Reinventing the blue team: Threat detection using graphs

“Why are attackers ahead? Their cross-cutting vision allows them to see the big picture, while detection teams remain focused on lists.”

Abstract

One of the biggest reasons why attackers tend to be ahead of detection teams is because of their cross-cutting vision, while the latter are more focused on specific tasks to perform. This, in the world of mathematics, is nothing more than a graphical view of the attacker’s view of the organization, while the response team is still focused on lists.

The graph approach is becoming more and more prominent in the defense landscape. In this talk we will see how, using XDR information, we can do crosswalks and represent our environment as entity/relationship graphs using a graph visualization service. We will also see how graph-based security products do it for better understanding and representation of the infrastructure.

Internal seminar within the European Safehorizon project, by Mounaime Mellouk at ITEFI in room 3 from 12:00 to 13:00 on January 9, 2025.

Advanced Strategies in Cybersecurity

The seminar highlights essential concepts such as the tiered model of asset classification, robust identity management using cutting-edge tools like Azure Active Directory Defender for Identity, and email protection through Microsoft 365 Defender for Office. It also explores how Cloud Access Security Broker (CASB) solutions play a pivotal role in securing Software as a Service (SaaS) applications by monitoring and controlling access.

Further insights are provided on the shared responsibility model of cloud security, emphasizing collaboration between businesses and their providers to safeguard hosted infrastructure. The use of data correlation with graphs is explored for visualizing potential attack paths, allowing organizations to proactively address vulnerabilities within their networks.

In today’s digital age, where the threat landscape is constantly evolving, businesses are compelled to strengthen their defenses with sophisticated cybersecurity strategies that transcend traditional security measures. This comprehensive analysis delves into advanced techniques essential for safeguarding sensitive data and critical infrastructures within corporate environments.

Key Concepts in Modern Cybersecurity:

1. Tiered Asset Classification:
   • The tier model (tier 0, tier 1, tier 2) serves as a hierarchical framework that categorizes assets based on their sensitivity and criticality. This approach enables organizations to allocate security resources effectively by prioritizing risks associated with each level.
2. Robust Identity Management:
   • Identity is one of the most valuable assets in any technological infrastructure, representing both human users and machine-to-machine entities. Tools like Azure Active Directory Defender for Identity provide robust solutions for managing identity authentication securely in a digital-first world.
3. Email Protection:
   • Given its ubiquity in professional settings, email remains a common attack vector. Microsoft 365 Defender for Office (MDO) not only detects known threats but also employs advanced AI-based models and machine learning to identify suspicious or malicious patterns in real-time.
4. SaaS Application Security:
   • Software as a Service (SaaS) applications have transformed business operations, yet they pose significant risks if mismanaged. Cloud Access Security Broker (CASB) solutions are vital for monitoring and controlling traffic between these external services, ensuring that only authorized accesses interact with sensitive data.
5. Shared Responsibility in Cloud Security:
   • The cloud security paradigm has evolved into a shared responsibility model where both businesses and their providers have defined roles in protecting hosted infrastructure. Understanding these divisions of responsibilities is crucial for implementing effective preventive measures.
6. Data Correlation with Graphs:
   • Using graphs to correlate different entities and events allows organizations to visualize potential attack paths, identifying hidden vulnerabilities within networks. This technique not only enhances the understanding of security landscapes but also facilitates proactive risk mitigation actions.
7. Exposure Management:
   • Evaluating third-party access risks is essential for exposure management. Companies must balance operational accessibility with necessary restrictions to protect valuable assets from unauthorized interactions.
8. Secure Use of AI Tools:
   • Implementing AI tools like Microsoft Copilot 365 securely is crucial, especially given potential vulnerabilities from malicious injections during generative query processing. Integrating privacy and security policies helps prevent abuses in these powerful technologies.
9. Unified Platforms for Cybersecurity Management:
   • Unified platforms enable organizations to manage all their cybersecurity tools under a single interface, streamlining monitoring and incident response efforts.
10. Challenges and Future Outlook:
    • As technology continues to advance, so do threats. Companies must remain vigilant and proactive in innovating their defensive systems to anticipate future challenges effectively.

Conclusion

This analysis provides an integral glimpse into the advanced methods organizations can implement to bolster their cybersecurity defenses. Adopting a holistic and strategic vision that integrates emerging technologies with effective management practices is key. By doing so, businesses not only protect sensitive data and critical infrastructures but also build resilience against future threats in an ever-changing cyber landscape.

The seminar underscores the importance of evolving security strategies beyond traditional measures, emphasizing proactive risk assessment, innovative technology integration, and collaborative efforts between organizations and their providers to secure digital environments comprehensively.

Mounaime Mellouk , Cloud Security Architect at Microsoft
Computer Engineer and graduate in Mathematics from the Autonomous University of Madrid.
Currently, Mounaime is Cloud Security Architect at Microsoft, responsible for the design of security strategies for large companies in Spain. With more than 9 years of experience in the Cybersecurity sector, he has previously been working in some of the largest IT consulting firms, leading the development of security architectures for cloud clients.
Mounaime holds a Master’s degree in Cybersecurity and Big Data from UC3M, where he has researched and developed malware detection methods using image analysis.

Language

Spanish