Some days start out quiet—too quiet—for a cybersecurity analyst. Others, not so much.

 “We never know what is going to happen. A day can start out calm or start out on fire and very quickly go from one or another,” says Jim Treinen, a security analyst for ProtectWise, who spends his days defending both his own company’s network as well as that of its customers.

Treinen, vice president of security research at cloud security provider ProtectWise, says his team is divided into two different groups. The first consists of the classic network security researcher-type analysts, who gather the bits and bytes of network traffic off the wire to determine what is good and bad, and who also pulls apart malware. The second group focuses on security analysis, performing behavioral analysis, machine-learning, and all the heuristic analysis that goes into judging what is legitimate activity and what is not.

First order of the day: Situational Awareness

For an analyst coming on shift, the first task of the day is a hand-over of activity and information from the analysts on the previous shift, especially if they are in a 24/7 security operations center. The analyst gets a briefing on the current events: ongoing incidents or things that are suspicious that need monitoring.  “We start there,” Treinen says.

“What are the key activities on the network? What are we monitoring? Is there something that we see that is a potential risk that we need to really come up to speed on quickly?”

And they watch to see what happens next. 

“The biggest problem we deal with especially in these large networks is the vast volume of things we need to watch. So where do we focus?”

An analyst can use a combination of tools and clues pulled from monitoring the network to determine which parts of the network to focus on first. This is where the hand-off, or situational awareness, from the previous analysts is helpful, as well as are tools that detect abnormal activity.

Fighting Attacks: Reactive Mode

Security analysts tend to work in two modes:  reactive mode, where they respond to alarms and information from their security tools; and calm/proactive mode, where they can proactively hunt for activity they think deserves attention so they aren’t always chasing down an event.

But what happens if things start to go bad quickly – a malware attack, virus escalation, a denial of service attack, or discovery of data theft?

The ideal scenario is to intercept attackers before they cause damage or steal information, according to Treinen. If analysts detect adversaries setting up an infrastructure to launch an attack or tunneling into the network, ideally, they would shut the infrastructure down and move to remediate the compromised machines before damage is done. That’s why analysts need to constantly monitor for activity such as a compromised host system calling out for malware updates or applications calling out for command and control type activity.

But the ideal doesn’t always happen.  So if a network is under attack, the logical step for the analyst is to develop a case file or incident file and start tracking the assets the security team thinks are under attack as well as track where the attacks are coming from. This activity becomes the focus point in the network.

“Depending on the types of tools you have in hand, you can trade searches off of that or elevate the monitoring of specific applications,” Treinen says.

An analyst will also watch for lateral movement to determine if the adversary is using the primary compromised applications or systems as a jumping point to get deeper into the network.  Automated remediation systems, or even the network engineering teams, should start closing systems down if that is warranted.

Doors into the network and systems need to be shut quickly. Analysts are also be focused on preserving any type of forensic evidence the SOC team can use internally to figure out how the bad guys got in or to preserve evidence if the organization calls in law enforcement. The bad guys most likely attempt to clean up after the attack to effectively delete their tracks.

Fighting Attacks: Calm Mode

Analysts can use the quieter times to proactively catch and mitigate attacks and security breaches. “If you have the right team and proactive analysts who are curious by nature and if they see something, they can pull on that thread to see where it leads them,” Treinen says.

Highly skilled attackers leave minimal tracks because they are stealthy. But an experienced senior analyst whose interest in an activity is piqued might be able to yield some fruit doing more in-depth analysis. Attackers are constantly changing the domains and IP addresses they use in order to escape detection, for example.  “If you keep enough history and enough memory of what has actually happened on your network, you can discover something you didn’t see before,” Treinen says.

Using tools that reconstruct the state of a network at any given point in time can give an analyst a powerful forensic search capability. Instead of just analyzing log data, the analyst can reconstruct the full network down to the packet-level to see who was talking to whom and which protocols were in use. Or the analyst might find evidence of compromised systems from a zero-day attack lying latent in the network, poised for future attack. 

“The network doesn’t lie; it gives you a true recording on what is going on,” Treinen says.

However, it takes more than one approach to find malicious activity; there is no silver bullet. So an analyst must also rely on host-based detection systems. You need a view of both network and host activity to get a full picture of threats, according to Treinen.

Related Content:

Find out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.