{"id":33764,"date":"2020-03-10T14:00:00","date_gmt":"2020-03-10T14:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/how-network-metadata-can-transform-compromise-assessment\/a\/d-id\/1337208"},"modified":"2020-03-10T14:00:00","modified_gmt":"2020-03-10T14:00:00","slug":"how-network-metadata-can-transform-compromise-assessment","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-network-metadata-can-transform-compromise-assessment\/","title":{"rendered":"How Network Metadata Can Transform Compromise Assessment"},"content":{"rendered":"
<\/div>\n
\n<\/header>\n

Listen more closely and your network’s metadata will surrender insights the bad guys counted on keeping secret<\/span> <\/p>\n

In the 1979 cult classic When a Stranger Calls<\/em>, a babysitter receives numerous telephone calls from a strange man, only to discover the calls are coming from inside the house!<\/em><\/p>\n

Indeed, the notion of a stranger lurking inside your home is terrifying. For the modern enterprise, however, it has become the new normal. Even more frightening, most businesses have no idea that their network has been compromised in the first place.<\/p>\n

According to an IBM study, it takes the typical enterprise 197 days to identify a breach<\/a> in its network and 69 days to contain it. Despite the profusion of network monitoring and traffic analysis tools on the market today, security teams are unable to distinguish the faint signal of a legitimate network incursion over the din of perpetual alerts.<\/p>\n

But as any TV detective will tell you, a criminal always leaves something behind. And just like a CSI forensics team might use luminol to detect trace amounts of blood at a crime scene, security analysts can harness the vast amount of network metadata to identify and isolate a network compromise.<\/p>\n

The Medium Is the Message<\/strong>
Taking the metaphor of a house a step further, doors and windows represent both points of ingress and egress for a potential intruder. Network IP addresses, proxy servers, and email boxes are the doors and windows of the enterprise network that digital prowlers exploit to gain access and exfiltrate data. But because these intruders must use the network itself, they also can’t help but leave traces of their presence in the form of network metadata.<\/p>\n

Metadata is often defined as data about data, or information that makes data useful. Every digital photograph includes metadata that offers detailed information about the photo \u2014 when it was taken, the type of camera used, even its GPS coordinates, all attached to the digital file as metadata, providing us with a simple way to sort and organize our photo libraries.<\/p>\n

Similarly, metadata is attached to the many various hardware devices and software that every network infrastructure needs to run. From email and application servers to network firewalls and cloud gateways, the attendant metadata of each system provides a strand of telling information. On its own, that individual thread of data may not tell you very much. But put enough of those dots together and take a step back, a clear picture begins to emerge.<\/p>\n

Converting Network Metadata into Useful Intel<\/strong>
For security teams, network metadata represents a vital yet underutilized threat intelligence resource that analysts must begin to incorporate into their compromise detection toolbox. Some of the primary sources of network metadata that can be correlated into actionable threat intelligence include:<\/p>\n