DEV Community

kozhevniko
kozhevniko

Posted on

Turn Your Exposure List Into an Incident Response Drill

#fortinet #incidentresponse #tabletopexercise #zoomeye

Turn Your Exposure List Into an Incident Response Drill

External attack surface data has a poor reputation inside many security teams. It arrives as a spreadsheet, gets filed, and is consulted once a quarter when someone asks whether the number went up. The CL-STA-0954 intrusion suggests a better use: take the list, assume a specific device on it was compromised, and see how far the response gets before it needs information nobody has.

The case is well documented. Unit 42 published its analysis on 14 October 2026, describing a September 2024 intrusion against a telecommunications managed service provider. Attackers exploited CVE-2024-47575 in a centralized FortiManager, exfiltrated configurations for more than 500 managed FortiGate firewalls, established unauthorized SSL VPN sessions to perimeter firewalls, and used CVE-2025-61624 through a FortiOS auto-script to deploy the memory-resident PEERSTITCH implant.

Building the drill from measured facts

A drill is only useful if its starting conditions are real. Start with what is measurable.

ZoomEye queries on 2026-10-22 for this article returned 38,987 assets for app="Fortinet FortiGate", 2,685,225 for app="FortiGate SSL VPN", and 1,181,307 for app="FortiGate SSL VPN" && port="10443". Query your own address space with the same fields. The result is a list of devices that anyone with a search engine can see, which is the correct starting population for the exercise.

Then write the scenario in five lines.

  1. One appliance from the external list is compromised as of 72 hours ago.
  2. Its configuration and administrator credentials are in an attacker's archive.
  3. The attacker opened one VPN session from an address you have not seen.
  4. The appliance stopped sending syslog eight hours ago.
  5. No alert fired for any of the above.

The questions the drill should answer

Four questions separate a team that can respond from one that can only escalate.

Who can produce the enrolled-device list. If the answer requires a login to a management appliance whose credentials may be in the stolen archive, the drill has found a real dependency problem.

What evidence survives a reboot. PEERSTITCH lives in memory and suppresses logs. If the response plan begins with restarting the appliance, the plan destroys the case. The drill should establish, in advance, who can take a memory snapshot and where it is stored.

Who can rotate certificates at scale. The stolen archive included certificates and private keys. Rotation of hundreds of device certificates is a project, not an action, and the drill should surface how long it actually takes.

Who notices silence. If no alert fires when an appliance stops logging, the drill should end with a named owner and a deadline for fixing that gap.

Where the external list stops helping

The measurements cannot tell you whether an appliance is patched, whether it is enrolled, or whether anyone still owns it. They also cannot see process memory or credential content. A drill that pretends otherwise becomes a planning exercise detached from evidence.

The honest use of external data is scoping and independence. It scopes the population that a real attacker could find, and it provides an observation channel that does not depend on the appliance's own logging, which in this case was deliberately degraded.

A short exercise that produces changes

Run the drill for ninety minutes with three participants: whoever owns the firewall estate, whoever owns identity and certificates, and whoever owns detection. Give them the five-line scenario and the four questions. Record every answer that begins with a version of we would have to check.

Those answers are the deliverable. Each one is a dependency that an intruder would exploit in exactly the same way CL-STA-0954 did: not by breaking cryptography or finding an unknown flaw, but by arriving at a device that everyone assumed someone else was watching.

Limits

This exercise is built from one published intrusion. It does not claim that any other Fortinet estate is compromised, and the counts above are product-asset measurements without version or tenancy detail. The drill's value comes from testing assumptions, not from predicting a specific attacker.

References

Top comments (0)