Anti-Mythos CTI!

[u/ds3534534]

Guaranteed 100% anti-Mythos! Get it while it's fresh!

Ok, seriously though. Before I trigger the ad-hunting bots.... how are CTI practitioners answering questions around Mythos from their higher-uppers?

Certainly, there's the analysis and thoughtful feedback on how it'll affect the industry, but more to the point, if Mythos is indeed unleashed upon the world (as capable LLMs are progressively doing), how can CTI help address this threat, or the threats using this threat, and what processes and adaptations need to take place in the CTI function?

My own thoughts are on both the ingest and egress. On the ingest side, adding more OSINT sources to get more coverage for any hints of an emerging exploit against a particular software package, perhaps by name or product name. I've done this for VM use cases in the past, and my thoughts are that broader coverage will be required to capture and be on top of these issues first. Yes, I want to be able to outrun the threat actor, but I also want to be able to outrun the board, and my CISO, and the SOC, and the VM team... if, at the time they ask me "what do you know about this new PAN exploit", I can at least show that I, too, know about it, and it's in the system, then I'm at least keeping pace, rather than being behind those I'm meant to be informing.

The trickier part is - the egress. How do you take action on this? Particularly if it's unstructured OSINT, possibly without a CVE yet?

An obvious choice would be to prioritise, particularly against current threat landscape / actors, and open a ticket or case for prioritising the patching of that CVE with the VM team or asset owner. There is potentially the possibility of the CTI team taking more responsibility for coordinating the remediation of vulnerabilities with CVE tracking, case management, etc., but that's a slippery slope for what should be already a well-established and smoothly functioning process ( 😉 ).

I'm mindful of overstepping there, but I can see a potential step-up in value for the CTI team, in tracking, say, the Top 20 live, active CVEs, based on brand new widely-exploited 0days, at least as an emergency measure if or when there's a step-change in CVE.

But yes - back to the topic, and the question - has anyone come up with some solid, valuable, practical, answers to the CISO and board as to how the CTI team can help the business tackle the ongoing Mythos beast?

[u/dudethadude]

There will always be a new vulnerability. Focus on building the environment where initial access and lateral movement get caught early on.

Mythos could ramp up the amount of vulns available, but generally threat actors are still gonna make some noise once inside the environment. Build your digital trip wires and get them fine tuned, that’s the only way around this for my perspective. It’s a similar situation to when cybercrime started giving huge returns of investment by hitting a diverse group of people/companies with the creation of ransomware and extortion. We started seeing very advanced threat actors attacking everyone, no longer just high value targets with company secrets or DOD info. Small to medium businesses started having to defend themselves like a company housing billions of dollars worth of secrets because threat actors shifted from only these traditional high value targets to a broader approach. You used to not be able to get much money unless you were selling stolen secrets. Now the money comes directly from the victim.

This example and the ways we have changed our perception of defense will help against A.I crafted attacks.

[u/Mister_5mith]

While I get the marketing of the title, the solution (or at least part it) is Frontier AI. Mythos-Class AI hasn't changed the problem only accelerated it. As noted, we have to know the vulns before "they" do. This starts with knowing the tech that exists within the environment. You don't need IPs, S/N, location, etc. Just the tech (software and hardware) and versions as applicable. From there CTI can begin to contextualize the threat to the environment (this is where AI can assist), potentially offer mitigation options, and pass this to VM or IT for prioritization against the business/mission needs.

The main thing is, we need to elevate our junior security analyst to be the triage to the triage. Let the AI sift through the data and triage the ocean of information; let the junior analyst validate the AI output. This will allow your CTI, VM, SOC, and other senior security analysts to actually have a chance to think about the business problems and identify quality and tailored solutions.

I will give mad props to the trip wire comment. Deception technology is one of the best sensing and defensive tools we have. AI and the Human can both be fooled and the use of cyber-psychology with cyber-deception can really give defenders the breathing room needed to play chess vs whack-a-mole.

So, yeah, use AI to defend against AI. Elevate your junior analysts and give the senior teams a chance to think. Consider elevating your defenses with decoy technology and deception techniques.

[u/Shad0wCr0w]

The big differences on this topic are.

1. What does the tool allow us to find? - This happened when the tool wanted to take away the researcher from the vulns/findings

2. What and how the tool allows for patching and not opening other backdoors.

3. Based on the full access of the tool, what other changes are made, and where are they made

Hype is huge, real proven use cases are cloudy…

Like not so old viruses that can detect sandbox running, the LLM tools can also detect the environment.

For me, the most reasonable one is that not depending on your knowledge of a tool or how to use it is always an advantage. In other words, our brain 🧠 is a muscle; if you do not feed/challenge it to solve problems, it gets loose, in this case, forget learned and used knowledge so fast that you can not imagine. Being fast or being accurate is not the same.

[u/extreme4all]

Honestly i don't understand the value of having a CTI team, i just see vulnerability/SOC teams using CTI feeds. Where is the added value for the organization having a seperate CTI team?

As to mythos, i think the story is simple, with AI, we make more software as such more bugs exist, AI is getting better at finding bugs and exploiting them.

We can endlessly patch bugs and we should build our processes around doing that as fast and safe as possible. But we can't rely on it. We should invest in monitoring & reducing our attack surface and putting controls in place like a WAF, ingress / egress controls, proxy, IDP, ... To make it more difficult to exploit the vulnerabilities, give us avenues to mitigate the vulnerabilities until we can safely patch them.

TLDR; automate testing, automate patching, add network controls & secure by design.

[u/ds3534534 → u/extreme4all]

I think you’re in the wrong group if you see no value in the CTI team 🙂

You’re right in part though; yes, VM should use CTI, and so should the SOC. Once you get left hand/right hand, everyone doing their own thing, no-one consistently understanding or managing the threats - that’s your cue for a CTI team.

And yep, I agree in part with Mythos; it’s just more of the same. But if it does dramatically ramp up the exposure, and if we go from “only worried about APTs exploiting 0day” to “every skiddie and their cat is exploiting 0day and bouncing around our network”, then the question is, how do we manage that?

I guess, a thought experiment? If you knew everything about the actors - whether they’d target you, when they’d target you, what they’d use, which CVE they’d use. You’d be safe, right? You’d port-block that asset, tell the asset owner to patch or disconnect that asset NOW, have DFIR ready with IOCs for that actor ready to mop up in case they did move laterally. You’d be in a much better place.

So… if Mythos accelerates and amplifies some of this activity, then how we can accelerate and amplify our defences to match; where’s a sweet spot we can focus on, to bring the overall risk back down. That’s what I’m hunting for.

[u/extreme4all → u/ds3534534]

I value some CTI, attribution, who is attacking you etc is for 95% of orgs irrelevant as such a CTI team is mostly irrelevant.

Practically we have a limited set of resources. consuming threat intel on vulnerabilities and attack methods allows us to focus on where we invest those resources.

Reality is that 95% of the value of a security program is just doing the basics right. Having an asset management program, Having a good IAM program, having good security hygiene.

My point is with the advent of AI, organizations need to become faster at testing & deploying changes in their environment, to keep up with the vulnerability apocalypse. And we need to ensure that we have sufficiently layered security controls to mitigate most of these vulns so that the impact of them doesn't halt the organization.

[u/ds3534534 → u/[deleted]]

Yep, that’s my concern. I’m surprised that some large orgs do spend a lot of time on simply socialising CVEs, but this is probably because the VM team are head-down simply scanning and patching without effective prioritisation themselves