SlideShare ist ein Scribd-Unternehmen logo

Adversary Playbook Tactical Assessment of Protection Techniques

•
•
J
Justin Berman

Integrating threat intelligence into security programs in order to increase accuracy and practicality of control selection.

Technologie
1 von 44
Downloaden Sie, um offline zu lesen
Adversary Playbook Tactical Assessment of Protection Techniques Julian Cohen Justin Berman
Julian Cohen | @HockeyInJune | http://hake.co/ ● Product Security | Flatiron Health ● Founder | http://playbook.delivery/ Previously ● Application Security | Financial Services ● Vulnerability Researcher | Defense Contracting ● Penetration Tester | Boutique Consulting ● Educator | Universities
Justin Berman | @justinmberman ● Head of Security | Flatiron Health Previously ● Head of Security Architecture | Financial Services ● Principal Consultant | Boutique Consulting ● Application Developer | Hi-Tech
https://thumbs.dreamstime.com/z/silhouettes-business-people-data-concepts-41633119.jpg Concepts
https://www.nettitude.com/uk/eight-things-to-consider-before-deploying-cyber-threat-intelligence/ https://medium.com/@HockeyInJune/playbook-based-testing-5df4b656113a Threat Intelligence ● Not hashes and IP address ● Actionable tactics and procedures ● Motivation, resourcing, strategies ● Expertise to distill and apply intelligence
Attacker Cost ● The cost of an attack is the minimum of cost times the success rate ● Cost factors ○ Expertise ○ Time ○ Money ○ Resources ● Success factors ○ Target ubiquity ○ Probability ○ Access https://trailofbits.files.wordpress.com/2011/08/attacker-math.pdf
Attacker Value All attackers are resource constrained — @dinodaizovi All attackers have a boss and a budget — @philvenables Repeatability: The capability to change the target and have the attack still work with the same success rate Scalability: The capability to launch the attack against multiple targets with minimal cost per additional target https://medium.com/@HockeyInJune/playbook-based-testing-5df4b656113a
Attacker Efficiency Attackers determine the least costly and most valuable attacks based on Who are the targets Required success rate Speed of conversion
Common Attacks Inexpensive, valuable, scalable, or repeatable: Phishing Credential reuse Known vulnerabilities with public exploits Office macros Spyware Vendor compromise Costly, valueless, unscalable, or unrepeatable: Web vulnerabilities 0-day exploits Known vulnerabilities without public exploits Embedded devices Crypto weaknesses Insider threat
Lockheed Martin’s Intrusion Kill Chain ● Eric M. Hutchins, Michael J. Cloppert, Rohan M. Amin, Ph.D. ● 6th International Conference Information Warfare and Security (ICIW 11) https://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf
Offensive Experience ● Attacker constraints ○ Resourcing, expertise, time ● Political constraints ○ Management ● Motivations ○ Military, financial, political ● Research and development ○ Pipelines, iterations, constraints http://www.cyberwar.news/wp-content/uploads/sites/32/2015/10/china_cyberwar.jpg
Integrating Concepts Into Programs
The Cycle The OODA Loop as Applied To A Security Program ● Observe - Collect Intelligence ● Orient - Model Threats ● Decide - Prioritize ● Act - Design and Build
Observe and Orient - The Traditional Way
Building Intrusion Kill Chains ● Analyze existing intelligence ○ Reports, news, breaches ● Analyze whitehat research ○ Presentations, reports, tools ● Collect intelligence ○ Honeypots, scanners, logging ● Understand motivations and resourcing ○ Military, criminal, political ● Use expertise to build theories ○ From experience, breaches, and research
● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory Intrusion Kill Chain https://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf
Intrusion Kill Chain Phase Detect Deny Disrupt Degrade Deceive Destroy E-mail harvesting Fake employee Policy Policy Fake employee Office macros Kill whitehats Hack Phishing Mail gateway Mail gateway Mail gateway Training Target runs macro EPP EPP Macros off No local admin Sandbox Poison Ivy EPP EPP EPP Sandbox Sandbox Poison Ivy NIDS Firewall NIPS Web proxy Sandbox Pivots to active directory Logging 2-factor auth SMB signing Segmentation Honeypot Key: EPP: Endpoint Protection Platform NIDS: Network Intrusion Detection System NIPS: Network Intrusion Prevention System SMB: Server Message Block Protocol
Observe and Orient - Integrating Intelligence
Observe and Orient - Integrating Intelligence
Observe and Orient - Integrating Intelligence
Decide - Traditional
● SQL Injection Vulnerability ● Authenticated ● VPN ● Sensitive Data ● Yields: Full Database Access ● High Impact, Low Likelihood CVSSv3: 7.7 Unlikely to occur Likelihood Versus Impact ● PDF Memory Corruption Vulnerability ● Commercial Software ● Support Staff ● Customer Data ● Yields: Some Data and Foothold Machine ● Low Impact, Medium Likelihood CVSSv3: 6.7 Likely to occur ● Conclusion: Treat everything as High Impact, most issues should be scored on Likelihood https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Financially-motivated, medium-resourced group Resources focused towards what’s necessary Strategy: Collect credit card numbers State-sponsored, well-resourced group Resources focused towards target set Strategy: Attack everyone and wait
Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Common Tactics Key: White: Shared attacks
Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Attacker Cost (Likelihood) Key: Red: Low-cost to attacker, high likelihood of attack
Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Cost to Change (Future Likelihood) Key: Red: High-cost to change, high likelihood of attack
Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Key: Green: Low-cost to defend Defender Cost
Intrusion Kill Chain Phase Detect Deny Disrupt Degrade Deceive Destroy E-mail harvesting Fake employee Policy Policy Fake employee Office macros Kill whitehats Hack Phishing Mail gateway Mail gateway Mail gateway Training Target runs macro EPP EPP Macros off No local admin Sandbox Poison Ivy EPP EPP EPP Sandbox Sandbox Poison Ivy NIDS Firewall NIPS Web proxy Sandbox Pivots to active directory Logging 2-factor auth SMB signing Segmentation Honeypot Key: EPP: Endpoint Protection Platform NIDS: Network Intrusion Detection System NIPS: Network Intrusion Prevention System SMB: Server Message Block Protocol Key: Green: Low-cost to defender Red: High-cost to attacker
Decide - Integrating Intelligence
Act - Traditional
● Message authenticity, signatures, and intelligence feeds ○ Bottom 20% attackers use blacklisted domains, fingerprintable templates, known malware ● Sanity checks and heuristics ○ Next 30% of attackers use new domains, obvious templates, unknown malware ● Sandbox for attachments and links ○ Next 30% of attackers use techniques designed to bypass common protections ● Difficult to detect sandbox ○ Next 15% of attackers use sandbox evasion techniques ● Top 5% of attackers will bypass the mail gateway Attacker Efficiency
Act - Integrating Intelligence Financially-motivated, medium-resourced group Resources focused towards what’s necessary Strategy: Collect credit card numbers State-sponsored, well-resourced group Resources focused towards target set Strategy: Attack everyone and wait
Demonstrate Success
The Challenge
● Do we know the set of attackers that are relevant for our organization? ○ Are these right attackers? ○ Have we enumerated their playbooks? ○ Are their playbooks accurate? Key Question 1
Key Question 2 ● Are we able to defend against the playbooks we are focused on? ○ Have we tested that?
Key Question 3 ● Have we effectively prioritized existing gaps against the most likely attackers? ○ Are we making reasonable progress towards reducing risk? ○ Do we have enough resources allocated to these efforts?
Key Question 4 ● Are we accurately and effectively predicting future changes? ○ When and who will become new attackers in the future? ○ Which and when will attacker playbooks change?
Combat Common Issues
Objective and Easy To Analyze Data Is Hard To Get
Diverges From Management Comfort Zones
What about Regulations?
Shortage of Talent Capable of Executing
We’re Hiring! security@flatiron.com

Empfohlen

Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wireInfoSec Addicts
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightDeep Shankar Yadav
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philAPhil Agcaoili
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Threat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk ProgramsThreat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk ProgramsRahul Neel Mani
 
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptxChi En (Ashley) Shen
 

Empfohlen

Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wireInfoSec Addicts
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightDeep Shankar Yadav
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philAPhil Agcaoili
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Threat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk ProgramsThreat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk ProgramsRahul Neel Mani
 
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptxChi En (Ashley) Shen
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityPanda Security
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceMarlabs
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
Careers in Cyber Security
Careers in Cyber SecurityCareers in Cyber Security
Careers in Cyber SecurityDeep Shankar Yadav
 
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...PROIDEA
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat IntelligenceSirius
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Mark Arena
 
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...Albert Hui
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat IntelligenceNTT Innovation Institute Inc.
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...Mark Arena
 
Battlefield network
Battlefield networkBattlefield network
Battlefield networkTal Be'ery
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence programMark Arena
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersInfosec
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...Mark Arena
 
Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat IntelligenceOWASP Delhi
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in securityOsama Ellahi
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE - ATT&CKcon
 
The Risks of YOLOing-2.pdf
The Risks of YOLOing-2.pdfThe Risks of YOLOing-2.pdf
The Risks of YOLOing-2.pdfHacken
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Chi En (Ashley) Shen
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Spyglass Security
 
CSW2022_08_behaviours.pptx.pdf
CSW2022_08_behaviours.pptx.pdfCSW2022_08_behaviours.pptx.pdf
CSW2022_08_behaviours.pptx.pdfSaraJayneTerp
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsIain Dickson
 

Weitere ähnliche Inhalte

Was ist angesagt?

What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityPanda Security
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceMarlabs
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...PROIDEA
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat IntelligenceSirius
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Mark Arena
 
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...Albert Hui
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...Mark Arena
 
Battlefield network
Battlefield networkBattlefield network
Battlefield networkTal Be'ery
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence programMark Arena
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersInfosec
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...Mark Arena
 
Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat IntelligenceOWASP Delhi
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in securityOsama Ellahi
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE - ATT&CKcon
 
The Risks of YOLOing-2.pdf
The Risks of YOLOing-2.pdfThe Risks of YOLOing-2.pdf
The Risks of YOLOing-2.pdfHacken
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Chi En (Ashley) Shen
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Spyglass Security
 

Was ist angesagt? (20)

What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
 
Careers in Cyber Security
Careers in Cyber SecurityCareers in Cyber Security
Careers in Cyber Security
 
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...
 
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...
 
Battlefield network
Battlefield networkBattlefield network
Battlefield network
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence program
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...
 
Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat Intelligence
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in security
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
 
The Risks of YOLOing-2.pdf
The Risks of YOLOing-2.pdfThe Risks of YOLOing-2.pdf
The Risks of YOLOing-2.pdf
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
 

Ähnlich wie Adversary Playbook Tactical Assessment of Protection Techniques

CSW2022_08_behaviours.pptx.pdf
CSW2022_08_behaviours.pptx.pdfCSW2022_08_behaviours.pptx.pdf
CSW2022_08_behaviours.pptx.pdfSaraJayneTerp
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsIain Dickson
 
Information security - what is going on 2016
Information security - what is going on 2016Information security - what is going on 2016
Information security - what is going on 2016Tomppa Järvinen
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsSpyglass Security
 
Cyber Security - awareness, vulnerabilities and solutions
Cyber Security - awareness, vulnerabilities and solutionsCyber Security - awareness, vulnerabilities and solutions
Cyber Security - awareness, vulnerabilities and solutionsinLabFIB
 
Security .NET.pdf
Security .NET.pdfSecurity .NET.pdf
Security .NET.pdfAbhi Jain
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
CSW2022_01_introduction.pptx.pdf
CSW2022_01_introduction.pptx.pdfCSW2022_01_introduction.pptx.pdf
CSW2022_01_introduction.pptx.pdfSaraJayneTerp
 
CanSecWest_cogsec_course_01_introduction.pdf
CanSecWest_cogsec_course_01_introduction.pdfCanSecWest_cogsec_course_01_introduction.pdf
CanSecWest_cogsec_course_01_introduction.pdfSaraJayneTerp
 
Cybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsCybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsSecureDocs
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfssuser4237d4
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfssuser4237d4
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingAPNIC
 
The 2019 Security Strategy
The 2019 Security StrategyThe 2019 Security Strategy
The 2019 Security StrategyCloudflare
 
Today's Cyber Challenges: Methodology to Secure Your Business
Today's Cyber Challenges: Methodology to Secure Your BusinessToday's Cyber Challenges: Methodology to Secure Your Business
Today's Cyber Challenges: Methodology to Secure Your BusinessJoAnna Cheshire
 
Evolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootConEvolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootConJorge Orchilles
 
Today's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About ItToday's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About ItResilient Systems
 
Setting up CSIRT
Setting up CSIRTSetting up CSIRT
Setting up CSIRTAPNIC
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 

Ähnlich wie Adversary Playbook Tactical Assessment of Protection Techniques (20)

CSW2022_08_behaviours.pptx.pdf
CSW2022_08_behaviours.pptx.pdfCSW2022_08_behaviours.pptx.pdf
CSW2022_08_behaviours.pptx.pdf
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
 
Information security - what is going on 2016
Information security - what is going on 2016Information security - what is going on 2016
Information security - what is going on 2016
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
 
Cyber Security - awareness, vulnerabilities and solutions
Cyber Security - awareness, vulnerabilities and solutionsCyber Security - awareness, vulnerabilities and solutions
Cyber Security - awareness, vulnerabilities and solutions
 
Security .NET.pdf
Security .NET.pdfSecurity .NET.pdf
Security .NET.pdf
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
 
CSW2022_01_introduction.pptx.pdf
CSW2022_01_introduction.pptx.pdfCSW2022_01_introduction.pptx.pdf
CSW2022_01_introduction.pptx.pdf
 
CanSecWest_cogsec_course_01_introduction.pdf
CanSecWest_cogsec_course_01_introduction.pdfCanSecWest_cogsec_course_01_introduction.pdf
CanSecWest_cogsec_course_01_introduction.pdf
 
Cybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsCybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From Cyberthreats
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & Handling
 
The 2019 Security Strategy
The 2019 Security StrategyThe 2019 Security Strategy
The 2019 Security Strategy
 
Today's Cyber Challenges: Methodology to Secure Your Business
Today's Cyber Challenges: Methodology to Secure Your BusinessToday's Cyber Challenges: Methodology to Secure Your Business
Today's Cyber Challenges: Methodology to Secure Your Business
 
Evolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootConEvolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootCon
 
Today's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About ItToday's Breach Reality, The IR Imperative, And What You Can Do About It
Today's Breach Reality, The IR Imperative, And What You Can Do About It
 
Setting up CSIRT
Setting up CSIRTSetting up CSIRT
Setting up CSIRT
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on it
 

Kürzlich hochgeladen

Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rick Flair
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfLoriGlavin3
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????blackmambaettijean
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr BaganFwdays
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxhariprasad279825
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsNathaniel Shimoni
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESmohitsingh558521
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .Alan Dix
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 

Kürzlich hochgeladen (20)

Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdf
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdf
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptx
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directions
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 

Adversary Playbook Tactical Assessment of Protection Techniques

  • 1. Adversary Playbook Tactical Assessment of Protection Techniques Julian Cohen Justin Berman
  • 2. Julian Cohen | @HockeyInJune | http://hake.co/ ● Product Security | Flatiron Health ● Founder | http://playbook.delivery/ Previously ● Application Security | Financial Services ● Vulnerability Researcher | Defense Contracting ● Penetration Tester | Boutique Consulting ● Educator | Universities
  • 3. Justin Berman | @justinmberman ● Head of Security | Flatiron Health Previously ● Head of Security Architecture | Financial Services ● Principal Consultant | Boutique Consulting ● Application Developer | Hi-Tech
  • 5. https://www.nettitude.com/uk/eight-things-to-consider-before-deploying-cyber-threat-intelligence/ https://medium.com/@HockeyInJune/playbook-based-testing-5df4b656113a Threat Intelligence ● Not hashes and IP address ● Actionable tactics and procedures ● Motivation, resourcing, strategies ● Expertise to distill and apply intelligence
  • 6. Attacker Cost ● The cost of an attack is the minimum of cost times the success rate ● Cost factors ○ Expertise ○ Time ○ Money ○ Resources ● Success factors ○ Target ubiquity ○ Probability ○ Access https://trailofbits.files.wordpress.com/2011/08/attacker-math.pdf
  • 7. Attacker Value All attackers are resource constrained — @dinodaizovi All attackers have a boss and a budget — @philvenables Repeatability: The capability to change the target and have the attack still work with the same success rate Scalability: The capability to launch the attack against multiple targets with minimal cost per additional target https://medium.com/@HockeyInJune/playbook-based-testing-5df4b656113a
  • 8. Attacker Efficiency Attackers determine the least costly and most valuable attacks based on Who are the targets Required success rate Speed of conversion
  • 9. Common Attacks Inexpensive, valuable, scalable, or repeatable: Phishing Credential reuse Known vulnerabilities with public exploits Office macros Spyware Vendor compromise Costly, valueless, unscalable, or unrepeatable: Web vulnerabilities 0-day exploits Known vulnerabilities without public exploits Embedded devices Crypto weaknesses Insider threat
  • 10. Lockheed Martin’s Intrusion Kill Chain ● Eric M. Hutchins, Michael J. Cloppert, Rohan M. Amin, Ph.D. ● 6th International Conference Information Warfare and Security (ICIW 11) https://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf
  • 11. Offensive Experience ● Attacker constraints ○ Resourcing, expertise, time ● Political constraints ○ Management ● Motivations ○ Military, financial, political ● Research and development ○ Pipelines, iterations, constraints http://www.cyberwar.news/wp-content/uploads/sites/32/2015/10/china_cyberwar.jpg
  • 13. The Cycle The OODA Loop as Applied To A Security Program ● Observe - Collect Intelligence ● Orient - Model Threats ● Decide - Prioritize ● Act - Design and Build
  • 14. Observe and Orient - The Traditional Way
  • 15. Building Intrusion Kill Chains ● Analyze existing intelligence ○ Reports, news, breaches ● Analyze whitehat research ○ Presentations, reports, tools ● Collect intelligence ○ Honeypots, scanners, logging ● Understand motivations and resourcing ○ Military, criminal, political ● Use expertise to build theories ○ From experience, breaches, and research
  • 16. ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory Intrusion Kill Chain https://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf
  • 17. Intrusion Kill Chain Phase Detect Deny Disrupt Degrade Deceive Destroy E-mail harvesting Fake employee Policy Policy Fake employee Office macros Kill whitehats Hack Phishing Mail gateway Mail gateway Mail gateway Training Target runs macro EPP EPP Macros off No local admin Sandbox Poison Ivy EPP EPP EPP Sandbox Sandbox Poison Ivy NIDS Firewall NIPS Web proxy Sandbox Pivots to active directory Logging 2-factor auth SMB signing Segmentation Honeypot Key: EPP: Endpoint Protection Platform NIDS: Network Intrusion Detection System NIPS: Network Intrusion Prevention System SMB: Server Message Block Protocol
  • 18. Observe and Orient - Integrating Intelligence
  • 19. Observe and Orient - Integrating Intelligence
  • 20. Observe and Orient - Integrating Intelligence
  • 22. ● SQL Injection Vulnerability ● Authenticated ● VPN ● Sensitive Data ● Yields: Full Database Access ● High Impact, Low Likelihood CVSSv3: 7.7 Unlikely to occur Likelihood Versus Impact ● PDF Memory Corruption Vulnerability ● Commercial Software ● Support Staff ● Customer Data ● Yields: Some Data and Foothold Machine ● Low Impact, Medium Likelihood CVSSv3: 6.7 Likely to occur ● Conclusion: Treat everything as High Impact, most issues should be scored on Likelihood https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
  • 23. Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Financially-motivated, medium-resourced group Resources focused towards what’s necessary Strategy: Collect credit card numbers State-sponsored, well-resourced group Resources focused towards target set Strategy: Attack everyone and wait
  • 24. Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Common Tactics Key: White: Shared attacks
  • 25. Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Attacker Cost (Likelihood) Key: Red: Low-cost to attacker, high likelihood of attack
  • 26. Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Cost to Change (Future Likelihood) Key: Red: High-cost to change, high likelihood of attack
  • 27. Attacker Cost ● Recon: E-mail harvesting ● Weapon: Office macros ● Delivery: Phishing ● Exploit: Target runs macro ● Install: Poison Ivy ● C2: Poison Ivy ● Actions: Pivots to active directory ● Recon: LinkedIn harvesting ● Weapon: Angler exploit kit ● Delivery: Phishing ● Exploit: Browser exploits runs ● Install: Custom malware ● C2: Custom encrypted channel ● Actions: Pivots to database servers Key: Green: Low-cost to defend Defender Cost
  • 28. Intrusion Kill Chain Phase Detect Deny Disrupt Degrade Deceive Destroy E-mail harvesting Fake employee Policy Policy Fake employee Office macros Kill whitehats Hack Phishing Mail gateway Mail gateway Mail gateway Training Target runs macro EPP EPP Macros off No local admin Sandbox Poison Ivy EPP EPP EPP Sandbox Sandbox Poison Ivy NIDS Firewall NIPS Web proxy Sandbox Pivots to active directory Logging 2-factor auth SMB signing Segmentation Honeypot Key: EPP: Endpoint Protection Platform NIDS: Network Intrusion Detection System NIPS: Network Intrusion Prevention System SMB: Server Message Block Protocol Key: Green: Low-cost to defender Red: High-cost to attacker
  • 29. Decide - Integrating Intelligence
  • 31. ● Message authenticity, signatures, and intelligence feeds ○ Bottom 20% attackers use blacklisted domains, fingerprintable templates, known malware ● Sanity checks and heuristics ○ Next 30% of attackers use new domains, obvious templates, unknown malware ● Sandbox for attachments and links ○ Next 30% of attackers use techniques designed to bypass common protections ● Difficult to detect sandbox ○ Next 15% of attackers use sandbox evasion techniques ● Top 5% of attackers will bypass the mail gateway Attacker Efficiency
  • 32. Act - Integrating Intelligence Financially-motivated, medium-resourced group Resources focused towards what’s necessary Strategy: Collect credit card numbers State-sponsored, well-resourced group Resources focused towards target set Strategy: Attack everyone and wait
  • 35. ● Do we know the set of attackers that are relevant for our organization? ○ Are these right attackers? ○ Have we enumerated their playbooks? ○ Are their playbooks accurate? Key Question 1
  • 36. Key Question 2 ● Are we able to defend against the playbooks we are focused on? ○ Have we tested that?
  • 37. Key Question 3 ● Have we effectively prioritized existing gaps against the most likely attackers? ○ Are we making reasonable progress towards reducing risk? ○ Do we have enough resources allocated to these efforts?
  • 38. Key Question 4 ● Are we accurately and effectively predicting future changes? ○ When and who will become new attackers in the future? ○ Which and when will attacker playbooks change?
  • 40. Objective and Easy To Analyze Data Is Hard To Get
  • 41. Diverges From Management Comfort Zones
  • 43. Shortage of Talent Capable of Executing