Adversaries may gather information about the network trust dependencies of a victim. MITRE lists this under Reconnaissance with platform PRE. Such information includes second or third party organizations and domains, for example managed service providers and contractors, that have connected and potentially elevated network access.
How attackers use it
MITRE says the information may come from direct elicitation, such as phishing for information, or from accessible data sets such as open technical databases.
What the adversary learns can lead to more reconnaissance, to acquiring or compromising infrastructure, and to initial access through a trusted relationship. The attacker may choose to go through the provider instead of directly at you.
The same reasoning applies to your own suppliers as to your customers. If your access to a customer is a route to them, a provider's access to you is a route to you.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
The useful detection sits on the trusted paths themselves. Watch logins and sessions from provider accounts and addresses for changes in time, place, and behavior.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Keep a current list of every provider and contractor with network access, and the level of access they hold.
- Give providers only the access they need, with accounts you can disable and time limits where possible.
- Require strong authentication on all third party access.
- Review provider activity regularly, and remove access when a contract ends.
Quick check
What is a network trust dependency?
A second or third party, such as a managed service provider or contractor, with connected and potentially elevated network access.
Which initial access technique does MITRE connect it to?
Trusted relationship.
Sources
- MITRE ATT&CK, Network Trust Dependencies (T1590.003): https://attack.mitre.org/techniques/T1590/003
