Detecting threats in network communications

Significant volumes of data are generated every second of every day as we go about our daily lives. This data is generated by a number of devices which we either directly or indirectly use, from smartphones and smartwatches, laptops and computers, to smart enabled machinery and autonomous vehicles. Whatever the device is, it generates significant amounts of data which is shared across a network during normal communications. And if these devices have been compromised in some way, these communications can be vital in identifying the anomalous activity and potentially preventing a data breach.

With an ever-growing focus on the importance of cybersecurity, many of these devices will have some kind of endpoint security solution installed on them, such as firewalls or anti-virus software, but these are primarily designed to focus on what is happening on the device itself. But what about the communications between these devices?

The data shared in these communications can be key in helping to identify anomalous or unknown malicious activity that is evading endpoint security solutions before a malicious actor is able to cause an effect. But storing this voluminous data mass can be expensive, whilst sifting through the data can be challenging.

The solution? Extracting communications metadata can be a crucial capability when it comes to enhancing your existing security posture, offering a number of benefits to an organisation.

Metadata can be described as the ‘data about data’ and is often considered in the concept of photography. For example, an image taken on a digital camera can capture the related metadata, which could include information such as the date and time when the photo was taken, camera model, resolution, settings used, and the location of the photo. This is valuable information to the right person, but often rarely seen.

The same can be said for metadata within network communications. We don’t always need to know the content of what was said, but knowing who was talking to who, how they were communicating and when can be valuable information. Specifically, the metadata within network communications relates to information such as the IP addresses from which the communication was sent from and received, which protocols were used, the ports the data was sent and received by and even the applications used to send the information. This information is highly valuable to threat hunting and incident forensics teams, enabling analysts to piece details together to understand a much more comprehensive picture. Metadata makes searching and storing information simple, and because every file includes metadata from the time it was created, it can be modified or destroyed with the right tools.

This metadata can be very valuable when it comes to identifying anomalous or malicious activity within a network. Even sophisticated threat actors, capable of successfully evading endpoint security solutions will find it very challenging to hide their external communications to command and control or staging servers. This activity will always leave a trail, and threat hunting teams can use this to understand and map their activity.

What are some of the latest threats to be identified? What impact have they caused? How have they been identified? If at all?

New network threats are being discovered and exploited all the time, whether it be attributed to massive corporations’ software, or a small vulnerable program written by one person that’s used to run malicious code.

Possibly the largest threat that was identified recently has been the Log4Shell vulnerability.

Log4J is a very common logging system written in java and distributed by the Apache Software Foundation as open-source software. Back in 2013, a patch was created to add the use of the Java Naming and Directory Interface (JNDI). This allows potential threat actors to run a very specific string using JNDI to talk to their Lightweight Directory Access Protocol (LDAP) server and retrieve a malicious file from it. The file is then put onto the victim system and run. This vulnerability was not discovered until late 2021 and was given a severity score of 10/10 by the National Vulnerability Database.

Since its discovery, threat actors from all over the world, whether they are state-sponsored, hacktivists or script kiddies, have been utilising the vulnerability to pass malicious code to a specific system to steal data or cause serious damage to a company. The impact of this vulnerability is enormous as it’s determined that around 3 billion devices could be using Log4J and any unpatched systems are under threat of DDOS, Ransomware, Crypto-mining and Data theft attacks, to name a few.

A recent (white hat) vulnerability has also included a virus that affects Apple phones. This virus, named ‘NoReboot,’ was discovered in early January. It is stored in the RAM so should be wiped when the device is switched off. However, it stops the phone from being switched off and clears the virus from the memory. When the user attempts to switch the device off, the malicious code activates and mimics the process that turns the phone off, e.g. making the appropriate vibrations and making the screen black. The phone is still on at this point and the virus can continue to operate. It also mimics the phone turning back on, showing the logo, and waiting a certain time, to not draw attention from the user to something out of the ordinary. This vulnerability is impossible to identify physically as it perfectly mimics the shutdown and boot up procedure. This virus was developed and tested by ZecOps but could pose a threat if used by external actors to spy on users as the camera and microphone will remain active.

This is of particular concern following the rapid and widespread adoption of remote working over the past few years, likely resulting in many employees using their devices more for business purposes or being provided work phones. This has increased the threat landscape significantly, offering many more potential targets for threat actors to exploit.

Why is it important to identify these threats? 

2021 saw a record number of identified vulnerabilities with 20141 CVEs generated. Nearly 2000 more than the previous record year of 2020. So far in 2022, 2136 vulnerabilities (as of the start of February) have been identified. Whilst the number of CVEs being identified will no doubt continue to increase, the impact of these vulnerabilities can vary from essentially not being a threat at all, to crippling companies and halting food/fuel supplies. This has been highlighted in recent events such as the ransomware attack against KP snacks, a large snack distributor in the UK which is highly likely to result in a shortage of supply for 6 – 8 weeks. Last year we saw another ransomware attack against JBS Meat Supplier in the US, resulting in a negative impact against America’s meat supply chain.

Whilst the victims of such attacks will inevitably brace the main impact of such an attack, resulting in financial damage, loss of revenue, damage to reputation and stocks, the impact of such attacks are also felt much wider than the company itself. In regard to both of the attacks above, food and snack supplies to the hospitality and retail industry were affected, causing a knock-on impact to the retailers and bars or restaurants who fell short on supply, as well as individuals.

How can the Telesoft Product Suite help detect threats by monitoring network communications?

Telesoft’s TDAC Platform is comprised of a number of intelligent hardware and software components. Sensors capture every communication in your network, providing full visibility whilst a data lake ingests and records all of this data.

Every flow record captured is enriched with threat intelligence. IP and domain reputation lists enable alerting of known threats. Geographic location and ASN mappings allow unexpected endpoints to be quickly identified and flagged. Signature-based intrusion detection alerts on suspicious activity, whilst buffering allows for packet data to be captured and recorded, even before the potential threat occurs.

To provide further analysis capability, the sensors support automated detection of tunnelled traffic, including GRE, GTP, MPLS and IP-in-IP, enabling visibility of the encapsulated flows. In addition, encrypted flow fingerprinting methodologies are utilised to identify threats within encrypted traffic without decrypting it, reducing latency and maintaining the privacy and integrity of the communication.

TDAC also utilises machine learning, behavioural analytics and historical baselining to monitor and identify anomalous flows, alerting the user with full flow analysis in real time. Combined with high-rate flow monitoring and intrusion detection capabilities, the TDAC Platform provides the full suite of tools to support Incident Response, Digital Forensics and 

Metadata within network communications relates to information such as the IP addresses from which the communication was sent from and received, which protocols were used, the ports the data was sent and received by and even the applications used to send the information.

The value of analysing metadata for threat hunting

30th March 2022 - Google type confusion CVE-2022-1096

A new zero-day exploit has been discovered which affects Google’s Chrome browser and other browsers which run on the chromium engine. This exploit is defined as a type-confusion vulnerability in the V8 JavaScript engine and has been listed as high-severity. This vulnerability has been classified as high-severity because it can potentially allow attackers to write outside of memory which can lead to a range of different attacks. Google has issued a patch for their Chrome browser and will be rolling out updates for other browsers within the week.

Fortunately, Google is incredibly security focused and has already applied a patch for this vulnerability which highlights the importance of patch management. This vulnerability (CVE-2022-1096) could easily be missed by network managers making their networks vulnerable to threat actors. Implementing a patch management system is necessary for numerous reasons such as increased security, no unnecessary fines and system uptime. Patch management requires more work by the security teams however a good patch management system is extremely effective at keeping networks secure. A defined patch management process would involve researching vulnerabilities, understanding and applying patches, prioritizing patches based on severity and testing patch compatibility.

On Monday 21st of March, LAPSUS$ posted screenshots of admin accounts and source code of 250 projects, supposedly owned by tech giant Microsoft, on their Telegram channel. Microsoft haven’t confirmed this to be true but are investigating. The 37GB of leaked data is said to include 90% of Bing’s source code and 45% of Bing Maps / Cortana’s source code. Independent security researchers have reported the leaks appear to contain authentic Microsoft code.

On the same day, LAPSUS$ also came out and said they had breached the network of a major authentication company called Okta. Okta has over 15,000 customers including Renault and Fedex, and on Tuesday 22nd March, they acknowledged that a 3rd party customer support engineer with access to their systems had been compromised between the 16th and 21st of January.

LAPSUS$ made it clear that they didn’t steal any of Okta’s data, but they were targeting their customers. It’s not known yet if any of them have been compromised but Okta are playing down the situation as being only an ‘attempt’ and having been ‘contained’ back in January.

LAPSSUS$ released 8 screenshots. One of these appeared to be logged into a Cloudflare account for the support engineer as a ‘Superuser’, prompting the Chief Executive of Cloudflare, Matthew Prince, to reset all their employees’ passwords out of caution. Okta uses Cloudflare as a content delivery network. Matthew has since come out saying there is no evidence that Cloudflare themselves had been affected.

In their 3rd major cyberattack in under a month, the cyber extortionist gang, LAPSUS$ has allegedly targeted Ubisoft. Ubisoft are a giant in the video game industry and is responsible for the Assassins Creed and Far Cry series, to name a few. They announced the incident on their website, on Thursday, 10th of March.

LAPSUS$ haven’t outright claimed this attack was carried out by them, but it was implied through them posting a link to Ubisoft’s announcement along with a smirk emoji, on their Telegram channel.

Ubisoft claimed the attack took place the week before the announcement; no ‘player personal information was accessed or exposed’; and that there was only some ‘temporary disruption’ to their services. They have confirmed in the same post that all their games and services are now functioning normally.

Ubisoft’s ‘IT teams are working with leading external experts to investigate the issue’ and as a precautionary procedure, they have ‘initiated a company-wide password reset’.

On the same day as Ubisoft announced the cyber-attack, LAPSUS$ announced on their Telegram channel that they are looking for existing employees of big tech companies/corporations to supply them with backdoor access into the network. They have offered payment in return.

After the cyber attack on Nvidia on the 23rd of February, it was rumoured that Samsung was / would soon be hit by the cyber extortionist gang, LAPSUS$. On Monday the 7th of March, Samsung confirmed a data breach that took place 3 days prior. This was claimed by LAPSUS$, and resulted in 190GB of data being stolen and leaked.

The data is said to include the source code for every trusted applet, all the algorithms for biometric locks on the Galaxy range of hardware which contains all the sensor source code, down to the bitstream detection, and the DRM information on the TrustZone Environment. The TrustZone Environment is a heavily secured data store in Samsung products where information and data regarding the biometric locking system, for example, is kept.

Also taken during the breach was the bootloader code for all of Samsung’s devices, including Knox, their built in secure environment software; source code relating to Qualcomm, the US-based technology firm; source code for Samsungs first time setup activation servers and full source code for Samsung accounts, including authentication, identity, API, services and more.

According to Samsung, no employee data was stolen.

Unlike the Nvidia attack where LAPSUS$ demanded the Lite Hash Rate software was removed from the tech giant’s graphics cards, it doesn’t seem like the gang has made any demands to Samsung.

On Tuesday the 1st of March, Nvidia confirmed that their network had been breached during a cyber-attack on the 23rd of February. The attackers took down several development and email systems for around 2 days. They were able to steal around 1TB of data and gain access to sensitive information such as their 71,335 employees' email addresses and passwords, along with data relating to their DLSS (Deep Learning Super Sampling) technology. This attack was carried out by an extortionist gang known as LAPSUS$, who demanded a fee to stop them from leaking the data they took, making this a ransomware attack.

Their demands were that Nvidia completely remove the ‘Lite Hash Rate’ technology that their graphics cards have, which reduces the hash rate of Ethereum mining by 50%, and that Nvidia pay them $1 million to keep the bypass code for that software, a secret.

During the data breach, LAPSUS$ also reportedly stole source code and schematics for Nvidia’s drivers and firmware, which prompted fears that the software updates could become compromised.

Nvidia’s code-signing certificates had also been leaked by the group. This means that malware can be created, and then signed using the leaked certificate, making it seem like a legitimate driver that had been issued by Nvidia. These certificates have long since expired; however, in some circumstances, Windows still recognises them as being legitimate.

Nvidia have since said that they don’t expect any of the issues to disrupt the business or their customers.


Stay up to date with the latest cyber threats and attacks with our weekly threat report. 

Weekly Cyber Threat Reports

Data rates are increasing day by day. Threat actors are constantly evolving their Tactics, Techniques and Procedures (TTPs). A perfect storm is brewing for security analysts and outsourcing security elements, like threat hunting, can benefit more than just security.

It is becoming increasingly challenging to comprehensively monitor networks; the traffic generated on a daily basis is at an all-time high and threat actors are using ever more sophisticated defence evasion techniques. This helps them to not only maintain persistence in the network for a prolonged period of time, but also ensures they have sufficient time to understand their target infrastructure to exact the maximum effect. And the same is true for all networks, from small or medium enterprises, up to CSP/ISP and network operators – if we are connected to the internet, then we are a potential target, it is all a matter of time. But how can we identify these evolving TTPs if they continue to evade endpoint security solutions? More importantly, how can we identify them within our network before they carry out their malicious actions?

Security needs to be considered from a more holistic approach. There is no ‘one size fits all’ or ‘silver bullet’ in cyber security and, consequently, a multitude of platforms and capabilities are required to provide a more complex and comprehensive security posture, creating a more challenging environment for threat actors to navigate.

Most organisations utilise a number of security solutions such as endpoint security, antivirus, firewalls and so on. Unfortunately, as we continue to witness in the news despite these security solutions, threat actors are still conducting successful operations. So, are these solutions ineffective? Of course not, but it has to be acknowledged that cyber criminals continue to evolve their understanding of our environments and defensive capabilities in order to bypass them and compromise a network more effectively. To bolster their cyber security, organisations should consider augmenting their existing infrastructure with tools that provide enhanced visibility that existing solutions may not provide.

Network security solutions are vital in enhancing an organisations’ security posture. Being able to see what is happening within a network is crucial to detecting threats, but being able to identify anomalous communications or beaconing outside of a network is vital to see what the endpoint solutions often miss.

Visibility into an organisations’ network traffic enables detailed analysis to be conducted by security analysts, enabling identification of changes in traffic patterns of behaviours that could indicate malicious activity, such as communications with Command and Control (C2) servers. This can often initiate the start of an investigation into a device of interest, enabling the identification of a compromised device before malware has been able to have an effect.

This proactive identification of anomalous communications activity can help an organisation to not only identify previously unknown malicious activity within their network, but it can also help to plan a response and mitigate the attack efficiently before it can have a negative impact, reducing costs associated with remediation, reputational damage and so on.

Additional tools, however, also require additional training, recruitment or upskilling existing analysts to make the most benefit from it. Consequently, this leads to additional costs, making it another barrier to entry for many small to medium enterprise organisations.

Outsourcing these requirements to service providers who can provide a comprehensive network security monitoring and threat hunting solution can be an attractive and cost-effective solution for enterprise organisations. Not only does it enable an organisation to strengthen their monitoring capabilities across all the growing data volumes, but it also enables them to proactively identify malicious activity before threat actors can exploit the network.

There is no 'one size fits all' when it comes to protecting your network

56% of organisations admit that it is highly unlikely they would be able to detect a sophisticated cyber attack. In the past year, 78% of organisations were victims of cyber-attacks which were able to access crucial data and put the companies and their customers at risk. 

This is why Telesoft has developed the Threat Hunting Service, to ensure any security incidents are minimised and identify suspicious activity as it attempts to evade detection from automated security systems.

What is a managed threat hunting service? 

A managed threat hunting service defends your organisation against potential cyber-attacks by proactively responding to security threats. 

Threats can bypass the perimeter, but we should also focus on sophisticated evasion techniques to prevent detection. This requires trained security analysts to hunt for threats to support the existing defences, creating ‘defence in depth’ or an enhanced security posture.

How does a managed threat hunting service work? 

A managed threat hunting service consists of qualified and highly trained security analysts who enhance the security posture while the enterprise can continue with business as usual. The analysts use advanced intelligence platforms to monitor every aspect of the company’s infrastructure. The enterprises are provided with actionable intelligence – the analysts will ensure every threat is validated before reaching out to the business about the severity of the impact.

Security analysts also conduct weekly and monthly reports to keep the company updated on various security issues and set up an action plan in motion to minimise the risks. The team works 24/7 and proactively responds to all incidents to make sure the company isn’t overloaded with security alerts. 

What is the average cost to set up a 24/7 security team? 

According to the 2021 Hiscox Cyber Readiness Report, the average UK business devoted 21% of its overall IT budget to cyber security, showing a 63% jump from the budgets allocated in 2020. 

Companies often set up an in-house cyber security team – the average UK salary of a Security Operations Center (SOC) analyst is £49,955 per year. Depending on the size of the company and the severity of the attacks, a business may need to hire multiple SOC analysts who are a part of a large security operations team. If an enterprise wishes to set up a 24/7 security team, they would need to hire at least six SOC analysts. 

The Infosecurity Magazine reported that C-level security executives receive 10,000 cyber threat alerts each month. There are 52,000 false-positive threats reported each year. It takes a SOC analyst 10 minutes to assess a single threat, which means they require 866 hours, or around 5 working months to assess all false-positive threats received. 

Based on this data, a company could spend £400,000 or more on hiring their SOC analyst team. 

The benefits of a managed threat hunting service

By using an outsourced managed threat hunting service, companies can reduce hiring costs while improving the quality of monitoring and overall security control. Companies can install 24/7 cloud-managed security without having to maintain their own security operations centre and spend money on hiring and training. Instead, an already-experienced security analyst takes care of your organisation’s cybersecurity needs. 

A strong monitoring and threat hunting platform will be able to help protect your business from data breaches, DNS hijacking, crypto-jacking, ransomware, and many more cybersecurity threats. 

A managed threat detection service also ensures clear communication and provides a steady stream of information to make sure no threat remains undetected. 

By using a managed threat detection service you can: 

* Proactively identify new threats with advanced analytics

* Improve threat intelligence and conduct future insights 

* Receive expert advice and intuitive reports 

The importance of having virtual & cloud security 

Virtual security solutions such as the Telesoft TDAC Enterprise provide actionable cyber intelligence, network visibility, and digital forensics. They can enhance threat detection, deep investigations, mitigation capabilities, event orchestration, and much more. They also protect global assets through the creation of an intelligence mesh connecting the whole network for full visibility.

By using virtual & cloud security, enterprises benefit from readily deployable and highly scalable software which provides accurate and enriched threat hunting across the entire infrastructure. By connecting the core network to IoT (Internet of Things) devices and the edge, the TDAC Enterprise enables real-time network visibility across the estate, including its physical, virtual, and hybrid networks. 

To see how Telesoft can help protect your company with a managed threat detection service, read more about our Threat Hunting Service and book a demo with our team today.

By using an outsourced managed threat hunting service, companies can reduce hiring costs while improving the quality of monitoring and overall security control. Companies can install 24/7 cloud-managed security without having to maintain their own security operations centre and spend money on hiring and training.

The Benefits of a Managed Threat Hunting Service

The view of the cyber threat landscape is very 
different depending on your perspective, this perspective is defined by 
what type of network you are protecting. Targeted cyber-attacks use an 
increasing catalogue of clever tactics and innovative attack vectors 
that are reshaping corporate and governmental security strategies, while
 wreaking havoc in consumer markets. Remaining secure in 2019 depends on
 many factors but ultimately defenders who will see the most success 
will be those who are able to identify and mitigate threats at a more 
granular level. The constant and ever increasing number of cyber-attacks
 facing organisations requires cyber security analysts and forensic 
specialists to detect, analyse and block cyber threats in almost 
real-time.

In order to adequately protect networks, defenders need access to 
tools and techniques that provide advanced multi-layered threat 
detection and agile automated mitigation in real-time to remediate cyber
 security incidents. And speed up the collection and analysis of cyber 
security incident related information for accurate forensic 
investigations. This, however, is easy to map out at a corporate level 
but at a practical level is much harder to implement.


 and mitigation? The fundamental starting point should always be network
 visibility. The ability to see and understand network traffic is 
crucial to a defenders ability to block an attack, the most efficient 
and effective way is to use unsampled network flow data such as NetFlow,
 IPFIX or sFlow collected from probes, switches/routers and network 
infrastructure. This good practice rule is applicable whether your 
network size is 1GbE or 400GbE, network visibility is all about creating
 a stable platform for your security infrastructure such as intrusion 
detection systems, analysis tools and SIEM’s to work from.

Another important weapon in a defenders toolkit is Cyber Threat 
Intelligence, this accumulated data gives valuable context and relevance
 to large amounts of data, enabling agile and improved detection of 
advanced threats. The UK’s National Cyber Security Centre (NCSC) 
categorises four types of threat intelligence; tactical, technical, 
operational and strategic. Together these four segments provide a clear 
view of the threat landscape from attacker methodologies, tools, and 
tactics to indicators of specific malware, details of a specific 
incoming attack and high-level information on changing risks.

Threat intelligence platforms built on ‘Cyber Threat Intelligence’ 
have become a critical security tool, using global security intelligence
 to detect malicious activity e.g. identifying known and zero-day 
threats such as protocol and application misuse, data exfiltration, DDoS
 attacks, malware and crimeware, botnet activity and network 
misuse/contamination inside a network. Defenders should look out for 
tools that consolidate threat intelligence from multiple sources, 
automate identification and containment of new attacks, security 
analytics, and integration with other security tools.

A smart cyber security strategy combines network visibility with 
threat intelligence but also the ability to block potential security 
incidents and risks as they happen, ideally this function should be 
automated to reduce resource requirements and maximise investigation 
work flow for post attack analysis. The question is how do you go from 
alert to triage to fix? The process of triaging or sorting the alerts in
 to relevancy is often made difficult by the vast amounts of alerts that
 a network can generate, add in to this mix, false positives and alerts 
that aren’t grouped together, making it difficult to get any real value 
from alerts and potentially missing important incidents.

One way around this is to use tools such as the 

 from
 Telesoft that can categorise and group network infrastructure by area 
according to IP address, service, application, physical or logical 
attribute, creating silos or entity sets of network information and 
alerts. Defenders can use entity sets to prioritise and automate 
response to incidents and gain contextual insight about an alert, 
accelerating the reaction time of a threat intelligence platforms. This 
enables rapid correlation of key indicators of compromise (IOCs) such as
 vulnerability scoring, attack density and destination IP etc.

Executing smart alert triaging using entity sets allows defenders to 
identify a priority alert and keep key infrastructure functioning in the
 face of an attack. In most organisations a cyber emergency response 
team (CERT) will be responsible for this action, automating some of this
 activity will allow them to focus resources in other areas. One way to 
do this is to deploy next generation security tools that utilise Border 
Gateway Protocol (BGP) Flowspec, BGP-FS is the protocol all internet 
routers use to talk to each other. BGP Flowspec uses the BGP protocol to
 distribute flow specification filters to network routers, so when a 
threat is identified, the entity set or infrastructure inputs a rule to 
block or deny traffic related to the threat by its source, destination 
and a number of other characteristics. The malicious traffic is 
systematically and temporarily filtered off the network, blocking 
threats globally before they have time to form fully or scale and affect
 users.

When total network visibility, global threat intelligence, smart 
alert triaging and the ability to block cyber-attacks are combined they 
create a proactive agile multi-layered security strategy that keeps 
day-to-day operations running smoothly and important data safe. Telesoft
 offers a number of 

 for flow monitoring and cyber threat visibility, talk to us to about detecting and blocking threats in your network

Want to know more? Email us to find out more

The view of the cyber threat landscape is very different depending on your perspective, this perspective is defined by what type of network you are protecting. Targeted cyber-attacks use an increasing catalogue of clever tactics and innovative attack vectors that are reshaping corporate and governmental security strategies, while wreaking havoc in consumer markets. Remaining secure in 2019 depends on many factors but ultimately defenders who will see the most success will be those who are able to identify and mitigate threats at a more granular level. The constant and ever increasing number of cyber-attacks facing organisations requires cyber security analysts and forensic specialists to detect, analyse and block cyber threats in almost real-time.

What is Multi-layered Threat Detection and Mitigation?

Telesoft’s TDAC provides security and network operations teams with a threat hunting tool that enables them to query and investigate data, to identify and neutralise threat actors within their network before they strike.

 provides highly accurate, unsampled network metadata, which is stored in Telesoft’s petabyte data lake. With access to this extensive data lake of metadata, raw network traffic and real-time Indicators of Compromise, TDAC enables network operators to carry out proactive threat hunting and identify malicious actors within their network.

Data is analysed, enriched, correlated and presented in real-time, reducing time and resources to act on events and observations. Read further to understand the benefits of Telesoft’s threat hunting solution.

When it comes to cyber security, companies use a variety of methods to protect their systems from malicious attacks. From firewalls and antivirus software to endpoint security, these are all reactive cyber security methods.

However, many companies are beginning to understand the benefits of proactive threat hunting. Below we’ve laid out the three main benefits of proactive cyber security as an element of your cyber security strategy.

1. IDENTIFY THREATS IN YOUR NETWORK BEFORE THEY ACT

Reactive cyber security methods work by detecting what are referred to in the industry as “known knowns” – something that has already been identified as a threat, such as a bad IP address or domain. With reactive cyber security, the malicious actor must threaten your network in some way in order to be identified. 

But the average threat actor has a dwell time of 180 days. That means an attacker could be hiding dormant in your network for months before taking any malicious action. In this time they could be learning about your network in depth and understanding any weaknesses before mounting an attack. 

Proactive threat hunting techniques have developed as a way to detect and identify what the industry calls “unknowns” – malicious actors that haven’t yet launched malicious activity, and therefore have yet to be uncovered by reactive methods. While attackers dwell in your network, security teams have an opportunity to proactively identify the threat and learn more about it using Telesoft TDAC.

Network anomaly detection with Telesoft TDAC allows operators and security teams to identify malicious actors lurking within networks before they have the opportunity to carry out their objectives, whether that’s delivering malware or ransomware or exfiltrating data. Once identified, the threat can either be removed immediately, or security teams can choose to monitor it in order to gain a better understanding of its behaviour. 

2. GAIN BETTER UNDERSTANDING OF CYBERCRIMINAL TACTICS, TECHNIQUES AND PROCEDURES (TTPS)

Once an “unknown” is identified through threat hunting, most companies’ immediate response would be to remove it from the network. However, there is a benefit to monitoring and observing its behaviour before responding. This helps network operators gain a unique perspective on malicious actors’ Tactics, Techniques and procedures (TTPs), and in doing so, the unknown becomes a “known known.” Understandably, this type of monitoring can only be done up until a point where they need to intervene to prevent damage.

Learning from the TTPs of threat actors in this way makes it easier to identify, track and remove similar activity in future. Any intelligence gathered from monitoring the previously unknown threat’s behaviour can then be shared with threat intelligence communities, helping to advance the field and protect more networks from attack.

By analysing the meta-data from all mobile and internet communications, TDAC allows security teams to store and analyse huge amounts of data over long periods of time. This allows them to track the behaviour patterns of threat actors from the point at which they first infiltrated the network, even when the threat has been identified at a much later date.

Being able to identify malicious activity within a network prior to the threat actor having an effect minimises the damage done to a company, both financially and reputationally. 

Cyber attacks have been characterised into seven stages, known as the Cyber Kill Chain:

Reconnaissance – a target is identified and researched to identify vulnerabilities.

Weaponization – malware is created to exploit the target’s vulnerabilities.

Delivery – the weapon is transmitted to the target through methods like email attachments.

Exploitation – the malware starts the action to exploit the target’s vulnerabilities

Installation – malware installs an access point for the attacker. 

Command and Control – Malware gives the attacker to the network.

Actions on Objective – The attacker takes action to fulfill their objective, such as encryption for ransom. 

Telesoft threat hunting enables network operators to identify and break the Cyber Kill Chain from stages 3 to 6, before the malicious actor can reach stage 7. 

Stages 3 to 6 of the cyber kill chain are all points at which the threat actor has gained access to a network and is actively moving around and trying to understand the environment prior to conducting stage 7. Monitoring activity throughout these stages can enable a more effective removal of the threat actor prior to stage 7, mitigating any real damage being done.

HOW TELESOFT’S THREAT HUNTING SOLUTION PREVENTS CYBER ATTACKS

Our threat hunting solution has numerous benefits to companies who want to proactively prevent cyber attacks, including:

Storing large amounts of data is fundamental in retaining the required data to be able to proactively hunt for threats. Some networks are seeing over 10Tbps of data, resulting in large storage requirements. Many solutions cannot scale to this – but Telesoft offers petabyte storage through our data lake. 

When it comes to proactive threat hunting, looking at everything and capturing data from every flow is the only way to see the complete picture. Many competitors sample data, but this does not allow for comprehensive visibility required for the most effective threat hunting. Telesoft offers unsampled visibility, meaning full visibility of the entire network for thorough analysis. 

Many solutions that retain data do so but for short periods – such as a week or a month. But what if something happened three months ago? Our data lake can scale to retain data for months, and even in excess of a year in some cases, meaning you’ll have long-term visibility of data to enable thorough analysis of past anomalies to identify threats which have been dormant on the system for long periods.

Investigating and analysing the vast data is an additional challenge. TDAC’s flexible interface, based on regular expressions, enables the user to define specific behaviours they want to search for across definable timeframes. By iteratively adjusting rules and analysing returned data, users can hone in on potential threats within their historical network data. Once threat characteristics are identified, these can be added to TDAC’s automated detection algorithms for detection in real time.

These four points are key to enable threat hunting to take place for network operators; they can’t hunt for a potential threat if they haven’t seen it (due to sampling) or simply don’t have the records as the retention period is too short.

Ready to start threat hunting in your network? 

 with Telesoft today to discuss our threat hunting solution. 

Proactive Threat Hunting

Over the past year the security industry has seen a change in the threat landscape. Attacks are being targeted more towards smaller organisations with lower security budgets which offer an opportunity for threat actors to gain initial access. They then move laterally through the network and connected third parties to find an alternative means of entry into the network of their primary target. This is known as a supply chain attack and has resulted in several high-profile attacks in recent months, including the attacks against SolarWinds in 2020 and the more recent exploit of the vulnerability within Kaseyas’ Virtual System Administrator (VSA) solution.

Both attacks have been widely reported and have shown the reach and potential impact that threat actors can have by successfully exploiting the supply chain, with many organisations and some 

One way in which organisations can help to identify potential supply chain attacks is through 

, enabling a comprehensive understanding of the communications happening on a network. By understanding these communications, or the communications which appear to be normal network activity, security and network operations teams can more readily identify the anomalous, suspicious, or malicious activity. By identifying this activity earlier, organisations and network providers can put mitigations into action at the earliest opportunity, reducing the potential damage and disruption caused.

This visibility is key to protecting IP and mobile networks of today, embracing the challenges that come with the increasing data rates associated with a rise in IoT devices and the rollout of 5G, whilst simultaneously ensuring protection is considered for legacy signalling networks.

5G IS DRIVING FURTHER INVESTMENT IN CORE NETWORK SECURITY

 globally, mobile carriers will benefit from significant revenue opportunities driven by growth in the mobile market, from better customer service to new 5G-enabled business models. However, the industry also recognises that 5G will dramatically raise the stakes for those who are tasked with ensuring the security and reliability of these networks. A recent report by the Business Performance Innovation (

) Network highlighted that 5G is driving current security investment in core network security products and DDoS protection.

Carriers understand overwhelmingly the importance of upgrading and integrating scalable security solutions, as recent increases in traffic rates and connected devices has significantly expanded the scale of the attack landscape for cyber criminals. The foundation of an effective network security strategy at this scale is visibility, but the perspective from which defenders look at a network that is hauling petabytes of traffic is different to that of someone who has for example 1Gbps traffic to process. Adding another layer of complexity at carrier scale is that the network will typically be spilt over multiple global locations, be a combination of core and edge networks and contain both legacy and new equipment.

SCALING NETWORK VISIBILITY WITH NETOFLOW SECURITY MONITORING

Network visibility at this level requires a hardware solution that can be deployed at multi-100Gbps and that can scale as the network expands. Universally, flow analysis tools like NetFlow probes and sensors are the most commonly deployed network security monitoring solutions, initially developed for enterprise-level security they also sometimes find themselves in the infrastructure of 

, ISP and carrier networks. However, they are simply not fit for purpose and cannot handle the sheer amount of traffic at that scale and provide accurate network flow monitoring.

Talos/Cisco technical breakdown of a recent IoT botnet attack – VPNFilter

Deep packet inspection, which can lead to bottlenecks and massive processing power requirements

Active monitoring, which as the name implies introduces an unnecessary load on the network

Sampled data, which can result in threats being missed.

The biggest advantage to using flow analysis is that there is almost certainly NetFlow or IPFIX support on existing infrastructure in the carrier’s core network anyway — which makes configuration much easier.

Visibility attained via flow data which could include NetFlow, IPFIX monitoring, J-Flow, sFlow or NetStream is ideal for extracting key information that is critical to a Network Security Operations (NOC) and/or a Security Operations Centre (SOC) team’s daily functions and long-term security strategy. Network visibility allows defenders to answer questions like:

Who or what is monopolising bandwidth and slowing down the network?

How can we spot botnets, APTs, zero-day malware, SS7 attacks, and other threats if they bypass perimeter defences?

How can we identify and track which IP’s and countries the network is exchanging data with?

How can I detect tunnelled traffic and gain visibility into encapsulated traffic that may be carrying threats?

How can I identify malicious activity within encrypted traffic such as TLS 1.3?

The ability to troubleshoot in real-time to ensure availability and improve user experience.

This type of granularity and behavioural analysis provides the ability to hunt for threats, which at scale can be difficult not least because of the sheer amount of data to search but also the categorisation and identification of the types of threats that are a risk to your network security. Typically, a carrier network defender will not be interested in ‘Credential Stuffing’ for instance because that threat is quite specific to website security, so that attack vector is likely more important to a SecOps team within a Content Delivery Network (CDN).

For a Carrier, DDoS and large scale IoT botnets like the recent Prometei and Flubot would constitute a significant threat. Specific alarms or events provided by flow monitoring and meta-data security enrichment enables threat hunters to visualise, analyse, and investigate contextual data relating to every transaction and network conversation, which means that these types of attacks can be caught before they cause irrevocable damage.

Threat Hunting and Network Monitoring with NetFlow at Scale

Threat hunting is the term used for proactively searching for cyber threats that could be present undetected within a network. The benefits of threat hunting as part of a holistic cyber-crime prevention strategy means that companies have an additional and proactive line of defence against malicious actors that may have breached endpoint security defenses, and are more likely to identify and prevent threat actors within their network before they strike. 

People often confuse proactive threat hunting with threat intelligence or threat monitoring, which are different yet important aspects of cyber-crime prevention. 

 is information an organisation uses to understand the threats being targeted at it. Threat hunting is often supported by threat intelligence, and the results and findings from threat hunting can be shared as additional threat intelligence. Threat monitoring is a passive technique utilising tools to observe your landscape, identifying suspicious activity as it happens.

There are several methodologies that threat hunters use in order to search for potential threats within a network: 

Threat hunters will analyse threat intelligence in search of potential suspicious activity – known as Indicators Of Compromise (IOC). If they find abnormal activity which could be evidence of malicious activity, this is used as a basis for investigation.

 Hypothesis-based threat monitoring often takes place when a new threat is identified in crowdsourced attack data, or in the case of well-documented attacks, in the news. Information shared will include attackers’ tactics, techniques and procedures (TTP) which threat hunters can search for in their own networks. 

Analytics and machine-learning threat hunting

This form of network anomaly detection is automated rather than being human-led. Advanced computer software processes data to detect irregularities, and these anomalies are then investigated by analysts to determine whether they pose a threat.

Indicators of Compromise (IOC) is the forensic name given to the anomalous pieces of data found in a system during threat hunting which may be evidence of malicious activity in the network. Cyber security experts should check IOC data regularly in order to detect suspicious activity within the network. Examples of IOCs include:

Geographical anomalies – attempted access from a blacklisted region or a region outside of where your company is located. 

IP address – supported by Threat Intelligence, suspected malicious IP addresses can be identified

TOR/anonymiser – identification of an IP address associated with known TOR nodes/anonymisers

Unusual outbound traffic – a change in what qualifies as ‘normal’ traffic for your organisation

Increase in traffic volume – spikes in traffic are often associated with DDoS/DoS attacks

Increase in DNS activity – this is often utilised for C2 communications when initiating connections.

The threat hunting process generally follows three steps:

Indicator – Advanced detection tools identify unusual behaviours such as the Indicators Of Compromise listed above. This trigger points threat hunters to an area where there may be malicious activity for further investigation. 

Investigation – Threat hunters use technology such as Endpoint Detection and Response (EDR) or Network Detection and Response (NDR) to analyse whether the system may be compromised. At this point the activity will either be deemed benign or considered malicious.  

Response – The final step is the resolution phase. It is vital to communicate the malicious activity to security teams so they can respond and mitigate threats. Data gathered from step 1 and 2 can then be utilised to improve threat hunting analytics and machine-learning technology further and prevent similar threats in future. 

SolarWinds is a major US information technology firm. In December 2020, it was reported that the firm had been hit by a cyber attack that went undetected for months and had spread to its clients. SolarWinds have since dubbed the attack the “SUNBURST vulnerability”.

Hackers were able to gain access to SolarWinds’ system and add malicious code. This code was then unwittingly sent out to up to 33,000 of SolarWinds’ clients as part of a software update. Up to 18,000 of SolarWinds’ customers installed the updates – including Microsoft, Cisco, Intel, Deloitte and even parts of the Pentagon – leaving them vulnerable to attack. It is believed that attackers from Russia were able to hack into and spy on high-profile private companies and senior US Government departments including the Treasury Department and the Department of Homeland Security. 

The SolarWinds attack had a huge impact in the cybersecurity industry and within large organisations and resulted in a massive upsurge in interest in threat hunting as a means to prevent large-scale and far-reaching attacks like this from happening again. 

BENEFITS OF THREAT HUNTING FOR TELECOMS COMPANIES

Threat hunting has many benefits as a means of threat protection for large organisations like telecoms companies. The benefits of threat hunting include: 

Proactive threat hunting can prevent damage being done if a threat actor has gained access but not yet stolen or compromised data. Often threat actors will lie dormant in a network for months before striking – threat hunting means you’re more likely to find and respond to these malicious actors before it’s too late. 

Reduction in breaches and breach attempts

Ongoing threat hunting means more data gathered from potential malicious activity, enabling machine learning to continually improve and respond better to beaches and breach attempts. 

Data gathered through threat hunting can help to establish a deeper understanding of threat actor TTPs, which can be shared with the wider threat intelligence community to better protect networks everywhere.

Faster and more accurate responses to threats

Regular and proactive threat hunting ensures that any breaches are located and resolved more quickly. 

Overall, threat hunting improves your network’s security and forms a vital weapon in your arsenal to protect against cyber-crime. 

Telecoms companies have much larger quantities of data compared to smaller organisations. Using the Telesoft Data Analytics Capability (TDAC) ensures the ability to comprehensively investigate in the event of a trigger, without missing any malicious activity. 

Threat hunting is the term used for proactively searching for cyber threats that could be present undetected within a network. The benefits of threat hunting as part of a holistic cyber-crime prevention strategy means that companies have an additional and proactive line of defence against malicious actors that may have breached endpoint security defenses, and are more likely to identify and prevent threat actors within their network before they strike. 

What is threat hunting and how does it benefit telecoms companies?

To continue expanding the current 2x100G FlowProbe functionally, SSL Certificate extraction has been added to the layer 7 metadata options.

Using the FPGA to perform deep packet inspection the system is able to identify packets containing SSL certificates. Certificates can vary in size but normally are in excess of 2kB, this results in it being spread across several packets. The FlowProbe is capable of delivering the whole certificate even when fragmented across multiple non-consecutive frames. Delivering the whole certificate enables the end-user to process any of the information they may require.

SSL certificate extraction

Security Analysts within the SecOps, DevOps, Security Operations Centre (SOC), Incident Response and Threat Intel teams are often overloaded with information produced by their cybersecurity tools. This issue is even more problematic in Firewalls and Intrusion Detection Systems (IDS) at carrier scale, leading to ‘Alert Fatigue’ and false positives. When this happens, it makes it difficult to priortise threats and respond to incidents and malicious activity effectively, leading to missed critical events and early opportunities to block attacks that pose a risk to network infrastructure. Having easy to access to information regarding threat actors, persistent threats, attack patterns, tools and signatures is incredibly important to perimeter defence strategies.  Modern network and asset security requires this level of granularity and valuable threat context to gain a greater level of network visibility and security.

Security Analysts within the SecOps, DevOps, Security Operations Centre (SOC), Incident Response and Threat Intel teams are often overloaded with information produced by their cybersecurity tools. This issue is even more problematic in Firewalls and Intrusion Detection Systems (IDS) at carrier scale, leading to ‘Alert Fatigue’ and false positives. When this happens, it makes it difficult to priortise threats and respond to incidents and malicious activity effectively, leading to missed critical events and early opportunities to block attacks that pose a risk to network infrastructure. Having easy to access to information regarding threat actors, persistent threats, attack patterns, tools and signatures is incredibly important to perimeter defence strategies.  Modern network and asset security requires this level of granularity and valuable threat context to gain a greater level of network visibility and security.

RESOURCES

Threat Hunting

Threat Hunting

The value of analysing metadata for threat hunting

Threat Hunting

Weekly Cyber Threat Reports

Threat Hunting

There is no 'one size fits all' when it comes to protecting your network

Threat Hunting

The Benefits of a Managed Threat Hunting Service

Threat Hunting

What is Multi-layered Threat Detection and Mitigation?

Threat Hunting

Proactive Threat Hunting

Threat Hunting

Threat Hunting and Network Monitoring with NetFlow at Scale

Threat Hunting

What is threat hunting and how does it benefit telecoms companies?

Threat Hunting

SSL certificate extraction

Threat Hunting

Utilising Contextual Threat Record in an Intrusion Detection System (IDS)

Threat Hunting

Sustainable Smart Cities in the Sand

Nucleus: Repository of cyber security information