Written by Marten Cureton and Tom Sadler
The Pyramid of Pain was created by security professional, David J Bianco, in 2013, while he was threat hunting and working on incident response. The Pyramid ranks, in ascending order, the list of indicators used to detect an attacker’s activities and how much “pain” it will cause the attacker by denying these different indicators, as well as the effort and difficulty to find each indicator for the security analyst.
Using our Managed Detection and Response (MDR) services, as well as our Security Essentials, we can easily analyse good data from the logs created and find hash values, IP addresses and domain names quickly and efficiently.
Our MDR service also distinguishes malicious activities from legitimate ones by analysing the processes and referencing the MITRE ATT&CK framework, which allows us to better identify the tools, Tactics, Techniques and Procedures used by attackers. This helps to mitigate these risks from your networks and systems.
As the Pyramid of Pain suggests – the closer we get to the top, the harder it is to detect and convert that information into something actionable. Similarly, the closer we get to identifying the upper layers of the pyramid of pain, the more challenging it is for the attacker to modify that behaviour.
Within our Security Essentials and Managed Detection and Response (MDR) services we are equipped to recognise every layer of the pyramid of pain and utilise this intelligence to not only protect your organisation but make it increasingly more difficult for threat actors to compromise your network.
Our solutions operate across the networking and endpoint space, offering full estate visibility. In a case example where a threat actor may have compromised a device within your organisation, our service can quickly identify all layers of the pyramid.
While not all indicators are created equally, meaning that some are easier to identify and modify, other indicators are more challenging to change especially where an attacker may be solely relying on a particular tool or framework. The granular view of each event and the links to the MITRE ATT&CK framework that our services provide, make it easier for our analysts to spot these indicators and turn this information into actionable intelligence.
Once identified, we are then able to feed that intelligence back into your organisation and help you to understand how to mitigate further attacks and identify any risks that may have exposed you to the threat in the first place.
We are further able to utilise this intelligence to update our own services by creating new detection rules based on any layer of the Pyramid of Pain, making it increasingly difficult for an attacker to reuse the same methods in the future and reducing the probability of the same style of attacks being successful.
CRN Awards Winner 2021 - MSSP of the Year We’ve been challenging the status quo in Cyber Security since 2014 when 5 industry veterans decided they were fed up with the way technology was sold to companies by big businesses who walked away after they’d made their money. Our mission is simple: Put the customer and the technology first. What does that mean? It means that we always do the right thing for the customer and always recommend the right technology for the job, offering support from the first phone call, through to implementation and beyond. And it means we care. Because, for us, security isn’t just a tool you pay for and manage, it’s a mindset. It impacts every element of business life and needs to be respected as a key component of EVERY strategic conversation. We exist to enable businesses with secure technologies that enable growth, reduce risk and defend data. Pentesec is now part of The Charterhouse Group.