WIXLIB

Root Cause Analysis MethodsTable of ContentsRoot Cause Analysis Methods. 25 Whys. 45 Whys – Example . 5Another Approach. 8Ishikawa “Fishbone” Diagram . 10Fishbone – Example . 11Ishikawa “Fishbone” Diagram . 12Fishbone – Example . 13Next Steps . 16Using Root Cause Analysis Results. 17Notices . 19Page 1 of 19

Root Cause Analysis MethodsRoot Cause Analysis MethodsThere are many different approaches, methods, and techniques forconducting root cause analysis in other fields and disciplines.The analysis method used to identify the root cause(s) of acybersecurity incident depends on the circumstances of the incident the information that is available/discoverable your specific incident taxonomy and types/categories of causes(or threat vectors)Adapt your root cause analysis method to the incident beinganalyzed, as needed. You might use more than one method, or a hybrid approach.A cause analysis process can guide analysts through the multiplequestions and paths to identify the initiating cause(s) and threatvector(s) that enabled an attack to occur.[Distribution Statement A] This material has been approved for public release and unlimiteddistribution.12**012 So there are a variety ofdifferent approaches, methods,techniques that you can use forconducting root cause analysis, andwe can adapt some of the ones thatare used in other fields outside ofinformation security and see how wecan apply these to cybersecurityincident root cause analysis.So generally the analysis method isgoing to depend on specifically thetype of incident that we're looking at.Root cause analysis of a privilegedcompromise incident is going to bedifferent from a denial-of-serviceattack incident. So it depends on thetype of activity that's occurring, whatPage 2 of 19

information is available to analyze, oraccessible, or even in existence. Ifan intruder has gained privilegedaccess on a particular vulnerablesystem, they may have deleted ortampered with some of the logs orevidence or information that'savailable to analyze on that system.And then it's also going to depend,again, on your type of categories ofthe incidents or root causes or threatvectors in your particular process.So again, there's a variety of differentways, different approaches thatyou're going to need to adapt asneeded, depending on the type ofincident, and even some of theexamples that we used from otherfields here in this example, you mighthave to use a hybrid or combinationapproach depending on the specificcircumstances of that incident you'reanalyzing.So the most important thing iscoming up with some kind of processto help guide you or your analyststhrough the various questions thatthey need to address that areimportant to them for going to thenext step and providing anappropriate response and course ofactions to identify the underlyingcause of the particular threat thatallowed the incident to occur, andtherefore provide a follow-upresponse appropriate and relevant tothat particular underlying cause.Page 3 of 19

5 Whys5 WhysThe 5 Whys (a.k.a. Five Whys) method iteratively asks “Why ?” toidentify the root cause of a problem. This method is used in many cause analysis techniques,including the Analyze phase of Six Sigma.Continue asking “Why ?” questions until the root cause isidentified or until no further data/information is available (i.e., thecause is “unknown”). This method may require more or fewer than five iterations ofquestions, depending on the problem.To answer the Why questions, you often also need to answerrelated What and How questions (as well as Who and When).[Distribution Statement A] This material has been approved for public release and unlimiteddistribution.13**013 So one method that's beenused in a number of different fields iscalled the Five Whys approach, theFive Whys method, and basicallywhat it does is repeatedly, iterativelyasks the question why somethingoccurred until you can identify theultimate cause of the particularproblem. So this technique is used,like I said, in other areas, such as theSix Sigma, the Analyze phase, andbasically you just keep on askingthose questions until the cause iseither unknown or until you get tothe answer. And even though thetechnique is called Five Whys, that'sjust kind of a generalized number. Inmany cases, you may be able to getPage 4 of 19

to the answer in fewer than fiveiterations, or in many cases, it maytake more than five questions toaddress the particular type ofanswers for the root cause of thisparticular incident.And as we mentioned earlier, Toanswer some of these why questions,maybe you can reword these orparaphrase them, or they might berelated to the what and howquestions, or even sometimes thewho and the when.5 Whys – Example5 Whys – ExampleWhy did the SIEM tool alert?- It detected a large amount of outgoing PII data.Why was the PII data being sent?- The data was coming from a local desktop workstation.Why was the system sending PII?- It was a result of malware, running as a hidden process.Why was the malware running on the system?- Antivirus was disabled.Why was malware installed?- The user clicked on a link in a phishing email.[Distribution Statement A] This material has been approved for public release and unlimiteddistribution.14**014 So here's an example ofapplying the Five Whys approach to aPage 5 of 19

cybersecurity incident. Your securityincident and event management toolmight set off an alert, and the firstwhy is why did this alert go off, andthen looking at the details of it. TheSIEM alert detected some amount ofpersonally identifiable information,some data being exfiltrated or goingout, was detected by some rule set,and it set off this alarm.So then further analysis, diggingdown into why did this alert go off,was the threshold set correctly, andyou find that it was indeed a correctpositive and that data was comingfrom a local workstation within ournetwork and it set off this threshold,this trigger-- so then the nextquestion is why was this systemsending PII data, and upon furtheranalysis-- again, if those resourcesare available to you-- you mayeventually discover that the PII wasbeing sent by a hidden maliciouscode, malware process, that wasundetected, and this malwareprogram was actually sending out thePII data across the network.So the next question may be: Well,how did this malware get on there?Why was it running undetected onthe system? And further analysiswas that for some reason theantivirus program that was expectedto be running on this had beendisabled. Maybe it was part of theinstallation of the malware or someother process, or maybe the intrudermanually went in and disabled theantivirus product.Page 6 of 19

And then another why question is:Well, why or how did the malwareget installed in the first place? Andagain, further analysis of the differentdata sources, or perhaps talking withthe users involved, ultimatelyidentified that the user had clicked ona phishing email that they receivedthat contained a link, and byfollowing this link they unknowinglydownloaded and installed thismalware, which caused all the otherprocesses, which triggered the causeand effect, ultimately leading to theinitial detection of the SIEM toolsetting off the alert.So this is just one kind of simplifiedexample of how you might keep onasking questions until you eventuallyget to the underlying, initiating causeof the problem, so then you canaddress all the different phases, thedifferent steps in the process, to fullymitigate against the problem.Page 7 of 19

Another ApproachAnother ApproachAsk the 5W H (Who, What, Where, When, Why, How) questions: What happened?- Outgoing PII data was detected by the SIEM tool. Where did the traffic originate?- It originated on a local desktop workstation. Who/what was sending the data?- Malware, running as hidden process, sent the data. Why/how was malware installed?- The user clicked on a link in a phishing email.[Distribution Statement A] This material has been approved for public release and unlimiteddistribution.15**015 Another approach, using avariation of Five Whys, is maybe theFive W's: who, what, where, when,why, and how questions. So again,this is just a slight variation, butagain, asking questions to try toidentify a particular cause.So applying this approach to theprevious scenario: What happened?Well, there was PII data that wasdetected by your SIEM tool. Wheredid that particular traffic originate?In this case, the where, we'reidentifying it as a particular hostworkstation within our network. Whoor what was sending the data? Now,the who, the person, sometimes thisPage 8 of 19

may never be known fully.Attribution of who the intruders arecan often be difficult, and maybe thebest you can hope is you might beable to trace it back to a particular IPaddress or host name coming from alocation, and that may just be onelink in a chain of other systems thatthe intruder may have used. But inthis case, for what we're sending, is aparticular piece of malicious code,this malware that was sending thedata, and it was running as a hiddenprocess on the system.And then asking the question of howor why did the malware get installed,again, we come back to the answerthat it was due to user involvement.They received a phishing email andthey clicked on a malicious link inthere to install the malicious code.So that's applying a slight variation ofasking different questions to come toidentify the underlying root cause.Page 9 of 19

Ishikawa “Fishbone” DiagramIshikawa “Fishbone” DiagramThe Ishikawa diagram is also known as a cause-and-effectdiagram.The primary “bones” in the diagram are categories of relatedcauses.Each bone in the diagram can branch out into furthercategories/subdivisions, down to the specific root causes.For example, these are categories used in service industries: policies procedures people technology[Distribution Statement A] This material has been approved for public release and unlimiteddistribution.16**016 Another approach, usingother types of fields, sectors, andservice industries is called the causeand-effect, or Ishikawa, or fishbonediagram, and the reason it's called afishbone diagram, as we'll see in thenext slide, is it looks like the outlineof a skeleton of a fish. So theprimary bones in the particularcause-and-effect diagram arecategories of related causes, andthen each bone in that category canthen have subcauses and branch outinto further subdivisions and subtreesin this diagram, and depending on,again, how you define your differentthreats or causes--Page 10 of 19

Fishbone – ExampleFishbone – chnologyCausesEffect[Distribution Statement A] This material has been approved for public release and unlimiteddistribution.17**017 Will affect how youaddress or use this process.Page 11 of 19

Ishikawa “Fishbone” DiagramIshikawa “Fishbone” DiagramThe Ishikawa diagram is also known as a cause-and-effectdiagram.The primary “bones” in the diagram are categories of relatedcauses.Each bone in the diagram can branch out into furthercategories/subdivisions, down to the specific root causes.For example, these are categories used in service industries: policies procedures people technology[Distribution Statement A] This material has been approved for public release and unlimiteddistribution.16**016 In many service industries,an example is the high-level-- theydistinguish between different policies,procedures, people and technology,and then they have, underneath eachof these higher-level categories,different detailed subdescriptions onhow these different causes might beused to identify various effects.Page 12 of 19