 

Analytics and machine-learning threat hunting

This form of network anomaly detection is automated rather than being human-led. Advanced computer software processes data to detect irregularities, and these anomalies are then investigated by analysts to determine whether they pose a threat.

Indicators of Compromise (IOC) is the forensic name given to the anomalous pieces of data found in a system during threat hunting which may be evidence of malicious activity in the network. Cyber security experts should check IOC data regularly in order to detect suspicious activity within the network. Examples of IOCs include:

Geographical anomalies – attempted access from a blacklisted region or a region outside of where your company is located. 

IP address – supported by Threat Intelligence, suspected malicious IP addresses can be identified

TOR/anonymiser – identification of an IP address associated with known TOR nodes/anonymisers

Unusual outbound traffic – a change in what qualifies as ‘normal’ traffic for your organisation

Increase in traffic volume – spikes in traffic are often associated with DDoS/DoS attacks

Increase in DNS activity – this is often utilised for C2 communications when initiating connections.

The threat hunting process generally follows three steps:

Indicator – Advanced detection tools identify unusual behaviours such as the Indicators Of Compromise listed above. This trigger points threat hunters to an area where there may be malicious activity for further investigation. 

Investigation – Threat hunters use technology such as Endpoint Detection and Response (EDR) or 

 to analyse whether the system may be compromised. At this point the activity will either be deemed benign or considered malicious.  

Response – The final step is the resolution phase. It is vital to communicate the malicious activity to security teams so they can respond and mitigate threats. Data gathered from step 1 and 2 can then be utilised to improve threat hunting analytics and machine-learning technology further and prevent similar threats in future. 

SolarWinds is a major US information technology firm. In December 2020, it was reported that the firm had been hit by a cyber attack that went undetected for months and had spread to its clients. SolarWinds have since dubbed the attack the “SUNBURST vulnerability”.

Hackers were able to gain access to SolarWinds’ system and add malicious code. This code was then unwittingly sent out to up to 33,000 of SolarWinds’ clients as part of a software update. Up to 18,000 of SolarWinds’ customers installed the updates – including Microsoft, Cisco, Intel, Deloitte and even parts of the Pentagon – leaving them vulnerable to attack. It is believed that attackers from Russia were able to hack into and spy on high-profile private companies and senior US Government departments including the Treasury Department and the Department of Homeland Security. 

The SolarWinds attack had a huge impact in the cybersecurity industry and within large organisations and resulted in a massive upsurge in interest in threat hunting as a means to prevent large-scale and far-reaching attacks like this from happening again. 

BENEFITS OF THREAT HUNTING FOR TELECOMS COMPANIES

Threat hunting has many benefits as a means of threat protection for large organisations like telecoms companies. The benefits of threat hunting include: 

Proactive threat hunting can prevent damage being done if a threat actor has gained access but not yet stolen or compromised data. Often threat actors will lie dormant in a network for months before striking – threat hunting means you’re more likely to find and respond to these malicious actors before it’s too late. 

Threat hunting is the term used for proactively searching for cyber threats that could be present undetected within a network. The benefits of threat hunting as part of a holistic cyber-crime prevention strategy means that companies have an additional and proactive line of defence against malicious actors that may have breached endpoint security defenses, and are more likely to identify and prevent threat actors within their network before they strike. 

RESOURCES

Managed Detection and Response

Managed Detection and Response

Cloud-Based Cyber Security: Understanding the Shared Responsibility Model

Managed Detection and Response

How to Detect Emerging Threats on your Network?

Managed Detection and Response

The value of analysing metadata for threat hunting

Managed Detection and Response

There is no 'one size fits all' when it comes to protecting your network

Managed Detection and Response

The Benefits of a Managed Threat Hunting Service

Managed Detection and Response

What is Multi-layered Threat Detection and Mitigation?

Managed Detection and Response

Proactive Threat Hunting

Managed Detection and Response

Threat Hunting and Network Monitoring with NetFlow at Scale

Managed Detection and Response

What is threat hunting and how does it benefit telecoms companies?

Managed Detection and Response

SSL certificate extraction

Managed Detection and Response

Utilising Contextual Threat Record in an Intrusion Detection System (IDS)

Managed Detection and Response

Sustainable Smart Cities in the Sand

Resources Hub