Web application vulnerabilities can stop any organisation in its tracks. After all, hackers infiltrate an incredible 30,000 websites every single day. And to make things even more concerning, web application attacks comprise around 26% of all data breaches. Luckily, blue teams are usually poised to defend against malicious actors, reducing the risk of hacks taking hold across an organisation’s complex systems.
So, if you want to become one of those knights in shining armour who defend an organisation's security team, stick with us. In this detailed guide, we'll discuss the blue team best practices you'll need to understand before embarking on a cyber security career. Whether you're intrigued by the ins and outs of vulnerability assessments or curious about SSL, you're in the right place!
Best practices for blue teams dealing with web hackers
Install SSL and security plugins
Having internet-exposed IP ranges and an insecure network can be a massive issue for security teams. So, to follow the best practices for blue teams, you'll want to make sure all SSL and security plugins are fully up to date.
By encrypting the data that travels between an end user and a web server, SSL disguises privileged information and prevents breaches. It also keeps the information private while reducing the risk of attack for web applications and sub-domains.
It also goes without saying that blue teamers will want to make sure all possible access points are secured with HTTPS and not HTTP. In HTTP, information shared over a website can be easily snooped on by hackers (which you don't want!). In short, one of the best practices for blue teams is simply boosting network security!
You can learn more about HTTP in detail here!
Keep web application firewall access controls properly configured
A Web Application Firewall (WAF) protects web applications by closely monitoring HTTP traffic. This firewall can protect against everything from file inclusion to cross-site scripting and SQL injections (AKA: some of the top web application vulnerabilities most organisations face!).
A WAF follows predefined rules, meaning security teams must carefully configure access controls to protect systems. With the proper guidelines, this firewall can spot suspicious activities and anomalies within web applications.
Regular updates, logging and monitoring the WAF, and continuously updating rules should keep things running smoothly. Just be warned that injection attacks for WAFs usually come through phishing links, meaning it's crucial to keep teams updated on what they shouldn’t click!
Implement SIEM solutions
If you're dealing with web-based software, it's an excellent idea for blue teams to implement Security Information and Event Management (SIEM) solutions. This tool collects data from endpoints and network devices across a company's system and stores it in a centralised location.
SIEM generally offers greater visibility across the whole network and alerts against the latest threats through early detection. A great SIEM solution also makes it easier to identify breaches and assess alerts (as log ingestion happens here in real time!).
The SIEM process is usually carried out by SOC analysts, who will utilise the results to identify false positives in data and identify blind spots in network visibility. By having better threat intelligence, patches can be made quickly and before vulnerabilities become critical.
If you’re interested in SIEM, why not run through our introduction to SIEM? It's easy and should give you the building blocks you need to progress in your blue team journey.
Perform regular vulnerability scans and assessments
Any penetration test will try to exploit existing issues in an organisation’s security makeup, but blue teams must constantly learn how to deal with new vulnerabilities. For that reason, it's crucial to perform regular vulnerability scans and assessments to stay on top of new threats.
Vulnerability scans will identify any issues in hardware and software, while assessments reduce the chances of an attacker breaching an organisation’s systems. Better yet, blue teams can work alongside red teams to uncover vulnerabilities and potential attack paths (this is known as purple teaming). By working collaboratively, blue teams can boost defences more easily and figure out what they may have missed in their initial scans.
Pair all this with excellent vulnerability management planning, and an organisation is essentially taking a “belt and braces” approach to all potential hacks.
Be prepared with excellent incident response tactics
Most blue teams will have an incident response contingent prepared to detect, contain, address, and eradicate a breach.
Web application attacks can be challenging to detect, but careful logging and continuous monitoring make it easier to spot suspicious activity. This can be as simple as repeated access attempts or as complex as large-scale hacks.
Once blue teams detect a breach, they can boost their Web Application Firewall to prevent further damage or isolate systems to contain the threat. Once the threat is under control, a ticket is created for developers to take action, and an incident recovery process starts to help restore normal service.
An organisation with a stellar incident response team can more readily stop a web attack in its tracks and is far less likely to suffer a disastrous breach.
If you’d like to learn more about security risks on the web, our Intro to Web Application Security module is a great place to start. It takes just 90 minutes to complete, and it covers theory AND a practical task that allows you to investigate a vulnerable website. Talk about diving in at the deep end!
Be proactive and create a company-wide security culture
Blue team best practices are all about being proactive, as they reduce the chance of threats and take the pressure off the organisation’s security infrastructure.
The best thing you can do to prevent threats is by working the following things into an organisation's threat management system:
· Email Threat Detection: Phishing is a huge issue for all organisations, and an estimated 3.4 billion spam emails are sent every day. As 91% of all cyber attacks start with a phishing email to an unsuspecting person, creating a company-wide understanding of web threats is critical.
· Endpoint Protection: If you're dealing with web hackers, you must secure your systems from all angles. From firewalls to antivirus measures and secure domains, you'll need to lock down everything and make it tricky to access to prevent a breach.
· Multi-Factor Authentication (MFA) and Privilege Controls: Strong passwords are essential, but skilled hackers can break through even the most robust encryption to uncover credentials. So, it's always worth using Multi-Factor Authentication to reduce the chance of malicious actors accessing files.
However, the most important thing you can do is ensure all employees understand the importance of cyber awareness. Whether through regular training, briefings, or reminder emails, keeping everyone on the same page if you're part of a blue team is vital!
Launch TryHackMe for Blue Teams!
Although you may want to specialise in blue team practices, it is always a good idea to have a broad knowledge of all types of defensive blue team tactics.
Our SOC Level 1 learning path introduces you to a wide array of tools and real-life analysis scenarios in defensive security. Trust us, any organisation is bound to value that hands-on experience!
Ben Spring