Iowa State University_CPR E MISC Microcontrollers and Digital Design Systems_ Installation of MITRE

downloaded from

Scholarfriends

https://scholarfriends.com Downloaded by: writerforacademic@gmail.com | https://scholarfriends.com/singlePaper/306315/iowa-state-university-cpr-e-miscmicrocontrollers-and-digital-design-systems-installation-of-mitre Distribution of this document is illegal.

Project Title: Installation of MITRE CALDERA (Att@ck framework) within the testbed environment and show its benefit in terms of attack-defense orchestration for sample attack defense use-cases.

Team Members: Matthew Johnson and Souradeep Bhattacharya Project Objective: The objective of this project is to implement the MITRE CALDERA (Att@ck framework) within the PowerCyber Testbed environment. The goal is to orchestrate the Lab experiments (Lab-1 to Lab-5, in addition to a DoS attack) within the Caldera environment.

The following experiments will be conducted: Experiment-1: Network Discovery with Active Scanning and Vulnerability Assessment Experiment-2a: Network Sniffing and Exploitation on DNP3 Payload – without firewall protection Experiment-2b: Network Sniffing and Exploitation on DNP3 Payload – with firewall protection Experiment-3: DoS attack on SCADA Server

Description of Implementation: Testbed: PowerCyber Testbed Protocol: DNP3 Platform/Tools: MITRE Caldera, Python Plugin Library for Caldera (Sandcat, Deploy, Stockpile, etc.)

Virtual Environment: KaliVM About Caldera: CALDERA (Cyber Adversary Language and Decision Engine for Red-team Automation), as a cybersecurity framework, can be used in several ways. It is built on the MITRE ATT&CK™ framework. The framework consists of two components: • The core system - This is the framework code, consisting of what is available in this repository.

Included is an asynchronous command-and-control (C2) server with a REST API and a web-based interface.

• Plugins - These repositories expand the core framework capabilities and providing additional functionality. Examples include agents, reporting, collections of TTPs and more.

Requirements: • Linux or MacOS operating system [KaliVM installed in PowerCyber Testbed will be utilized] • Python 3.7+ (with pip3) [Python library for Caldera Plugins available on GitHub] Applications: • Autonomous red-team engagements – Building a specific adversary threat profile and deploying in a network to see where it may be susceptible to attacks.

• Autonomous incident-response – Identifying TTPs that other security tools may not see or block Autonomous red-team engagements (Red Team Agent): This section describes the overall architecture of the red team agent and how it carries out cyber-attacks.

The primary objectives of the red team are: 1. Vulnerability assessments 2. Penetration Tests 3. Social Engineering

Log-in as RED User

Deploy an Agent to the system

Choose Adversery profile (e.g. Discovery or Hunter)

Create and Run an attack operation

Figure 1: Red Team Attack Scenario Schematic Diagram This study source was downloaded by 100000850872992 from CourseHero.com on 03-30-2023 18:12:38 GMT -05:00

https://www.coursehero.com/file/174991260/Project-Planpdf/

Review operation by running Abilities on deployed Agent

Export operation results

Autonomous incident-response (Blue Team Agent): This section describes the overall architecture of the blue team agent and how it carries out cyber defenses. The primary objectives of the blue team are: 1. Implementing controls 2. Security monitoring 3. Incident response

Log-in as BLUE User

Deploy an Agent to the system

Choose Defender profile (e.g. Incident Responder)

Choose a fact source to determine good v/s bad on a given host

Review operation by running Abilities on deployed Agent

Export operation results

Figure 2: Blue Team Defender Scenario Schematic Diagram

Description of Experimental Testing/Evaluation: The Caldera environment will be deployed with the PowerCyber Testbed to emulate the attack-defense scenario for the following experiments based on MITRE ATT&CK™ framework: Adversary Scenario: Experiment-1: Network Discovery with Active Scanning and Vulnerability Assessment ➢ MITRE Caldera environment will be used to scan the Control Center, Substation-1, Substation-2, and Substation-3 IP networks. ➢ Victim network information will be gathered, such as which IP addresses are actively in use as well as more detailed information about the hosts assigned to these addresses. ➢ Vulnerability scanning will be performed to check if the configuration of a target host/application potentially aligns with the target of a specific exploit the adversary may seek to use. ➢ Victim host information will be gathered that typically include running software and version numbers via server banners, listening ports, or other network artifacts.

Experiment-2a: Network Sniffing and Exploitation on DNP3 Payload – without firewall protection Experiment-2b: Network Sniffing and Exploitation on DNP3 Payload – with firewall protection ➢ MITRE Caldera environment will be used to capture and monitor the data packets transmitted over the network. ➢ It can capture packet data flowing on a network and identify many characteristics of the packet like protocol, packet size, source and destination address, packet function, etc. ➢ The captured DNP3 payload data will be exploited to initiate an RTU relay trip command to the connected relay for Substation 1 RTU and Substation 2 RTU. ➢ This attack scenario will be replicated with and without firewall protection and the observations will be compared.

Experiment-3: DoS attack on SCADA Server ➢ MITRE Caldera environment will be used to perform a Network Denial of Service (DoS) attack to degrade or block the availability of targeted resources on the SCADA server. ➢ DoS attack will be initiated using the Direct Network Flood technique by directly sending a highvolume of network traffic to the target. ➢ The network IP addresses, and host information obtained from active scanning carried out in Experiment-1 will be utilized to conduct the DoS attack.

This study source was downloaded by 100000850872992 from CourseHero.com on 03-30-2023 18:12:38 GMT -05:00

https://www.coursehero.com/file/174991260/Project-Planpdf/

Defender Scenario: ➢ Active scanning cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. ➢ MITRE Caldera environment will be explored further to determine defender strategies for all attack vectors mentioned above, wherever possible.

Expected Learning Outcomes: ➢ To get familiarized with MITRE ATT&CK™ framework and the adversary tactics and techniques based on real-world observations. ➢ To get familiarized with MITRE Caldera environment and demonstrate its benefits towards attackdefense scenario orchestration. ➢ To model an adversary who uses port scanning to gather information which can be used later for an attack and discover what hosts are alive on a network. ➢ To analyze the importance, severity and potential solutions related to existing vulnerabilities in a system. ➢ To demonstrate how captured data traffic could be exploited to execute relay trip commands. ➢ To develop defense strategies in order to mitigate above attacks, wherever possible.

References: [1] MITRE Caldera, (26th March, 2022), https://caldera.mitre.org/, https://caldera.readthedocs.io/en/latest/Getting-started.html [2] MITRE ATT&CK™ (26th March, 2022), https://attack.mitre.org/ [3] GitHub/mitre/caldera, (26th March 2022), https://github.com/mitre/caldera [4] J. D. Yoo et al., “Cyber Attack and Defense Emulation Agents,” Applied Sciences, vol. 10, no. 6, p.

2140, Mar. 2020, doi: 10.3390/app10062140.

This study source was downloaded by 100000850872992 from CourseHero.com on 03-30-2023 18:12:38 GMT -05:00

https://www.coursehero.com/file/174991260/Project-Planpdf/ Powered by TCPDF (www.tcpdf.org)