Come l'intelligenza artificiale difende le infrastrutture critiche dal ransomware

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
12
May 2021
12
May 2021
In the wake of the Colonial Pipeline cyber-attack, this blog discusses the many threats facing critical infrastructure, and how Cyber AI disrupted a similar ‘double extortion’ ransomware attack against an electrical utilities supplier.

Modern Threats to OT Environments

At the 2021 RSA cyber security conference, US Secretary of Homeland Security Alejandro Mayorkas made an era-defining statement regarding the cyber security landscape: “Let me be clear: ransomware now poses a national security threat.”

Last weekend, Mayorkas’ words rang true. A ransomware attack on the Colonial Pipeline – responsible for nearly half of the US East Coast’s diesel, gasoline, and jet fuel – resulted in the shutdown of a critical fuel network supplying a number of Eastern states.

The fallout from the attack demonstrated how widespread and damaging the consequences of ransomware can be. Against critical infrastructure and utilities, cyber-attacks have the potential to disrupt supplies, harm the environment, and even threaten human lives.

Though full details remain to be confirmed, the attack is reported to have been conducted by an affiliate of the cyber-criminal group called DarkSide, and likely leveraged common remote desktop tools. Remote access has been enabled as an exploitable vulnerability within critical infrastructure by the shift to remote work that many organizations made last year, including those with Industrial Control Systems (ICS) and Operational Technology (OT).

The rise of industrial ransomware

Ransomware against industrial environments is on the rise, with a reported 500% increase since 2018. Oftentimes, these threats leverage the convergence of IT and OT systems, first targeting IT before pivoting to OT. This was seen with the EKANS ransomware that included ICS processes in its ‘kill list’, as well as the Cring ransomware that compromised ICS after first exploiting a vulnerability in a virtual private network (VPN).

It remains to be seen whether the initial attack vector in the Colonial Pipeline compromise exploited a technical vulnerability, compromised credentials, or a targeted spear phishing campaign. It has been reported that the attack first impacted IT systems, and that Colonial then shut down OT operations as a safety precaution. Colonial confirms that the ransomware “temporarily halted all pipeline operations and affected some of our IT systems,” showing that, ultimately, both OT and IT were affected. This is a great example of how many OT systems depend on IT, such that an IT cyber-attack has the ability to take down OT and ICS processes.

In addition to locking down systems, the threat actors also stole 100GB of sensitive data from Colonial. This kind of double extortion attack — in which data is exfiltrated before files are encrypted — has unfortunately become the norm rather than the exception, with over 70% of ransomware attacks involving exfiltration. Some ransomware gangs have even announced that they are dropping encryption altogether in favor of data theft and extortion methods.

Earlier this year, Darktrace defended against a double extortion ransomware attack waged against a critical infrastructure organization, which also leveraged common remote access tools. This blog will outline the threat find in depth, showing how Darktrace’s self-learning AI responded autonomously to an attack strikingly similar to the Colonial Pipeline incident.

Darktrace threat find

Ransomware against electric utilities equipment supplier

In an attack against a North American equipment supplier for electrical utilities earlier this year, Darktrace/OT demonstrated its ability to protect critical infrastructure against double extortion ransomware that targeted organizations with ICS and OT.

The ransomware attack initially targeted IT systems, and, thanks to self-learning Cyber AI, was stopped before it could spill over into OT and disrupt operations.

The attacker first compromised an internal server in order to exfiltrate data and deploy ransomware over the course of 12 hours. The short amount of time between initial compromise and deployment is unusual, as ransomware threat actors often wait several days to spread stealthily as far across the cyber ecosystem as possible before striking.

Figure 1: A timeline of the attack

How did the attack bypass the rest of the security stack?

The attacker leveraged ‘Living off the Land’ techniques to blend into the business’ normal ‘patterns of life’, using a compromised admin credential and a remote management tool approved by the organization, in its attempts to remain undetected.

Darktrace commonly sees the abuse of legitimate remote management software in attackers’ arsenal of techniques, tactics, and procedures (TTPs). Remote access is also becoming an increasingly common vector of attack in ICS attacks in particular. For example, in the cyber-incident at the Florida water treatment facility last February, attackers exploited a remote management tool in attempts to manipulate the treatment process.

The specific strain of ransomware deployed by this attacker also successfully evaded detection by anti-virus by using a unique file extension when encrypting files. These forms of ‘signatureless’ ransomware easily slip past legacy approaches to security that rely on rules, signatures, threat feeds, and lists of documented Common Vulnerabilities and Exposures (CVEs), as these are methods that can only detect previously documented threats.

The only way to detect never-before-seen threats like signatureless ransomware is for a technology to find anomalous behavior, rather than rely on lists of ‘known bads’. This can be achieved with self-learning technology, which spots even the most subtle deviations from the normal ‘patterns of life’ for all devices, users, and all the connections between them.

Darktrace insights

Initial compromise and establishing foothold

Despite the abuse of a legitimate tool and the absence of known signatures, Darktrace/OT was able to use a holistic understanding of normal activity to detect the malicious activity at multiple points in the attack lifecycle.

The first clear sign of an emerging threat that was alerted by Darktrace was the unusual use of a privileged credential. The device also served an unusual remote desktop protocol (RDP) connection from a Veeam server shortly before the incident, indicating that the attacker may have moved laterally from elsewhere in the network.

Three minutes later, the device initiated a remote management session which lasted 21 hours. This allowed the attacker to move throughout the broader cyber ecosystem while remaining undetected by traditional defences. Darktrace, however, was able to detect unusual remote management usage as another early warning indicative of an attack.

Double threat part one: Data exfiltration

One hour after the initial compromise, Darktrace detected unusual volumes of data being sent to a 100% rare cloud storage solution, pCloud. The outbound data was encrypted using SSL, but Darktrace created multiple alerts relating to large internal downloads and external uploads that were a significant deviation from the device’s normal ‘pattern of life’.

The device continued to exfiltrate data for nine hours. Analysis of the files downloaded by the device, which were transferred using the unencrypted SMB protocol, suggests that they were sensitive in nature. Fortunately, Darktrace was able to pinpoint the specific files that were exfiltrated so that the customer could immediately evaluate the potential implications of the compromise.

Double threat part two: File encryption

A short time later, at 01:49 local time, the compromised device began encrypting files in a SharePoint back-up share drive. Over the next three and a half hours, the device encrypted over 13,000 files on at least 20 SMB shares. In total, Darktrace produced 23 alerts for the device in question, which amounted to 48% of all the alerts produced in the corresponding 24-hour period.

Darktrace’s Cyber AI Analyst then automatically launched an investigation, identifying the internal data transfers and the file encryption over SMB. From this, it was able to present incident reports that connected the dots among these disparate anomalies, piecing them together into a coherent security narrative. This put the security team in a position to immediately take remediating action.

If the customer had been using Darktrace’s autonomous response technology, there is no doubt the activity would have been halted before significant volumes of data could have been exfiltrated or files encrypted. Fortunately, after seeing both the alerts and Cyber AI Analyst reports, the customer was able to use Darktrace’s ‘Ask the Expert’ (ATE) service for incident response to mitigate the impact of the attack and assist with disaster recovery.

Figure 2: AI Analyst Incident reporting an unusual reprogram command using the MODBUS protocol. The incident includes a plain English summary, relevant technical information, and the investigation process used by the AI.  

Detecting the threat before it could disrupt critical infrastructure

The targeted supplier was overseeing OT and had close ties to critical infrastructure. By facilitating the early-stage response, Darktrace prevented the ransomware from spreading further onto the factory floor. Crucially, Darktrace also minimized operational disruption, helping to avoid the domino effect which the attack could have had, affecting not only the supplier itself, but also the electric utilities that this supplier supports.

As both the recent Colonial Pipeline incident and the above threat find reveal, ransomware is a pressing concern for organizations overseeing industrial operations across all forms of critical infrastructure, from pipelines to the power grid and its suppliers. With self-learning AI, these attack vectors can be dealt with before the damage is done through real-time threat detection, autonomous investigations, and — if activated — targeted machine-speed response.

Looking forward: Using Self-Learning AI to protect critical infrastructure across the board

In late April, the Biden administration announced an ambitious effort to “safeguard US critical infrastructure from persistent and sophisticated threats.” The Department of Energy’s (DOE) 100-day plan specifically seeks technologies “that will provide cyber visibility, detection, and response capabilities for industrial control systems of electric utilities.”

The Biden administration’s cyber sprint clearly calls for a technology that protects critical energy infrastructure, rather than merely best practice measures and regulations. As seen in the above threat find, Darktrace AI is a powerful technology that leverages unsupervised machine learning to autonomously safeguard critical infrastructure and its suppliers with machine speed and precision.

Darktrace enhances detection, mitigation, and forensic capabilities to detect  sophisticated and novel attacks, along with insider threats and pre-existing infections, using Self-Learning Cyber AI, without rules, signatures, or lists of CVEs. Incident investigations provided in real time by Cyber AI Analyst jumpstart remediation with actionable insights, containing emerging attacks at their early stages, before they escalate into crisis.

Enable near real-time situational awareness and response capabilities

Darktrace immediately understands, identifies, and investigates all anomalous activity in ICS/OT networks, whether human or machine driven. Additionally, Darktrace actions targeted response where appropriate to neutralize threats, either actively or in human confirmation mode. Because Self-learning AI adapts alongside evolutions in the ecosystem, organizations benefit from real-time awareness with no tuning or human input necessary

Deploy technologies to increase visibility of threats in ICS and OT systems

Darktrace contextualizes security events, adapts to novel techniques, and translates findings into a security narrative that can be actioned by humans in minutes. Delivering a unified view across IT and OT systems.

Darktrace detects, investigates, and responds to threats at higher Purdue levels and in IT systems before they ‘spill over’ into OT. ‘Plug and play’ deployment seamlessly integrates with technological architecture, presenting 3D network topology with granular visibility into all users, devices, and subnets.

Darktrace's asset identification continuously catalogues all ICS/OT devices and identifies and investigates all threatening activity indicative of emerging attacks – be it ICS ransomware, APTs, zero-day exploits, insider threats, pre-existing infections, DDoS, crypto-mining, misconfigurations, or never-before-seen attacks.

Thanks to Darktrace analyst Oakley Cox for his insights on the above threat find.

Darktrace model detections:

  • Initial compromise:
  • User / New Admin Credential on Client
  • Data exfiltration:
  • Anomalous Connection / Uncommon 1 GiB Outbound
  • Anomalous Connection / Low and Slow Exfiltration
  • Device / Anomalous SMB Followed by Multiple Model Breaches
  • Anomalous Connection / Download and Upload
  • File encryption:
  • Compromise / Ransomware / Suspicious SMB Activity
  • Anomalous Connection / SMB Enumeration
  • Device / Anomalous RDP Followed by Multiple Model Breaches
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Anomalous Connection / Sustained MIME Type Conversion
  • Anomalous Connection / Suspicious Read Write Ratio
  • Device / Multiple Lateral Movement Model Breaches

INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
David Masson
Direttore della sicurezza aziendale

David Masson is Darktrace’s Director of Enterprise Security, and has over two decades of experience working in fast moving security and intelligence environments in the UK, Canada and worldwide. With skills developed in the civilian, military and diplomatic worlds, he has been influential in the efficient and effective resolution of various unique national security issues. David is an operational solutions expert and has a solid reputation across the UK and Canada for delivery tailored to customer needs. At Darktrace, David advises strategic customers across North America and is also a regular contributor to major international and national media outlets in Canada where he is based. He holds a master’s degree from Edinburgh University.

Book a 1-1 meeting with one of our experts
share this article
COre coverage

More in this series

Nessun articolo trovato.

Blog

Email

Looking Beyond Secure Email Gateways with the Latest Innovations to Darktrace/Email

Default blog imageDefault blog image
09
Apr 2024

Organizations Should Demand More from their Email Security

In response to a more intricate threat landscape, organizations should view email security as a critical component of their defense-in-depth strategy, rather than defending the inbox alone with a traditional Secure Email Gateway (SEG). Organizations need more than a traditional gateway – that doubles, instead of replaces, the capabilities provided by native security vendor – and require an equally granular degree of analysis across all messaging, including inbound, outbound, and lateral mail, plus Teams messages.  

Darktrace/Email is the industry’s most advanced cloud email security, powered by Self-Learning AI. It combines AI techniques to exceed the accuracy and efficiency of leading security solutions, and is the only security built to elevate, not duplicate, native email security.  

With its largest update ever, Darktrace/Email introduces the following innovations, finally allowing security teams to look beyond secure email gateways with autonomous AI:

  • AI-augmented data loss prevention to stop the entire spectrum of outbound mail threats
  • an easy way to deploy DMARC quickly with AI
  • major enhancements to streamline SOC workflows and increase the detection of sophisticated phishing links
  • expansion of Darktrace’s leading AI prevention to lateral mail, account compromise and Microsoft Teams

What’s New with Darktrace/Email  

Data Loss Prevention  

Block the entire spectrum of outbound mail threats with advanced data loss prevention that builds on tags in native email to stop unknown, accidental, and malicious data loss

Darktrace understands normal at individual user, group and organization level with a proven AI that detects abnormal user behavior and dynamic content changes. Using this understanding, Darktrace/Email actions outbound emails to stop unknown, accidental and malicious data loss.  

Traditional DLP solutions only take into account classified data, which relies on the manual input of labelling each data piece, or creating rules to catch pattern matches that try to stop data of certain types leaving the organization. But in today’s world of constantly changing data, regular expression and fingerprinting detection are no longer enough.

  • Human error – Because it understands normal for every user, Darktrace/Email can recognize cases of misdirected emails. Even if the data is correctly labelled or insensitive, Darktrace recognizes when the context in which it is being sent could be a case of data loss and warns the user.  
  • Unclassified data – Whereas traditional DLP solutions can only take action on classified data, Darktrace analyzes the range of data that is either pending labels or can’t be labeled with typical capabilities due to its understanding of the content and context of every email.  
  • Insider threat – If a malicious actor has compromised an account, data exfiltration may still be attempted on encrypted, intellectual property, or other forms of unlabelled data to avoid detection. Darktrace analyses user behaviour to catch cases of unusual data exfiltration from individual accounts.

And classification efforts already in place aren’t wasted – Darktrace/Email extends Microsoft Purview policies and sensitivity labels to avoid duplicate workflows for the security team, combining the best of both approaches to ensure organizations maintain control and visibility over their data.

End User and Security Workflows

Achieve more than 60% improvement in the quality of end-user phishing reports and detection of sophisticated malicious weblinks1

Darktrace/Email improves end-user reporting from the ground up to save security team resource. Employees will always be on the front line of email security – while other solutions assume that end-user reporting is automatically of poor quality, Darktrace prioritizes improving users’ security awareness to increase the quality of end-user reporting from day one.  

Users are empowered to assess and report suspicious activity with contextual banners and Cyber AI Analyst generated narratives for potentially suspicious emails, resulting in 60% fewer benign emails reported.  

Out of the higher-quality emails that end up being reported, the next step is to reduce the amount of emails that reach the SOC. Darktrace/Email’s Mailbox Security Assistant automates their triage with secondary analysis combining additional behavioral signals – using x20 more metrics than previously – with advanced link analysis to detect 70% more sophisticated malicious phishing links.2 This directly alleviates the burden of manual triage for security analysts.

For the emails that are received by the SOC, Darktrace/Email uses automation to reduce time spent investigating per incident. With live inbox view, security teams gain access to a centralized platform that combines intuitive search capabilities, Cyber AI Analyst reports, and mobile application access. Analysts can take remediation actions from within Darktrace/Email, eliminating console hopping and accelerating incident response.

Darktrace takes a user-focused and business-centric approach to email security, in contrast to the attack-centric rules and signatures approach of secure email gateways

Microsoft Teams

Detect threats within your Teams environment such as account compromise, phishing, malware and data loss

Around 83% of Fortune 500 companies rely on Microsoft Office products and services, particularly Teams and SharePoint.3

Darktrace now leverages the same behavioral AI techniques for Microsoft customers across 365 and Teams, allowing organizations to detect threats and signals of account compromise within their Teams environment including social engineering, malware and data loss.  

The primary use case for Microsoft Teams protection is as a potential entry vector. While messaging has traditionally been internal only, as organizations open up it is becoming an entry vector which needs to be treated with the same level of caution as email. That’s why we’re bringing our proven AI approach to Microsoft Teams, that understands the user behind the message.  

Anomalous messaging behavior is also a highly relevant indicator of whether a user has been compromised. Unlike other solutions that analyze Microsoft Teams content which focus on payloads, Darktrace goes beyond basic link and sandbox analysis and looks at actual user behavior from both a content and context perspective. This linguistic understanding isn’t bound by the requirement to match a signature to a malicious payload, rather it looks at the context in which the message has been delivered. From this analysis, Darktrace can spot the early symptoms of account compromise such as early-stage social engineering before a payload is delivered.

Lateral Mail Analysis

Detect and respond to internal mailflow with multi-layered AI to prevent account takeover, lateral phishing and data leaks

The industry’s most robust account takeover protection now prevents lateral mail account compromise. Darktrace has always looked at internal mail to inform inbound and outbound decisions, but will now elevate suspicious lateral mail behaviour using the same AI techniques for inbound, outbound and Teams analysis.

Darktrace integrates signals from across the entire mailflow and communication patterns to determine symptoms of account compromise, now including lateral mailflow

Unlike other solutions which only analyze payloads, Darktrace analyzes a whole range of signals to catch lateral movement before a payload is delivered. Contributing yet another layer to the AI behavioral profile for each user, security teams can now use signals from lateral mail to spot the early symptoms of account takeover and take autonomous actions to prevent further compromise.

DMARC

Gain in-depth visibility and control of 3rd parties using your domain with an industry-first AI-assisted DMARC

Darktrace has created the easiest path to brand protection and compliance with the new Darktrace/DMARC. This new capability continuously stops spoofing and phishing from the enterprise domain, while automatically enhancing email security and reducing the attack surface.

Darktrace/DMARC helps to upskill businesses by providing step by step guidance and automated record suggestions provide a clear, efficient road to enforcement. It allows organizations to quickly achieve compliance with requirements from Google, Yahoo, and others, to ensure that their emails are reaching mailboxes.  

Meanwhile, Darktrace/DMARC helps to reduce the overall attack surface by providing visibility over shadow-IT and third-party vendors sending on behalf of an organization’s brand, while informing recipients when emails from their domains are sent from un-authenticated DMARC source.

Darktrace/DMARC integrates with the wider Darktrace product platform, sharing insights to help further secure your business across Email Attack Path and Attack Surface management.

Conclusion

To learn more about the new innovations to Darktrace/Email download the solution brief here.

All of the new updates to Darktrace/Email sit within the new Darktrace ActiveAI Security Platform, creating a feedback loop between email security and the rest of the digital estate for better protection. Click to read more about the Darktrace ActiveAI Security Platform or to hear about the latest innovations to Darktrace/OT, the most comprehensive prevention, detection, and response solution purpose built for critical infrastructures.  

Learn about the intersection of cyber and AI by downloading the State of AI Cyber Security 2024 report to discover global findings that may surprise you, insights from security leaders, and recommendations for addressing today’s top challenges that you may face, too.

References

[1] Internal Darktrace Research

[2] Internal Darktrace Research

[3] Essential Microsoft Office Statistics in 2024

Continue reading
About the author
Carlos Gray
Product Manager

Blog

Nessun articolo trovato.

Managing Risk Beyond CVE Scores With the Latest Innovations to Darktrace/OT

Default blog imageDefault blog image
09
Apr 2024

Identifying Cyber Risk in Industrial Organizations

Compromised OT devices in ICS and SCADA environments pose significant physical risks, even endangering lives. However, identifying CVEs in the multitude of complex OT devices is labor-intensive and time-consuming, draining valuable resources.

Even after identifying a vulnerability, implementing a patch presents its own challenges limited maintenance windows and the need for uninterrupted operations strain IT and OT teams often leading organizations to prioritize availability over security leading vulnerabilities remaining unresolved for over 5 years on average. (1)

Darktrace’s New Innovation

Darktrace is an industry leader in cybersecurity with 10+ years of experience securing OT environments where we take a fundamentally different approach using Self-Learning AI to enhance threat detection and response.

Continuing to combat the expanding threat landscape, Darktrace is excited to announce new capabilities that enable a contextualized and proactive approach to managing cyber risk at industrial organizations.

Today we launch an innovation to our OT Cybersecurity solution, Darktrace/OT, that will add a layer of proactivity, enabling a comprehensive approach to risk management. This industry leading innovation for Darktrace/OT moves beyond CVE scores to redefine vulnerability management for critical infrastructure, tackling the full breadth of risks not limited by traditional controls.  

Darktrace/OT is the only OT security solution with comprehensive Risk Management which includes:

  • Contextualized risk analysis unique to your organization
  • The most realistic evaluation and prioritization of OT risk
  • Effectively mitigate risk across your OT infrastructure, with and without patching.
  • The only OT security solution that evaluates your defenses against Advanced Persistent Threat (APT) Groups.

The most comprehensive prevention, detection, and response solution purpose built for Critical Infrastructures

Darktrace’s Self-Learning AI technology is a cutting-edge innovation that implements real time prevention, detection, response, and recovery for operational technologies and enables a fundamental shift from the traditional approach to cyber defense by learning a ‘pattern of life’ for every network, device, and user.  

Rather than relying on knowledge of past attacks, AI technology learns what is ‘normal’ for its environment, discovering previously unknown threats by detecting subtle shifts in behavior. Through identifying these unexpected anomalies, security teams can investigate novel attacks, discover blind spots, have live time visibility across all their physical and digital assets, and reduce time to detect, respond to, and triage security events.  

  • Achieve greater visibility of OT and IT devices across all levels of the Purdue Model.
  • The industry's only OT security to scale threat detection and response, with a 92% time saving from triage to recovery.  
  • The only OT focused security solution to provide bespoke Risk Management.

To learn more about how Darktrace/OT approaches unique use cases for industrial organizations visit the Darktrace/OT Webpage or join us LIVE at a city near you.

Read more below to discover how new innovations to Darktrace/OT are bringing a new, contextualized approach to Risk Management for Industrial organizations.

For more information on the entire Darktrace/OT Solution read our solution brief here.

Darktrace/OT and New Risk Management

Risk Identification

Leveraging the visibility of Darktrace/OT which identifies individual systems throughout the Purdue Model and the relationship between them, Darktrace/OT identifies high-risk CVEs and presents potential attack routes that go beyond techniques requiring a known exploit, such as misuse of legitimate services. Each attack path will have a mathematical evaluation of difficulty and impact from initial access to the high value objectives.  

Together this gives comprehensive coverage over your real and potential risks from both an attacker and known vulnerability perspectives. OT attack paths as seen here even leverage insights between the industrial and corporate communications to reveal ways threat actors may take advantage of IT-OT convergence. This revelation of imperceptible risks fills gaps in traditional risk analysis like remote access and insider threats.

Figure 1: Darktrace/OT visualizing the most critical attack paths at an organization
Figure 1: Darktrace/OT visualizing the most critical attack paths at an organization
Figure 2: A specific Attack Path identified by Darktrace/OT

Risk Prioritization

Darktrace/OT prioritizes remediations and mitigations based on difficulty and damage to your unique organization, using the established Attack Paths.

We ascertain the priorities that apply to your organization beyond pure theoretical damage answering questions like:

  • How difficult is a particular vulnerability to exploit considering the steps an attacker would require to reach it?
  • And, how significant would the impact be if it was exploited within this particular network?

This expanded approach to risk prioritization has a much more comprehensive evaluation of your organization's unique risk than has ever been possible before. Traditional approaches of ranking only known vulnerabilities with isolated scores using CVSS and exploitability metrics, often leaves gaps in IT-OT risks and is blind to legitimate service exploitation.

Figure 3: Darktrace/OT leverages its contextual understand of the organization’s network to prioritize remediation that will have the positive impact on the risk score

Darktrace provides mitigation strategies associated with each identified risk and the relevant impact it has on your overall risk posture, across all MITRE ATT&CK techniques.

What sets Darktrace apart is our ability to contextualize these mitigations within the broader business. When patching vulnerabilities directly isn’t possible, Darktrace identifies alternative actions that harden attack paths leading to critical assets. Hardening the surrounding attack path increases the difficulty and therefore reduces the likelihood and impact of a breach.

That means unpatched vulnerabilities and vulnerable devices aren’t left unprotected. This also has an added bonus, those hardening techniques work for all devices in that network segment, so apply one change, secure many.

Figure 4: Darktrace prioritizes mitigation reducing accessibility of vulnerability and the overall risk score when patches aren’t available

Communicate Board Level Risk with APT Threat Mapping

Darktrace/OT bridges theory and practice as the only security solution that maps MITRE techniques, frequently used by APT Groups, onto AI-assessed critical Attack Paths. This unique solution provides unparalleled insights including sector and location intelligence, possible operating platforms, common techniques, exploited CVEs, and the number of potential devices affected in your environment, supporting holistic risk assessment and proactive defense measures.

Ultimately, this becomes a power dashboard to communicate board level risk, using both metric based evidence and industry standard threat mapping.

Conclusion

Darktrace/OT is part of the Darktrace ActiveAI Security Platform a native, holistic, AI-driven platform built on over ten years of AI research. It helps security teams shift to more a productive mode, finding the known and the unknown attacks and transforming the SOC with the various Darktrace products to drive efficiency gains. It does this across the whole incident lifecycle to lower risk, reduce time spent on active incidents, and drive return on investment.

Discover more about Darktrace's ever-strengthening platform with the upcoming changes coming to our Darktrace/Email product and other launch day blogs.

Join Darktrace LIVE half-day event to understand the reality versus the hype surrounding AI and how to achieve cyber resilience.

Learn about the intersection of cyber and AI by downloading the State of AI Cyber Security 2024 report to discover global findings that may surprise you, insights from security leaders, and recommendations for addressing today’s top challenges that you may face, too.  

References

1. https://research-information.bris.ac.uk/ws/portalfiles/portal/313646831/Catch_Me_if_You_Can.pdf

Continue reading
About the author
Mitchell Bezzina
VP, Product and Solutions Marketing
Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

Iniziare la prova gratuita
Darktrace AI protecting a business from cyber threats.