Phân loại mối đe dọa theo NIST / MITRE ATT&CK / OWASP
1. Tấn công ứng dụng Web (OWASP Top 10 2021/2023)
| Thứ hạng | Tên tấn công | Mô tả ngắn | Phòng thủ chính |
|---|---|---|---|
| A01 | Broken Access Control | User truy cập tài nguyên ngoài quyền hạn (IDOR, path traversal, missing authz) | RBAC/ABAC, deny-by-default, test authorization unit/integration |
| A02 | Cryptographic Failures | Dữ liệu nhạy cảm không mã hóa/mã hóa yếu (HTTP, TLS 1.0/1.1, weak hash, hardcoded key) | TLS 1.3 everywhere, HSTS, AES-GCM/ChaCha20-Poly1305, Argon2id, Key Management (KMS/HSM) |
| A03 | Injection (SQLi, NoSQLi, Command, LDAP, XPATH) | Dữ liệu không tin cậy được thực thi như code/lệnh | Parameterized Query/Prepared Statement, ORM safe, Input Validation, WAF, Least Privilege DB user |
| A04 | Insecure Design | Thiếu threat modeling, secure design pattern, business logic flaw | Threat Modeling (STRIDE/PASTA), Secure Design Patterns, Code Review, Arch Review |
| A05 | Security Misconfiguration | Default cred, unnecessary features, verbose error, outdated SW, open cloud storage | Hardening (CIS Benchmarks), IaC Scanning (Checkov, tfsec), Automated Config Audit |
| A06 | Vulnerable & Outdated Components | Thư viện/framework/OS có CVE chưa vá | SBOM (CycloneDX/SPDX), SCA (Dependabot, Snyk, Trivy), Patch Management, Virtual Patching |
| A07 | Identification & Authentication Failures | Weak password, no MFA, session fixation, credential stuffing, weak recovery | MFA (FIDO2/WebAuthn), Argon2id, Rate limit, Secure Session Mgmt, Breached Password Check |
| A08 | Software & Data Integrity Failures | CI/CD không ký, auto-update không verify, deserialization không an toàn | SLSA, Sigstore/Cosign, Signed Commits/Releases, Integrity Check (Subresource Integrity) |
| A09 | Security Logging & Monitoring Failures | Thiếu log, log không đủ context, không alert, không retention | Structured Logging (JSON), Centralized SIEM, Alerting (Sigma), Audit Trail, Immutable Logs |
| A10 | Server-Side Request Forgery (SSRF) | Server fetch URL do user cung cấp → truy cập internal metadata/cloud API | Allowlist URL/IP, Deny private RFC1918/Loopback/Link-local, No redirect, Egress Proxy |
2. Tấn công mạng & Hạ tầng (Network & Infrastructure Threats)
- DDoS (Volumetric, Protocol, Application Layer): SYN Flood, UDP Amplification (DNS/NTP/CLDAP), HTTP Flood, Slowloris. Phòng: Cloud Scrubbing (Cloudflare, AWS Shield, Akamai), On-prem DDoS Appliance, Anycast, Rate Limiting.
- Man-in-the-Middle (MitM): ARP Spoofing, DNS Spoofing, HTTPS Stripping (SSLStrip), Evil Twin AP, BGP Hijack. Phòng: TLS 1.3 (HSTS, HPKP deprecated), Certificate Pinning, DNSSEC, DANE, 802.1X, VPN/ZTNA.
- Lateral Movement: Pass-the-Hash, Pass-the-Ticket, Kerberoasting, SMB Relay, RDP/SSH brute, Exploit (EternalBlue, PrintNightmare). Phòng: Micro-segmentation, Credential Guard, LAPS, Tiered Admin, PAM, EDR.
- Credential Theft: Phishing, Keylogger, Mimikatz (LSASS dump), Browser credential dump, GitHub/Config leak. Phòng: MFA (FIDO2), Passwordless, PAM, Secrets Management (Vault, AWS Secrets Manager), UEBA.
3. Mối đe dọa mới nổi (Emerging Threats 2024)
- AI/ML Attacks: Prompt Injection (LLM), Data Poisoning, Model Extraction, Adversarial Examples, Deepfake (Voice/Video) cho Social Engineering.
- Supply Chain: Dependency Confusion, Malicious Package (npm/PyPI/Maven), Compromised Build (SolarWinds, Codecov), CI/CD Poisoning.
- Cloud Native: Container Escape, K8s RBAC Misconfig, Cloud Metadata Service Abuse (IMDSv1), Serverless Event Injection.
- Identity-based: Golden SAML, Token Theft (Pass-the-Cookie), MFA Fatigue (Push Bombing), OAuth Device Code Phishing.
- Ransomware 3.0: Double/Triple Extortion (Encrypt + Exfil + DDoS + Harassment), RaaS (LockBit, BlackCat, Cl0p), Living off the Land (LotL).
4. Phân loại theo tác nhân (Threat Actor)
| Actor | Động cơ | Đặc điểm | Ví dụ |
|---|---|---|---|
| Nation-State (APT) | Spionage, Sabotage, Influence | Highly resourced, patient, 0-day, custom malware | APT29 (Cozy Bear), Lazarus, Equation Group |
| Cybercrime (Ransomware Gang) | Financial Gain | RaaS, Affiliate model, double extortion, speed | LockBit, BlackCat/ALPHV, Cl0p, Play |
| Hacktivist | Ideological/Political | DDoS, Defacement, Data Leak, Op- | Anonymous, Killnet, Cyber Partisans |
| Insider (Malicious/Negligent) | Revenge, Money, Mistake | Legitimate access, hard to detect | Snowden, Tesla sabotage, Accidental leak |
| Script Kiddie / Opportunistic | Notoriety, Easy target | Automated scanner, known exploit, low skill | Shodan scanner, Mass exploiter |
Chiến lược phòng thủ toàn diện (Defense in Depth)
- Identify: Asset Inventory (IT/OT/Cloud), Attack Surface Management (ASM), Threat Intel.
- Protect: Zero Trust (ZTNA, Micro-seg, MFA, Least Priv), Hardening (CIS Bench), Encryption (TLS 1.3, AES-256), Secure SDLC/DevSecOps, Supply Chain Sec (SBOM, SCA, Sigstore).
- Detect: SIEM/UEBA, NDR (Zeek), EDR/XDR, Cloud Detection (GuardDuty, Defender for Cloud), Threat Hunting (MITRE ATT&CK).
- Respond: IR Plan (NIST 800-61), SOAR Playbook, Containment (Network/Host/Identity), Forensics, Communication.
- Recover: Immutable Backup (3-2-1), DR Test, Ransomware Recovery, Post-Incident Review, Improve Controls.
Kết luận
Mối đe dọa Web & Mạng đa dạng, tiến hóa nhanh (AI, Supply Chain, Cloud, Identity). Không có "danh sách 3 việc làm xong". Cần chương trình an ninh liên tục dựa trên Framework (NIST CSF, ISO 27001, MITRE ATT&CK), tự động hóa (DevSecOps, SOAR), và văn hóa an ninh (People, Process, Technology).