Above: Feedback from the field
CIOs, CISOs, or managers often ask us what best practices they should follow to protect themselves effectively and quickly.
The first piece of advice I give them is to identify the risks and establish a simple organizational structure (CISO, DPO, PSSI) tailored to how the organization operates.
Over the past 14 years at ITrust, we’ve had the opportunity to form our own views on best practices, aligning them with those identified by ANSSI, ENISA, and SANS. We have certain convictions, and we wanted to validate them through a small-scale study based on independent, recognized standards.
The study is simple. We examined each of the attack techniques used by hackers, malware, insiders, and malicious actors, and we assessed whether the attack method was detected and thwarted by various technologies: Does antivirus software detect a privilege escalation? Does a firewall detect a C&C server used by Emotet? Etc. …
To ensure greater realism, we reviewed two well-researched studies by RedCanary and Dark Reading that evaluate the most commonly used attack techniques in recent attacks in 2020.
These conclusions are then compared with our real-world experience. We have identified the attack techniques that ITrust detects among its customers or within its network during the most significant attacks or those that have the greatest impact on the company.
We have discussed this analysis with our engineers and have reached a conclusion.
Here is the Mitre matrix showing the coverage rate by technology type.
We did the same thing for antivirus, firewall, SIM, etc.
For each type of protection technology, we have shown its percentage of coverage for the various MITRE attack techniques. In the following columns, we have identified their coverage based on their ability to detect the 10 and 3 most commonly used techniques currently employed by hackers and malware. Finally, in the last column, we identify their coverage rate based on the most dangerous attacks (APT, ransomware, etc.) as assessed by ITrust’s red team and Threat Hunting teams.
Graph 1: Number of Mitre techniques covered
Graph 2: MITRE Techniques Covered, Among the 3 Most Dangerous
Graph 3: MITRE Techniques Covered, Among the 10 Most Commonly Used by Pirates/Hackers 
Here is the summary:We note the virtually nonexistent coverage rate for firewalls and antivirus software (even though they are essential for protecting against the most basic risks. We repeat: it is necessary to have a firewall and antivirus software!)
An EDR alone has a detection rate that is promising but will rarely be able to fend off advanced attacks.
The best coverage rate is achieved withSOC, SIEM, UEBA, and TH. According to the RedCanary study, adding an EDR increases the detection rate by 10%.
Feedback and data analysis also indicate that an anti-phishing/anti-spam solution is highly complementary. It does not appear in this table.
The “classic” reactive SIEM—without UEBA, artificial intelligence, or threat hunting—does not protect against the attacks that have the greatest impact.
Cybersecurity: Protection Rates for Different Types of Technology, According to Recent Studies – 2020 / ITrust Analysis
MITRE Matrix Awards
MITRE Matrix Rankings by ITrust
What’s in it for me?
Traditional antivirus and firewall tools are no longer sufficient to protect against 2% of modern attacks
ASOC(Security Operations Center) equipped with a UEBA SIEM offers the best detection efficiency against current attacks and, more broadly, the best coverage rate.
Supplementing a UEBASOCwith EDR and anti-phishing solutions is advisable. Supplementing aSOCwith a vulnerability scanner has become essential.
Based on the experience of ITrust engineers, the recommended solution for any type of company to protect itself is as follows:
– a simple risk analysis (simplified Ebios RA)
– a tailored SIP (Security Policy), regularly reviewed and improved through a quality cycle
– a CISO (Cybersecurity Manager)
– a managedSOCincluding a UEBA and SIEM, along with a continuous vulnerability scanner and an anti-phishing solution,
constitutes a protection package that will provide a very high level of protection for a company (estimated at 100%. This 100% is a dangerous figure because we know that such a level is never guaranteed. I would therefore say 99%).
It is advisable to regularly conduct intrusion audits and awareness training, to partition the information system based on the results of the risk analysis, to use European cybersecurity tools, and to host sensitive data with European cloud providers using European tools and software. Monitoring the dark web and news about cybersecurity vulnerabilities, as well as contacting a CERT, is beneficial and helps round out the protection in a meaningful way.
Becareful not to fall into the classic traps: a SIM is not a SIEM, a next-generation antivirus is not an EDR (it only detects known patterns, unlike an EDR), an XDR is not aSOC, …
Beware of cybersecurity insurance—it does not cover a large number of hacking cases and is not yet very mature. It will be worth looking into in two years.
Be aware that 70% of currentSOCsdo not detect new threats, notably for the reasons mentioned here, but also because of a lack of implementation ofeffectivemonitoring, escalation, and communication processes between teams. According to itrust experts,effectiveprocesses account for 50% of success.
For the record, a typical cybersecurity budget accounts for 7% to 13% of the IT budget (depending on the type of company and the industry). With a smaller budget, it is impossible to guarantee anything.
That’s it—it couldn’t be simpler or more effective. Thank you to the Itrust engineers and our customers for this feedback.
Some of the information presented in this article is factual, as it is supported by independent studies; other information consists of interpretations or opinions from our consultants and experts, which we are happy to discuss. It’s worth noting that we encourage all companies to equip themselves with at least an antivirus and a firewall and to conduct a risk analysis to identify the assets and activities that need protection. We don’t try to protect everything; we try to make it difficult to access what is valuable.
The goal is for the attacker to target someone else who is less protected and who will require less effort to breach.
