Current events have caused a sudden shift in the threat landscape. Business continuity and adapting to new remote working environments have been pivotal. Now that the big changes have occurred and enterprises are settling into the new normal, it has never been more relevant to ask the most important question in cybersecurity: Has my network infrastructure already been compromised? Luckily, by unlocking the value of the network metadata already at your fingertips, you can answer this question quickly and easily.
DNS
All data breaches, both novel and traditional, have a common denominator: the threat actor must navigate via the host system’s infrastructure. Therefore, they leave behind a trail of evidence that can be followed in your metadata. The most important of these is DNS. When a system is compromised through a phishing attack or malware, the adversary will try to resolve a domain to receive instructions or to exfiltrate information. If there is a collision of DNS data with an indicator of compromise, the conclusion is evident: your network infrastructure has been compromised.
Proxy and Firewall Logs
If the attack does not rely on DNS queries, its only other option is to use an IP address. The evidence of such a compromise can be found by analyzing the access logs of firewalls and proxies.
Network Flows
Analyzing the behavior of an adversary within the network reveals much about the nature and intention of the attack. These details can be gleaned by analyzing lateral network flows.
Spambox
Spambox emails, by definition, are contained. This is good, but they can reveal a lot about how adversaries are targeting an enterprise and its users. Stopping spam is good, but analyzing it is even better because it is a source of intelligence unique to your organization.
When these network metadata are correlated, businesses will learn the degree of success that threat actors are achieving in compromising systems. For more information on Lumu’s data collection approach be sure to see our video on the subject.
It’s never a bad time to ask “Has my network been compromised?” but the best time to answer it is now. Sign up for a Lumu Free account today.
