Anticipating future behavior using kill chains
A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; deriving an observable based upon the monitoring of the electronically-observable data source; identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility; associating the security related activity with a phase of a cyber kill chain; and, performing a security operation on the security related activity via a security system, the security operation disrupting performance of the phase of the cyber kill chain.
1. A computer-implementable method for performing a security operation, comprising:
monitoring an entity, the monitoring observing at least one electronically-observable data source;
deriving an observable based upon the monitoring of the electronically-observable data source;
identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility;
processing the security related activity to generate a session fingerprint, the session fingerprint representing a set of behavior factors associated with a session;
associating the session fingerprint with a particular security vulnerability scenario from a plurality of security vulnerability scenarios, each of the plurality of security vulnerability scenarios providing a grouping of security risk use cases that represent a particular class of security vulnerability;
inferring a particular security vulnerability scenario from the observable derived based upon the monitoring;
associating the security related activity with a phase of a cyber kill chain, the associating being based in part on the security vulnerability scenario inferred from the observable, each phase of the cyber kill chain having a corresponding security risk persona, each security risk persona characterizing a behavioral pattern exhibited by the entity during enactment of an entity behavior associated with a particular phase of the cyber kill chain; and,
performing a security operation on the security related activity via a security system, the security system executing on a hardware processor, the security operation disrupting performance of the phase of the cyber kill chain.
2. The method of claim 1 , further comprising:
associating a security risk persona with the entity; and,
generating a baseline risk score based upon the security risk persona.
3. The method of claim 2 , wherein:
the disrupting performance of the component of the cyber kill chain is based upon the security risk persona.
4. The method of claim 2 , wherein:
the security risk persona characterizes a user entity behavior.
5. The method of claim 4 , wherein:
the cyber kill chain comprises an associated security vulnerability scenario.
6. The method of claim 5 , wherein:
the phase of the cyber kill chain comprises a risk use case; and,
performance of the component of the cyber kill chain is disrupted by affecting completion of the risk use case.
7. A system comprising:
a hardware processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring an entity, the monitoring observing at least one electronically-observable data source;
deriving an observable based upon the monitoring of the electronically-observable data source;
identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility;
processing the security related activity to generate a session fingerprint, the session fingerprint representing a set of behavior factors associated with a session;
associating the session fingerprint with a particular security vulnerability scenario from a plurality of security vulnerability scenarios, each of the plurality of security vulnerability scenarios providing a grouping of security risk use cases that represent a particular class of security vulnerability;
inferring a particular security vulnerability scenario from the observable derived based upon the monitoring;
associating the security related activity with a phase of a cyber kill chain, the associating being based in part on the security vulnerability scenario inferred from the observable, each phase of the cyber kill chain having a corresponding security risk persona, each security risk persona characterizing a behavioral pattern exhibited by the entity during enactment of an entity behavior associated with a particular phase of the cyber kill chain; and,
performing a security operation on the security related activity via a security system, the security system executing on the hardware processor, the security operation disrupting performance of the phase of the cyber kill chain.
8. The system of claim 7 , wherein the instructions executable by the processor are further configured for:
associating a security risk persona with the entity; and,
generating a baseline risk score based upon the security risk persona.
9. The system of claim 8 , wherein:
the disrupting performance of the component of the cyber kill chain is based upon the security risk persona.
10. The system of claim 8 , wherein:
the security risk persona characterizes a user entity behavior.
11. The system of claim 10 , wherein:
the cyber kill chain comprises an associated security vulnerability scenario.
12. The system of claim 11 , wherein:
the phase of the cyber kill chain comprises a risk use case; and,
performance of the component of the cyber kill chain is disrupted by affecting completion of the risk use case.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
monitoring an entity, the monitoring observing at least one electronically-observable data source;
deriving an observable based upon the monitoring of the electronically-observable data source;
identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility;
processing the security related activity to generate a session fingerprint, the session fingerprint representing a set of behavior factors associated with a session;
associating the session fingerprint with a particular security vulnerability scenario from a plurality of security vulnerability scenarios, each of the plurality of security vulnerability scenarios providing a grouping of security risk use cases that represent a particular class of security vulnerability;
inferring a particular security vulnerability scenario from the observable derived based upon the monitoring;
associating the security related activity with a phase of a cyber kill chain, the associating being based in part on the security vulnerability scenario inferred from the observable, each phase of the cyber kill chain having a corresponding security risk persona, each security risk persona characterizing a behavioral pattern exhibited by the entity during enactment of an entity behavior associated with a particular phase of the cyber kill chain; and,
performing a security operation on the security related activity via a security system, the security system executing on a hardware processor, the security operation disrupting performance of the phase of the cyber kill chain.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein the computer executable instructions are further configured for:
associating a security risk persona with the entity; and,
generating a baseline risk score based upon the security risk persona.
15. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the disrupting performance of the component of the cyber kill chain is based upon the security risk persona.
16. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the security risk persona characterizes a user entity behavior.
17. The non-transitory, computer-readable storage medium of claim 16 , wherein:
the cyber kill chain comprises an associated security vulnerability scenario.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein:
the phase of the cyber kill chain comprises a risk use case; and,
performance of the component of the cyber kill chain is disrupted by affecting completion of the risk use case.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.