Invalid security verification actions—how many of these are you guilty of?

Under the background of escalating information security threats, enterprises' demand for "combat-oriented" security defense has become more and more urgent. The Cybersecurity Law and the Cybersecurity Classified Protection Regulations have put forward strict "combat-oriented" requirements for enterprises. Combined with today's security situation, such requirements are reasonable and necessary. Therefore, cybersecurity validation has emerged as a fusion of technology, processes, and tools to validate what tactics, techniques, and attack methods potential attackers will adopt, as well as the actual response of the security defense system and processes. Through extensive market research, we found that although some enterprises are also conducting security validation, the results are still not ideal, turning security validation into an attractive but useless "showpiece". Actually, it's not that security validation is useless, but that the way it is conducted is incorrect. Ineffective security validation equals no security validation at all. Come and see how many of these pitfalls you have fallen into!

▍01 Scratching the Surface: Using Low-Quality Attack Samples

Just as it is best to practice with real questions before the college entrance examination, it is also best to use mock exams with real questions (real attack samples) for security validation. Seeing this, you might think that attack samples only need to meet the requirements of security validation — but that is exactly where the problem lies. Low-quality attack samples cannot perform true security validation:

• First, phishing attacks in many low-quality samples usually just use the action of creating a malicious attachment themselves, lacking the real malicious URLs or deceptive body text used by hackers. Therefore, they cannot reflect the reaction of email protection products to phishing attacks in real-world scenarios.

• Second, these samples perform a large amount of domain name resolution but lack a real connection-back process, failing to test the actual effect of DNS security defense. The biggest characteristic of connection-backs in real attacks is that they are random and multiple, whereas the connection-backs of these samples are usually just single simulations, which highly likely won't trigger alerts from security products.

• Third, file landing in many low-quality attack samples is just a formal operation lacking real malicious file execution, leading to a distorted evaluation of defense effectiveness. In particular, security products that perform threat detection based on behavior will have basically no response. The samples used by real hackers will be evasion-ready, but the subsequent real behaviors of samples that bypass security products will be preserved by hackers. It fails to validate whether the defense system can withstand those destructive, unrecoverable attack behaviors.

• Finally, low-quality attack samples, especially self-made samples (demo programs), yield validation results that inherently lack sufficient reference value. Even if mitigation and remediation are performed according to these results, there is still no guarantee that the optimized defense system can withstand real attack behaviors.

In summary, the practice of using low-quality attack samples for security validation cannot accurately reflect the actual defense capabilities of enterprises, and enterprises are unable to discover and patch real security weaknesses. To accurately evaluate an enterprise's defense capabilities, security validation must use high-quality, real attack samples. The Saixun Security Validation Platform collects a large number of attack methods from real threat groups and converts them into a validation action library that can be used for security validation. Through these real attack samples, enterprises can comprehensively evaluate their defense capabilities, reveal potential weaknesses in their defense systems, and patch them in a timely manner.

▍02 Armchair Strategist: Avoiding Real Attack Execution for Fear of Impact on the Production Environment

Above, we talked about using real attack samples. Some enterprises may worry that executing attacks with real samples will cause a heavy load or even damage their own security deployments. Therefore, they are reluctant to execute real sample attacks and settle for non-real sample attacks instead. Such caution is necessary, but unrealistic simulations actually have significant loopholes in their results, leading to:

1. Security Policy Blind Spots: Inability to identify and patch actual weaknesses in security policies.

2. Inadequate Emergency Response Drills: Employees lack perception and understanding of the entire emergency process of real attack events, making it difficult to understand how the four processes of response, containment, reporting, and recovery advance.

Considering the existence of such concerns, Saixun Validation has developed an isolated environment called a protected sandbox to ensure that the execution of real attack samples does not affect the actual production environment. The protected sandbox environment has strict network isolation, hard disk isolation, and rollback mechanisms, ensuring that the hazards of all sample files are controlled within the sandbox. Of course, the real execution of real samples also relies on the deep research of the samples by the security lab researchers, so as to know what execution parameters are required for it to run under what dependency environment.

Saixun Validation's unique playbook execution can directly reflect the entire attack process of hackers in real scenarios, with a one-to-one fully authentic replica. Through automated attack path analysis and simulation, it discovers the vulnerabilities of the system and the current shortcomings of security products, improving the team's emergency response and event attribution capabilities. Meanwhile, since there are no vulnerability target machines, enterprises do not need to worry about any actual damage to the system caused by the attacks. Through real attack validation, enterprises can fully discover and repair existing security weaknesses and improve their overall defense level.

▍03 Carving a Mark on the Boat to Find a Sword: Relying on Fixed Samples, Easily Outsmarted by Hackers

Hackers are not repeaters by nature, nor are they ruthless zero-day production machines. From an attacker's perspective, successful routines can be reused; when disclosed malicious files are blocked, they can bypass these blocks with minor adjustments. Although some low-quality attack samples also collect some real malicious files for landing, focusing only on the sample itself and the landing while ignoring subsequent behavior will lead to bigger problems:

1. "Thinking we've blocked it": An enterprise's security defense products may take automated static defense measures against disclosed malicious files, but attackers only need to modify the files to bypass these measures. Evaluating defense effectiveness solely through file landing is extremely inaccurate; in reality, it may fail to prevent attacks while giving a false signal of security.

2. "Thinking we've found the problem": Even if it is validated that the file landing was not blocked, it only allows for blocking that specific file. Repeated validation will still fall back into the false sense of security of "thinking we've blocked it".

The Saixun Security Research Team deeply tracks various APT groups, researching and analyzing their tactics and techniques, precisely to restore their real attack routines. We believe that empowering a security defense system also requires teaching it "how to fish".

The Saixun Security Lab regularly updates the attack library, providing ample ammunition for enterprise security validation, maintaining defense capabilities against the latest attack technologies, considering various variant attacks and evasion techniques, and comprehensively evaluating the effectiveness of the defense system to ensure that enterprise defense measures can cope with evolving threats.

▍04 Putting the Cart Before the Horse: Over-Focusing on Single-Point Security Products, Ignoring the Overall Defense System

The security defense system is a whole, and a hacker's attack chain is quite long, never a single point. Therefore, security validation does not just focus on the performance of a certain link, but on the performance of the entire system. Validating single-point security products can be a stage or link, but it is not the end of security validation. Overly focusing on the capabilities of certain single-point security products to validate whether they can defend against advanced and complex attack methods seems comprehensive, but in reality, it ignores that the attack itself is a systematic behavior with stages, processes, and context. This leads to the following problems:

1. Limitations of Single-Point Validation: Overly focusing on the effectiveness of individual security products while ignoring the coordination and effectiveness of the overall defense system.

2. Ignoring Attack Methods in the Lurking Stage: Either failing to think about why hackers can lurk in the target environment for a long time without being discovered, or believing that attack methods in the lurking stage do not have particularly great hazards and do not need attention.

3. Lack of Systematic Defense: Ignoring the cooperation of various security products and policies, failing to comprehensively evaluate the overall defense capability of the enterprise.

In fact, an attack is usually a complex process requiring coordination across multiple defense layers and policies. The overall management and operation of SIEM and SOC can ensure the coordination and effectiveness of the overall defense system. Combined with Saixun Validation's first-hand victim threat intelligence, continuous validation can demonstrate context-correlated full attack chain simulations to help defenders create more effective correlation analysis rules, which can greatly improve the speed of detection and response to hacker behavior in the lurking stage. Comprehensive defense evaluation should cover multiple levels of network, host, email, cloud, and business, implementing defense-in-depth strategies to improve overall defense depth and effectiveness.

▍Effective Security Validation Operations are All in the Saixun Security Validation Platform

In summary, it's not that security validation is attractive but useless, but that ineffective operations fail to make security validation exert its true value, resulting in a waste of resources instead. Saixun Validation has built a powerful security validation platform to assist the continuous development of enterprise security construction. Saixun Validation has also summarized key points of effective security validation for enterprises.

1. High-Quality Real Sample Execution: Use high-quality, real attack samples for simulation, and avoid validating only static protection methods through technical means to accurately evaluate the defense capabilities of enterprises. Through the validation action library of the Saixun Security Validation Platform, enterprises can use attack methods collected from real threat groups for validation, comprehensively revealing potential weaknesses in the defense system.

2. Harmless Attack Execution: When executing real attack samples, use an isolated environment like a protected sandbox to ensure that security validation is performed without affecting customer environments and assets. The protected sandbox environment has strict network isolation, hard disk isolation, and rollback mechanisms, ensuring that the hazards of all sample files are controlled within the sandbox while protecting the enterprise's production environment and business continuity.

3. Multi-Stage Attack Validation: Validation should cover all stages of the entire attack chain. Through multi-stage attack simulation, evaluate the performance of enterprises in each defense link, use security validation technology to automatically execute and analyze multi-stage attacks, and discover potential security weaknesses.

4. Attacker's Perspective: From the perspective of the attacker, identify and focus on key actions that can achieve the attack objectives. Discover potential security weaknesses and enhance defense strategies through attack path analysis tools.

5. Comprehensive Defense Evaluation: Evaluate and improve security defense capabilities from an overall perspective, rather than just single-point capabilities. Use a security assessment framework to comprehensively evaluate the enterprise's security posture, ensuring coordination and cooperation between various defense layers.

6. Regularly Update the Attack Library: In the selection of the attack library, while ensuring quality, there must be the ability to continuously update. By constantly updating and optimizing the attack library, ensure that it covers the latest attack techniques and strategies, and can reflect the latest threat intelligence related to threat groups and victims.

For more information about the Saixun Security Metrics and Validation Platform, please call our official number at 400-860-6366 or send an email to mkt@validations.cn to contact us. You can also scan the QR code below to add official customer service, and we will serve you wholeheartedly.