A Proactive Approach to Cybersecurity: Thinking Like an Attacker - Shailendra Shyam Sahasrabudhe, Country Manager, India, UAE and South East Asia, Cymulate Ltd

In 2017, Michael Melone published the 'Think Like a Hacker: A Sysadmin's Guide to Cybersecurity' book, keeping in mind the ever-evolving landscape of information security. The book covers how the emergence of targeted attacks and determined human adversaries (DHA) has irrevocably altered the rules of the game.

He opined that while the importance of writing secure code remains undiminished, it addresses only one facet of the overarching challenge. To mount an effective defence against targeted attacks, IT professionals must delve deeper into the mindset of attackers and comprehend how they exploit enterprise design to their advantage.

Melone makes a very strong point. Understanding the tactics deployed by advanced attackers as they breach networks is paramount.

Equally crucial is grasping their manipulation of concepts like access and authorization to move stealthily from one system to another. Exploring the deployment of custom implants and backdoors within an enterprise by attackers sheds light on their covert methods. Moreover, the concept of service-centric design comes to the fore, offering insights into how it can simultaneously enhance security and usability.

Over the past few years, the frequency and impact of cyberattacks have surged, making it clear that organizations can no longer rely solely on reactive security measures. To effectively minimize risk, security teams must shift their perspective and continuously assess their defences from an attacker's viewpoint. After all, it takes one to know one, right?

This proactive approach is vital to developing a resilient cybersecurity program. In this article, we'll explore why organizations should think like cyber attackers and how this mindset can strengthen their defences.

Why Think Like an Attacker?

Cybercriminals are frequently motivated by a desire to showcase their skills, challenge the boundaries of systems and networks and make money unscrupulously while exhibiting their superiority. They persistently pose questions like, "How can I breach this?" or "How can I manipulate this for maximum impact or better financial gains?"

In contrast, cybersecurity teams are primarily dedicated to safeguarding and fortifying systems. Nevertheless, adopting an adversarial mindset serves as a critical thinking tool, capable of significantly enhancing an organization's cybersecurity posture by proactively identifying and addressing vulnerabilities.

The importance of adopting an attacker's perspective lies in gaining unique insights into an organization's defences. By doing so, security teams can identify potential vulnerabilities, assess their risk to the business, and prioritize threats accordingly. Viewing cybersecurity from an offensive standpoint can help internal teams, responsible for defense leverage these insights to enhance their strategies, ultimately bolstering an organization's resiliency.

It's equally crucial for companies to understand why their Security Operations (SecOps) teams sometimes struggle to gain the business's support for cybersecurity changes. Additionally, organizations should explore how exposure management can engage business stakeholders in cybersecurity operations. Techniques like attack surface management (ASM), breach and attack simulation (BAS), automated red teaming, and exposure analytics can aid in identifying and mitigating critical exposures.

Identifying Vulnerabilities Through the Right Toolkits

ASM involves simulating attackers' reconnaissance to uncover potential attack points within an organization's systems, including servers, applications, services, cloud components, workstations, and more. By pinpointing these vulnerabilities, organizations can define and implement remediation strategies to address the gaps in their defences.

Advanced ASM tools encompass external ASM, which scans the public attack surface, seeking security gaps and internal ASM Assessments, which find system exposures and risks that could lead to lateral movement escalation in the event of a breach. In essence, ASM helps identify configuration issues, unpatched software flaws, risky permissions, and other vulnerabilities that attackers might exploit.

BAS takes the next step by launching attack simulations to validate whether existing security controls can withstand real-world attacks. Its capabilities encompass Production-Safe Attack Simulations, which operationalize threat intelligence in alignment with frameworks like MITRE ATT&CK and NIST, using ready-to-use attack simulations.

Moreover, it can customize automated and scheduled attack scenarios for environment-specific refinements. And then some dynamic dashboards and reports provide insights into security assessment findings, complete with actionable remediation guidance.

The granular findings analysis, where the cross-analysis from multiple validation sources are displayed on a single dashboard with customizable views and filters. By proactively testing security controls through BAS, organizations can identify and address gaps, strengthening their incident response plans for real attacks.

Automated Red Teaming: Continuous Defense Testing

Automated red teaming involves adversarial simulations for ongoing validation of security defenses. This includes full kill-chain campaigns to validate security controls, network pen testing to simulate lateral movement, and even internal phishing campaigns to assess employee resilience against phishing attacks. By launching outside-in simulated attacks relentlessly, organizations can uncover their exposure to risks that require immediate remediation.

Exposure analytics correlates and analyzes data from various sources to facilitate better remediation and reporting. Effective exposure analytics should offer:

Correlation: To link exposure potential with business context.

Reporting: For generating reports on issues to be addressed in context, categorized by risk and area of responsibility.

Prioritization: To create prioritized remediation plans based on contextual risks and business impact.

Benchmarking: To establish baseline risks and security posture, enabling continuous assessment and improvement tracking.

Quantification: To build risk metrics and performance tracking for comprehensive cybersecurity program scoping and mobilization.

Exposure analytics creates risk-ranked inventories, measures resilience levels, accelerates response times, and provides executives with data-driven insights into security priorities.

Embracing the Attacker's Perspective

Taking on an attacker's perspective is invaluable for implementing a proactive security program that focuses on preventing breaches rather than just detecting them. Companies can explore various types of attack simulations and exposure analytics to transform their security practices. This shift in mindset is crucial for safeguarding their systems, users, applications, clouds, and networks from the ever-evolving threat landscape.

Ultimately, thinking like an attacker is not just a mindset shift; it's a strategic imperative for organizations looking to fortify their cybersecurity defences in a world of growing cyber threats. By embracing this proactive approach, companies can proactively identify and mitigate risks, bolster their resilience, and better protect their valuable assets and sensitive data from potential cyber adversaries.

The key to safeguarding against hackers lies in adopting the hacker's perspective. Learning to think like an attacker is not just a strategy but a prerequisite for countering the evolving threats in the realm of cybersecurity.