Network Threat Identification: ระบุภัยคุกคามก่อนพัง
ไม่สามารถป้องกันสิ่งที่มองไม่เห็นได้ การ Identify (ระบุ) เป็นขั้นแรกของ NIST CSF และทุก Framework การรู้จัก "อะไรคือภัยคุกคาม" และ "มันดูอย่างไรบนเครือข่าย" เป็นพื้นฐาน
ประเภทภัยคุกคามเครือข่ายหลัก (Network Threat Categories)
| Category | ตัวอย่าง | ลักษณะบนเครือข่าย (Network Indicators) |
|---|---|---|
| Malware | Virus, Worm, Trojan, Ransomware, Cryptominer, RAT, Botnet Agent | C2 Beaconing (DNS/HTTP/HTTPS), Unusual Ports, Large Uploads, Lateral Movement (SMB/RPC), Disabled AV |
| Denial of Service (DoS/DDoS) | Volumetric (UDP Flood), Protocol (SYN Flood), Application (HTTP Flood), Yo-Yo | Traffic Spike, High Packet Rate, SYN/ACK Ratio ผิดปกติ, Resource Exhaustion (CPU/Mem/BW) |
| Unauthorized Access | Brute Force (SSH/RDP/VPN), Credential Stuffing, Pass-the-Hash, Kerberoasting, VPN Exploit | Failed Login Spikes, New User Creation, Privilege Escalation, Odd Hours/Geo Login, MFA Fatigue |
| Data Exfiltration | Large Transfer, DNS Tunneling, Cloud Storage Upload, Encrypted Archive, Steganography | Large Outbound Flows, Unusual Destinations, High Entropy Traffic, Long-lived Connections |
| Man-in-the-Middle (MitM) | ARP Spoofing, DNS Hijack, BGP Hijack, Rogue AP, SSL Strip, Certificate Impersonation | Duplicate MAC/IP, Certificate Warnings, Unexpected Redirects, TLS Downgrade |
| Reconnaissance/Scanning | Port Scan, Vuln Scan, Service Enum, DNS Zone Transfer, Cloud Metadata Access | High Connection Rate to Many Ports/IPs, ICMP Sweeps, Specific Payload Patterns |
| Insider Threat | Data Theft, Sabotage, Credential Sharing, Shadow IT, Unauthorized Cloud Sync | Large Access/Download, Off-hours Activity, Personal Cloud Upload, USB/Print Anomalies |
| Supply Chain / Third-Party | Compromised Vendor, Malicious Update, Dependency Confusion, CI/CD Poisoning | Unexpected Outbound from Build Server, New Binary Hash, Unsigned Code Execution |
วิธีการระบุภัยคุกคาม (Identification Methods)
1. Network Traffic Analysis (NTA/NDR) - เน้น Behavior
- Flow Analysis (NetFlow/IPFIX/sFlow): Volume, Top Talkers, Port Distribution, GeoIP, ASN
- Full Packet Capture (PCAP): Deep Inspection, Retrospective Analysis, Forensics
- Protocol Analysis: DNS (Tunneling, DGA, Fast Flux), HTTP (SQLi, XSS, C2), SMB (Lateral), TLS (JA3 Fingerprint, SNI Anomaly)
- ML/UEBA (User Entity Behavior Analytics): Baseline Normal → Detect Anomaly (Time, Volume, Destination, Protocol)
Tools: Zeek (Bro), Suricata, Arkime (Moloch), NetworkMiner, Wireshark, Darktrace, Vectra, ExtraHop, Corelight
2. Intrusion Detection/Prevention Systems (IDS/IPS)
- Signature-based (Snort/Suricata Rules): Known Attacks (CVE Exploits, Malware C2, Shellcode)
- Anomaly-based: Statistical Deviation, Protocol Violation
- Placement: Network Perimeter (TAP/SPAN), Internal Segmentation Points, Cloud (VPC Traffic Mirroring)
3. Log Aggregation & SIEM (Security Information Event Management)
- Collect: Firewall, Proxy, DNS, DHCP, VPN, AD/AD FS, CloudTrail, VPC Flow Logs, Endpoint (EDR), App Logs
- Correlate: Multi-source Rules (MITRE ATT&CK Mapping), Threat Intel Enrichment
- Alert: Real-time, Scheduled Searches, Risk-based Alerting (Reduce Fatigue)
- Tools: Splunk, Elastic (ELK), Microsoft Sentinel, IBM QRadar, LogRhythm, Graylog, Wazuh (Open Source)
4. Threat Intelligence Integration
- Strategic: Threat Actor Profiles, Campaigns, Geopolitical (CTI Reports)
- Tactical: TTPs (MITRE ATT&CK), Malware Analysis, Phishing Kits
- Operational (IOCs): IP, Domain, Hash, URL, Email, Certificate, ASN, JA3
- Technical: Vulnerability Details, Exploit Code, Detection Rules (Sigma, YARA, Snort)
- Feeds: AlienVault OTX, Abuse.ch, MISP, STIX/TAXII, Commercial (Mandiant, CrowdStrike, Recorded Future)
- Automation: TIP (Threat Intelligence Platform), SOAR, STIX Shifter
5. Vulnerability Management (Proactive Identification)
- Asset Discovery (Active Scan + Passive/Agent)
- Vulnerability Scanning (Authenticated > Unauthenticated) - Tenable, Qualys, Rapid7, OpenVAS, Nuclei
- Prioritization: CVSS + EPSS (Exploit Prediction Scoring System) + CISA KEV (Known Exploited Vulnerabilities) + Asset Criticality + Threat Context
- Remediation Tracking: Patch, Mitigate, Accept Risk (with Compensating Controls)
6. Threat Hunting (Proactive Human-driven)
- Hypothesis-driven: "Attacker อาจใช้ Living-off-the-Land Binaries (LOLBins) บน Server X"
- Data-driven: Anomaly ใน Data → Investigate
- Intel-driven: Threat Report → Hunt for TTPs ใน Environment
- Framework: MITRE ATT&CK, Diamond Model, Kill Chain
Risk Assessment: Likelihood × Impact
เมื่อเจอ Threat/Indicator ให้ประเมิน:
- Likelihood: โอกาสเกิดขึ้น (Threat Actor Capability, Vulnerability Exploitability, Exposure)
- Impact: ความรุนแรง (Data Sensitivity, Business Criticality, Regulatory, Reputational, Safety)
- Risk = Likelihood × Impact → Prioritize Response (Critical/High/Medium/Low)
สรุป Checklist: ระบุภัยคุกคามได้ไหม?
- ☐ มี Asset Inventory ครบ (Managed + Unmanaged + Cloud + IoT + OT)
- ☐ มี Network Visibility (TAP/SPAN/Mirror/NetFlow/Zeek) ครอบคลุมจุดสำคัญ
- ☐ มี IDS/IPS + NDR + SIEM ที่ Correlate ได้
- ☐ มี Threat Intelligence Feed เข้ามา Enrich Alerts อัตโนมัติ
- ☐ มี Vuln Management Process (Scan → Prioritize → Patch → Verify)
- ☐ มี Threat Hunting Team/Schedule (แม้ Part-time)
- ☐ มี IR Plan + Playbook สำหรับ Top Threats (Ransomware, Phishing, Insider, Cloud)
- ☐ ทดสอบการตรวจจับเป็นประจำ (Red Team, Purple Team, Breach & Attack Simulation - BAS)
Threat Identification ไม่ใช่จุดจบ แตเป็นจุดเริ่มต้นของการ Defend ต้องต่อเนื่อง อัตโนมัติ และมีมุมมองทั้ง Technical (IOC, TTP) และ Business (Risk, Impact)
