SlideShare ist ein Scribd-Unternehmen logo

Cyber Purple Teaming: Uniting Blue and Red Teams - B Sides San Antonio - Albert Campa, Denim Group

•Als PPTX, PDF herunterladen•
•
Denim Group
Denim Group

You’ve heard of black, white, and gray box testing? Adding to the security color spectrum, Red Teams (pen testers) working together with Blue Teams (defenders), can improve organizational security and get the most out of security assessments. This talk will discuss both general and specific concepts and techniques to improve penetration tests with coordination of internal security teams. We will discuss high level topics such as knowing what type of assessment is needed for your organization, to more detailed technical concepts such as detecting attack traffic and coordinating with red team attacks. If your internal security team isn't ready for a pentest, lets discuss steps to get your team prepared and ready to fully take advantage of full scope penetration tests. From a pentester perspective, we will discuss the types of testing that is most beneficial to your clients and how to communicate and perform testing activities in conjunction with blue teams. We will also talk about ways to assist the teams with remediation from a 3rd party point of view. What are the three key points an audience will receive: · Pen testing techniques on working with internal security · Internal security techniques for detecting attacks · Concepts on performing the best type of pen test for your customers

Technologie
1 von 46
© 2015 Denim Group – All Rights Reserved Cyber Purple Teaming: Uniting Blue and Red Teams Don’t forget Advanced Cyber
© 2015 Denim Group – All Rights Reserved Introduction: - Security Consultant - Brazilian JiuJitsu practitioner - Defender of networks - Firewall admin - Linux guy - Soccer player/fan - Windows guy - Air Force guy
© 2015 Denim Group – All Rights Reserved Points to discuss: - Blue team preparations – Get ready defenders! - Not ready for pentest? Get ready! - Log all things! Educate all things! - Red team tactics – Hack with love! - The scope question – Hack all things! - Social Engineering – Assess, train, assess! - Team communication - Wolf! Man on! Watch out! - Putting it all together – fine tuning
© 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
© 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
© 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
© 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
© 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
© 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
© 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
© 2015 Denim Group – All Rights Reserved Blue team tactics - Brace yourself
© 2015 Denim Group – All Rights Reserved Blue team tactics - Security Fundamentals
© 2015 Denim Group – All Rights Reserved Blue team tactics - Security Fundamentals - Patch management - Locked down DMZ firewall and servers. - Proper segmentation - Vulnerability scanning - Monitoring - Security Awareness Training (Web based CBT?) - Skills (Be a sysadmin)
© 2015 Denim Group – All Rights Reserved Blue team tactics - Internal Assessments - Vulnerability scanning (minimum) - Internal pentesting (resources needed) - System hardening / Compliance scans - Patch management program - VA data to patch cycle
© 2015 Denim Group – All Rights Reserved Blue team tactics - Logs, Logs and more logs - Firewall, IPS, Servers, network devices, etc.
© 2015 Denim Group – All Rights Reserved Blue team tactics - Configure tools properly - Malware detection, IPS, Log levels, etc - http://hackerhurricane.blogspot.com/ - http://www.slideshare.net/Hackerhurricane/windows- logging-cheat-sheet-v11 - Personnel resources - Skills and training
© 2015 Denim Group – All Rights Reserved Blue team tactics - Netflow / Packet Capture - Proper location - Tool to view and understand the flows - Use Cases - Unauth traffic from/to internet - (ftp, telnet, non-standard http(s)) - C2, Unexpected traffic - Sensitive information unencrypted - Unusual spikes in traffic - Internal server access - Internal detection of spread of malware
© 2015 Denim Group – All Rights Reserved Blue team tactics - SIEM - Remember Personnel requirements! - Central Log repository - Log correlation - Ease of Log search
© 2015 Denim Group – All Rights Reserved Blue team tactics - That pentest engagement is getting closer.
© 2015 Denim Group – All Rights Reserved Blue team tactics - CISO - Pentest is coming (black box, white box, grey box) - Incentives (awards, gear, etc)
© 2015 Denim Group – All Rights Reserved Blue team tactics - Be Confident
© 2015 Denim Group – All Rights Reserved Red team tactics - Defined: - Red Team vs Penetration test? - Scope - Social Engineering - Physical Testing - Man Power used - Collaboration needed - Exploits / havoc wreaked
© 2015 Denim Group – All Rights Reserved Red team tactics - Are we ready for full Red Team Assessment - Full scope, Physical, SE, all out attack - Nation State tactics
© 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - Team Player Attitude
© 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - OOOOOOOOOOOOHH Day!!!!
© 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - OOOOOOOOOOOOHH Day!!!!
© 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - OOOOOOOOOOOOHH Day!!!!
© 2015 Denim Group – All Rights Reserved Red team tactics - Social Engineering - Are employees trained? Not CBT, not 1 Lunch and Learn. - Its no use, cant fix… - Blue team: We have firewall, AV.
© 2015 Denim Group – All Rights Reserved Red team tactics - Social Engineering
© 2015 Denim Group – All Rights Reserved Red team tactics - Social Engineering – Dave Kennedy - Destroying Education and Awareness - https://www.youtube.com/watch?v=ldvI12lpeEI - WebJacking in SET - http://www.restrictedintelligence.co.uk/
© 2015 Denim Group – All Rights Reserved Red team tactics - Full Scope.
© 2015 Denim Group – All Rights Reserved Purple Team tactics - Unprepared Blue Teams - Recommendation on Personnel - Training of Personnel(SANS, Books, podcasts, RSS) - Assistance with tools implementation (SIEM rules) - Retesting and verifying (segmentation, IPS/SIEM)
© 2015 Denim Group – All Rights Reserved Purple Team tactics - All Blue Teams - Adversary simulation (Rafa Mudge) - http://blog.cobaltstrike.com/2014/11/12/adversary-simulation- becomes-a-thing/ - Malleable C2 - Nation State simulation
© 2015 Denim Group – All Rights Reserved Purple Team tactics - Testing Scenarios - WAF - IPS/IDS - AV - Malware Detection - DLP - More… - What exists in your SOC: - Monitoring TEAM - Deployment/UpKeep/Configuration TEAM
© 2015 Denim Group – All Rights Reserved Purple Team tactics - SIEM Rules - Idea mentioned by Kevin Johnson @ BsidesATX - As a pentester, provide SIEM rules to blue teams - Any vendor - An idea, a possibility? - Purple Team Talk by Kevin Johnson and James Jardine - https://youtu.be/ARM2ArOw9sI
© 2015 Denim Group – All Rights Reserved Purple Team tactics - We Talked Logs/Events - Lets Talk Flows/packet analysis - Example from compromising a system: - Beacon - Setoolkit / Metasploit
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics
© 2015 Denim Group – All Rights Reserved Purple Team tactics - So what’s the point? - Bring the education - Work together and keep communication high - Blue and Red have to equally contribute - Don’t throw over the fence - Make reports beneficial - Remediation?
© 2015 Denim Group – All Rights Reserved Comments? Questions? Twitter: @beto_atx Email: acampa@denimgroup.com

Empfohlen

Purple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyPurple Team Use Case - Security Weekly
Purple Team Use Case - Security Weekly
Jorge Orchilles
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Chris Gates
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018
Christopher Korban
 
Next Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAMNext Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAM
BGA Cyber Security
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMCon
Jorge Orchilles
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
👀 Joe Gray
 
MITRE AttACK framework it is time you took notice_v1.0
MITRE AttACK framework it is time you took notice_v1.0MITRE AttACK framework it is time you took notice_v1.0
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 

Empfohlen

Purple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyPurple Team Use Case - Security Weekly
Purple Team Use Case - Security Weekly
Jorge Orchilles
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Chris Gates
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018
Christopher Korban
 
Next Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAMNext Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAM
BGA Cyber Security
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMCon
Jorge Orchilles
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
👀 Joe Gray
 
MITRE AttACK framework it is time you took notice_v1.0
MITRE AttACK framework it is time you took notice_v1.0MITRE AttACK framework it is time you took notice_v1.0
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
Purple team is awesome
Purple team is awesomePurple team is awesome
Purple team is awesome
Sumedt Jitpukdebodin
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testing
Amine SAIGHI
 
Red team Engagement
Red team EngagementRed team Engagement
Red team Engagement
Indranil Banerjee
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
asherad
 
Red team and blue team in ethical hacking
Red team and blue team in ethical hackingRed team and blue team in ethical hacking
Red team and blue team in ethical hacking
Vikram Khanna
 
What is Penetration Testing?
What is Penetration Testing?What is Penetration Testing?
What is Penetration Testing?
btpsec
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE - ATT&CKcon
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
Muhammad Sahputra
 
PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple Teaming
Nikhil Mittal
 
Red Team vs. Blue Team
Red Team vs. Blue TeamRed Team vs. Blue Team
Red Team vs. Blue Team
EC-Council
 
Purple team strategy_lascon_2016
Purple team strategy_lascon_2016Purple team strategy_lascon_2016
Purple team strategy_lascon_2016
Trupti Shiralkar, CISSP
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Jorge Orchilles
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
Vulnerability assessment and penetration testing
Vulnerability assessment and penetration testingVulnerability assessment and penetration testing
Vulnerability assessment and penetration testing
Abu Sadat Mohammed Yasin
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]
David Sweigert
 
Cyber kill chain
Cyber kill chainCyber kill chain
Cyber kill chain
Ankita Ganguly
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 
What is pentest
What is pentestWhat is pentest
What is pentest
itissolutions
 
Threat Activity Groups - Dragos
Threat Activity Groups - Dragos Threat Activity Groups - Dragos
Threat Activity Groups - Dragos
Dragos, Inc.
 
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
beltface
 
Security by Collaboration: Rethinking Red Teams versus Blue Teams
Security by Collaboration: Rethinking Red Teams versus Blue TeamsSecurity by Collaboration: Rethinking Red Teams versus Blue Teams
Security by Collaboration: Rethinking Red Teams versus Blue Teams
AlienVault
 

Weitere ähnliche Inhalte

Was ist angesagt?

Purple team strategy_lascon_2016
Purple team strategy_lascon_2016Purple team strategy_lascon_2016
Purple team strategy_lascon_2016
Trupti Shiralkar, CISSP
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Jorge Orchilles
 

Was ist angesagt? (20)

Purple team is awesome
Purple team is awesomePurple team is awesome
Purple team is awesome
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testing
 
Red team Engagement
Red team EngagementRed team Engagement
Red team Engagement
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
 
Red team and blue team in ethical hacking
Red team and blue team in ethical hackingRed team and blue team in ethical hacking
Red team and blue team in ethical hacking
 
What is Penetration Testing?
What is Penetration Testing?What is Penetration Testing?
What is Penetration Testing?
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
 
PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple Teaming
 
Red Team vs. Blue Team
Red Team vs. Blue TeamRed Team vs. Blue Team
Red Team vs. Blue Team
 
Purple team strategy_lascon_2016
Purple team strategy_lascon_2016Purple team strategy_lascon_2016
Purple team strategy_lascon_2016
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
 
Vulnerability assessment and penetration testing
Vulnerability assessment and penetration testingVulnerability assessment and penetration testing
Vulnerability assessment and penetration testing
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]
 
Cyber kill chain
Cyber kill chainCyber kill chain
Cyber kill chain
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
 
What is pentest
What is pentestWhat is pentest
What is pentest
 
Threat Activity Groups - Dragos
Threat Activity Groups - Dragos Threat Activity Groups - Dragos
Threat Activity Groups - Dragos
 

Andere mochten auch

Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
beltface
 
Blue team reboot - HackFest
Blue team reboot - HackFest Blue team reboot - HackFest
Blue team reboot - HackFest
Haydn Johnson
 
Red team, Blue Team or White Cell
Red team, Blue Team or White CellRed team, Blue Team or White Cell
Red team, Blue Team or White Cell
Frank Breedijk
 

Andere mochten auch (10)

Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
 
Security by Collaboration: Rethinking Red Teams versus Blue Teams
Security by Collaboration: Rethinking Red Teams versus Blue TeamsSecurity by Collaboration: Rethinking Red Teams versus Blue Teams
Security by Collaboration: Rethinking Red Teams versus Blue Teams
 
Going Purple : From full time breaker to part time fixer: 1 year later
Going Purple : From full time breaker to part time fixer: 1 year later Going Purple : From full time breaker to part time fixer: 1 year later
Going Purple : From full time breaker to part time fixer: 1 year later
 
Empire Work shop
Empire Work shopEmpire Work shop
Empire Work shop
 
Purple View
Purple ViewPurple View
Purple View
 
Automation of Penetration Testing
Automation of Penetration TestingAutomation of Penetration Testing
Automation of Penetration Testing
 
Home Arcade setup (NoVA Hackers)
Home Arcade setup (NoVA Hackers)Home Arcade setup (NoVA Hackers)
Home Arcade setup (NoVA Hackers)
 
Blue team reboot - HackFest
Blue team reboot - HackFest Blue team reboot - HackFest
Blue team reboot - HackFest
 
Red team, Blue Team or White Cell
Red team, Blue Team or White CellRed team, Blue Team or White Cell
Red team, Blue Team or White Cell
 
DevOOPS: Attacks and Defenses for DevOps Toolchains
DevOOPS: Attacks and Defenses for DevOps ToolchainsDevOOPS: Attacks and Defenses for DevOps Toolchains
DevOOPS: Attacks and Defenses for DevOps Toolchains
 

Ähnlich wie Cyber Purple Teaming: Uniting Blue and Red Teams - B Sides San Antonio - Albert Campa, Denim Group

AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA ProgramAppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
Denim Group
 
ThreadFix 2.2 Preview Webinar with Dan Cornell
ThreadFix 2.2 Preview Webinar with Dan CornellThreadFix 2.2 Preview Webinar with Dan Cornell
ThreadFix 2.2 Preview Webinar with Dan Cornell
Denim Group
 
SecDevOps: Development Tools for Security Pros
SecDevOps: Development Tools for Security ProsSecDevOps: Development Tools for Security Pros
SecDevOps: Development Tools for Security Pros
Denim Group
 
OWASP San Antonio Meeting 10/2/20
OWASP San Antonio Meeting 10/2/20OWASP San Antonio Meeting 10/2/20
OWASP San Antonio Meeting 10/2/20
Denim Group
 
Structuring and Scaling an Application Security Program
Structuring and Scaling an Application Security ProgramStructuring and Scaling an Application Security Program
Structuring and Scaling an Application Security Program
Denim Group
 
Audit Manager -- Compliance made easy
Audit Manager -- Compliance made easyAudit Manager -- Compliance made easy
Audit Manager -- Compliance made easy
Solarwinds N-able
 
Achieving Visible Security at Scale with the NIST Cybersecurity Framework
Achieving Visible Security at Scale with the NIST Cybersecurity FrameworkAchieving Visible Security at Scale with the NIST Cybersecurity Framework
Achieving Visible Security at Scale with the NIST Cybersecurity Framework
Kevin Fealey
 
Incident Response and SAP Systems
Incident Response and SAP SystemsIncident Response and SAP Systems
Incident Response and SAP Systems
Onapsis Inc.
 
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity MonitoringSophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
Imperva
 

Ähnlich wie Cyber Purple Teaming: Uniting Blue and Red Teams - B Sides San Antonio - Albert Campa, Denim Group (20)

From an Experience of Vulnerability Reporting
From an Experience of Vulnerability ReportingFrom an Experience of Vulnerability Reporting
From an Experience of Vulnerability Reporting
 
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA ProgramAppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
 
ThreadFix 2.2 Preview Webinar with Dan Cornell
ThreadFix 2.2 Preview Webinar with Dan CornellThreadFix 2.2 Preview Webinar with Dan Cornell
ThreadFix 2.2 Preview Webinar with Dan Cornell
 
When Content Meets Data, Big Things Happen - Peter Krmpotic, Adobe
When Content Meets Data, Big Things Happen - Peter Krmpotic, AdobeWhen Content Meets Data, Big Things Happen - Peter Krmpotic, Adobe
When Content Meets Data, Big Things Happen - Peter Krmpotic, Adobe
 
SecDevOps: Development Tools for Security Pros
SecDevOps: Development Tools for Security ProsSecDevOps: Development Tools for Security Pros
SecDevOps: Development Tools for Security Pros
 
OWASP San Antonio Meeting 10/2/20
OWASP San Antonio Meeting 10/2/20OWASP San Antonio Meeting 10/2/20
OWASP San Antonio Meeting 10/2/20
 
SecureSet WarGames - Logging and Packet Capture Training
SecureSet WarGames - Logging and Packet Capture TrainingSecureSet WarGames - Logging and Packet Capture Training
SecureSet WarGames - Logging and Packet Capture Training
 
Structuring and Scaling an Application Security Program
Structuring and Scaling an Application Security ProgramStructuring and Scaling an Application Security Program
Structuring and Scaling an Application Security Program
 
Audit Manager -- Compliance made easy
Audit Manager -- Compliance made easyAudit Manager -- Compliance made easy
Audit Manager -- Compliance made easy
 
How secure are your customers.pptx
How secure are your customers.pptxHow secure are your customers.pptx
How secure are your customers.pptx
 
April 2015 Webinar: Cyber Hunting with Sqrrl
April 2015 Webinar: Cyber Hunting with SqrrlApril 2015 Webinar: Cyber Hunting with Sqrrl
April 2015 Webinar: Cyber Hunting with Sqrrl
 
The Internal Signs of Compromise
The Internal Signs of CompromiseThe Internal Signs of Compromise
The Internal Signs of Compromise
 
Achieving Visible Security at Scale with the NIST Cybersecurity Framework
Achieving Visible Security at Scale with the NIST Cybersecurity FrameworkAchieving Visible Security at Scale with the NIST Cybersecurity Framework
Achieving Visible Security at Scale with the NIST Cybersecurity Framework
 
Securing Your Digital Transformation: Cybersecurity and You
Securing Your Digital Transformation: Cybersecurity and YouSecuring Your Digital Transformation: Cybersecurity and You
Securing Your Digital Transformation: Cybersecurity and You
 
Incident Response and SAP Systems
Incident Response and SAP SystemsIncident Response and SAP Systems
Incident Response and SAP Systems
 
Bridging the gap between business and technology - Behaviour Driven Developme...
Bridging the gap between business and technology - Behaviour Driven Developme...Bridging the gap between business and technology - Behaviour Driven Developme...
Bridging the gap between business and technology - Behaviour Driven Developme...
 
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity MonitoringSophisticated Incident Response Requires Sophisticated Activity Monitoring
Sophisticated Incident Response Requires Sophisticated Activity Monitoring
 
Drupal for Big Data - is it ready? (European Drupal Days 2015)
Drupal for Big Data - is it ready? (European Drupal Days 2015)Drupal for Big Data - is it ready? (European Drupal Days 2015)
Drupal for Big Data - is it ready? (European Drupal Days 2015)
 
Privileged accesss management for den csa user group CA Technologies
Privileged accesss management for den csa user group CA TechnologiesPrivileged accesss management for den csa user group CA Technologies
Privileged accesss management for den csa user group CA Technologies
 
attune SAP Fashion Management (SAP FMS) webinar slides
attune SAP Fashion Management (SAP FMS) webinar slidesattune SAP Fashion Management (SAP FMS) webinar slides
attune SAP Fashion Management (SAP FMS) webinar slides
 

Mehr von Denim Group

Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Denim Group
 
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Denim Group
 
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
Optimizing Security Velocity in Your DevSecOps Pipeline at ScaleOptimizing Security Velocity in Your DevSecOps Pipeline at Scale
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
Denim Group
 
Using Collaboration to Make Application Vulnerability Management a Team Sport
Using Collaboration to Make Application Vulnerability Management a Team SportUsing Collaboration to Make Application Vulnerability Management a Team Sport
Using Collaboration to Make Application Vulnerability Management a Team Sport
Denim Group
 
Security Champions: Pushing Security Expertise to the Edges of Your Organization
Security Champions: Pushing Security Expertise to the Edges of Your OrganizationSecurity Champions: Pushing Security Expertise to the Edges of Your Organization
Security Champions: Pushing Security Expertise to the Edges of Your Organization
Denim Group
 
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native ApplicationsThe As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
Denim Group
 
An Updated Take: Threat Modeling for IoT Systems
An Updated Take: Threat Modeling for IoT SystemsAn Updated Take: Threat Modeling for IoT Systems
An Updated Take: Threat Modeling for IoT Systems
Denim Group
 
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Denim Group
 
AppSec in a World of Digital Transformation
AppSec in a World of Digital TransformationAppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
Denim Group
 
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native ApplicationsThe As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
Denim Group
 
AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
Denim Group
 
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack SurfaceEnumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
Denim Group
 
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack SurfaceEnumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
Denim Group
 
Assessing Business Operations Risk With Unified Vulnerability Management in T...
Assessing Business Operations Risk With Unified Vulnerability Management in T...Assessing Business Operations Risk With Unified Vulnerability Management in T...
Assessing Business Operations Risk With Unified Vulnerability Management in T...
Denim Group
 

Mehr von Denim Group (20)

Long-term Impact of Log4J
Long-term Impact of Log4JLong-term Impact of Log4J
Long-term Impact of Log4J
 
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
 
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
 
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
Optimizing Security Velocity in Your DevSecOps Pipeline at ScaleOptimizing Security Velocity in Your DevSecOps Pipeline at Scale
Optimizing Security Velocity in Your DevSecOps Pipeline at Scale
 
Application Asset Management with ThreadFix
Application Asset Management with ThreadFix Application Asset Management with ThreadFix
Application Asset Management with ThreadFix
 
Using Collaboration to Make Application Vulnerability Management a Team Sport
Using Collaboration to Make Application Vulnerability Management a Team SportUsing Collaboration to Make Application Vulnerability Management a Team Sport
Using Collaboration to Make Application Vulnerability Management a Team Sport
 
Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...
Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...
Managing Penetration Testing Programs and Vulnerability Time to Live with Thr...
 
Security Champions: Pushing Security Expertise to the Edges of Your Organization
Security Champions: Pushing Security Expertise to the Edges of Your OrganizationSecurity Champions: Pushing Security Expertise to the Edges of Your Organization
Security Champions: Pushing Security Expertise to the Edges of Your Organization
 
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native ApplicationsThe As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
 
An Updated Take: Threat Modeling for IoT Systems
An Updated Take: Threat Modeling for IoT SystemsAn Updated Take: Threat Modeling for IoT Systems
An Updated Take: Threat Modeling for IoT Systems
 
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
 
A New View of Your Application Security Program with Snyk and ThreadFix
A New View of Your Application Security Program with Snyk and ThreadFixA New View of Your Application Security Program with Snyk and ThreadFix
A New View of Your Application Security Program with Snyk and ThreadFix
 
Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...
 
AppSec in a World of Digital Transformation
AppSec in a World of Digital TransformationAppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
 
The As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native ApplicationsThe As, Bs, and Four Cs of Testing Cloud-Native Applications
The As, Bs, and Four Cs of Testing Cloud-Native Applications
 
Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...Enabling Developers in Your Application Security Program With Coverity and Th...
Enabling Developers in Your Application Security Program With Coverity and Th...
 
AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation AppSec in a World of Digital Transformation
AppSec in a World of Digital Transformation
 
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack SurfaceEnumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
 
Enumerating Enterprise Attack Surface
Enumerating Enterprise Attack SurfaceEnumerating Enterprise Attack Surface
Enumerating Enterprise Attack Surface
 
Assessing Business Operations Risk With Unified Vulnerability Management in T...
Assessing Business Operations Risk With Unified Vulnerability Management in T...Assessing Business Operations Risk With Unified Vulnerability Management in T...
Assessing Business Operations Risk With Unified Vulnerability Management in T...
 

Kürzlich hochgeladen

Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Victor Rentea
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Victor Rentea
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Orbitshub
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Orbitshub
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
Overkill Security
 

Kürzlich hochgeladen (20)

2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
 

Cyber Purple Teaming: Uniting Blue and Red Teams - B Sides San Antonio - Albert Campa, Denim Group

  • 1. © 2015 Denim Group – All Rights Reserved Cyber Purple Teaming: Uniting Blue and Red Teams Don’t forget Advanced Cyber
  • 2. © 2015 Denim Group – All Rights Reserved Introduction: - Security Consultant - Brazilian JiuJitsu practitioner - Defender of networks - Firewall admin - Linux guy - Soccer player/fan - Windows guy - Air Force guy
  • 3. © 2015 Denim Group – All Rights Reserved Points to discuss: - Blue team preparations – Get ready defenders! - Not ready for pentest? Get ready! - Log all things! Educate all things! - Red team tactics – Hack with love! - The scope question – Hack all things! - Social Engineering – Assess, train, assess! - Team communication - Wolf! Man on! Watch out! - Putting it all together – fine tuning
  • 4. © 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
  • 5. © 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
  • 6. © 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
  • 7. © 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
  • 8. © 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
  • 9. © 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
  • 10. © 2015 Denim Group – All Rights Reserved Red Team vs Blue Team:
  • 11. © 2015 Denim Group – All Rights Reserved Blue team tactics - Brace yourself
  • 12. © 2015 Denim Group – All Rights Reserved Blue team tactics - Security Fundamentals
  • 13. © 2015 Denim Group – All Rights Reserved Blue team tactics - Security Fundamentals - Patch management - Locked down DMZ firewall and servers. - Proper segmentation - Vulnerability scanning - Monitoring - Security Awareness Training (Web based CBT?) - Skills (Be a sysadmin)
  • 14. © 2015 Denim Group – All Rights Reserved Blue team tactics - Internal Assessments - Vulnerability scanning (minimum) - Internal pentesting (resources needed) - System hardening / Compliance scans - Patch management program - VA data to patch cycle
  • 15. © 2015 Denim Group – All Rights Reserved Blue team tactics - Logs, Logs and more logs - Firewall, IPS, Servers, network devices, etc.
  • 16. © 2015 Denim Group – All Rights Reserved Blue team tactics - Configure tools properly - Malware detection, IPS, Log levels, etc - http://hackerhurricane.blogspot.com/ - http://www.slideshare.net/Hackerhurricane/windows- logging-cheat-sheet-v11 - Personnel resources - Skills and training
  • 17. © 2015 Denim Group – All Rights Reserved Blue team tactics - Netflow / Packet Capture - Proper location - Tool to view and understand the flows - Use Cases - Unauth traffic from/to internet - (ftp, telnet, non-standard http(s)) - C2, Unexpected traffic - Sensitive information unencrypted - Unusual spikes in traffic - Internal server access - Internal detection of spread of malware
  • 18. © 2015 Denim Group – All Rights Reserved Blue team tactics - SIEM - Remember Personnel requirements! - Central Log repository - Log correlation - Ease of Log search
  • 19. © 2015 Denim Group – All Rights Reserved Blue team tactics - That pentest engagement is getting closer.
  • 20. © 2015 Denim Group – All Rights Reserved Blue team tactics - CISO - Pentest is coming (black box, white box, grey box) - Incentives (awards, gear, etc)
  • 21. © 2015 Denim Group – All Rights Reserved Blue team tactics - Be Confident
  • 22. © 2015 Denim Group – All Rights Reserved Red team tactics - Defined: - Red Team vs Penetration test? - Scope - Social Engineering - Physical Testing - Man Power used - Collaboration needed - Exploits / havoc wreaked
  • 23. © 2015 Denim Group – All Rights Reserved Red team tactics - Are we ready for full Red Team Assessment - Full scope, Physical, SE, all out attack - Nation State tactics
  • 24. © 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - Team Player Attitude
  • 25. © 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - OOOOOOOOOOOOHH Day!!!!
  • 26. © 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - OOOOOOOOOOOOHH Day!!!!
  • 27. © 2015 Denim Group – All Rights Reserved Red team tactics – Hack with love! - OOOOOOOOOOOOHH Day!!!!
  • 28. © 2015 Denim Group – All Rights Reserved Red team tactics - Social Engineering - Are employees trained? Not CBT, not 1 Lunch and Learn. - Its no use, cant fix… - Blue team: We have firewall, AV.
  • 29. © 2015 Denim Group – All Rights Reserved Red team tactics - Social Engineering
  • 30. © 2015 Denim Group – All Rights Reserved Red team tactics - Social Engineering – Dave Kennedy - Destroying Education and Awareness - https://www.youtube.com/watch?v=ldvI12lpeEI - WebJacking in SET - http://www.restrictedintelligence.co.uk/
  • 31. © 2015 Denim Group – All Rights Reserved Red team tactics - Full Scope.
  • 32. © 2015 Denim Group – All Rights Reserved Purple Team tactics - Unprepared Blue Teams - Recommendation on Personnel - Training of Personnel(SANS, Books, podcasts, RSS) - Assistance with tools implementation (SIEM rules) - Retesting and verifying (segmentation, IPS/SIEM)
  • 33. © 2015 Denim Group – All Rights Reserved Purple Team tactics - All Blue Teams - Adversary simulation (Rafa Mudge) - http://blog.cobaltstrike.com/2014/11/12/adversary-simulation- becomes-a-thing/ - Malleable C2 - Nation State simulation
  • 34. © 2015 Denim Group – All Rights Reserved Purple Team tactics - Testing Scenarios - WAF - IPS/IDS - AV - Malware Detection - DLP - More… - What exists in your SOC: - Monitoring TEAM - Deployment/UpKeep/Configuration TEAM
  • 35. © 2015 Denim Group – All Rights Reserved Purple Team tactics - SIEM Rules - Idea mentioned by Kevin Johnson @ BsidesATX - As a pentester, provide SIEM rules to blue teams - Any vendor - An idea, a possibility? - Purple Team Talk by Kevin Johnson and James Jardine - https://youtu.be/ARM2ArOw9sI
  • 36. © 2015 Denim Group – All Rights Reserved Purple Team tactics - We Talked Logs/Events - Lets Talk Flows/packet analysis - Example from compromising a system: - Beacon - Setoolkit / Metasploit
  • 37. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 38. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 39. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 40. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 41. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 42. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 43. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 44. © 2015 Denim Group – All Rights Reserved Purple Team tactics
  • 45. © 2015 Denim Group – All Rights Reserved Purple Team tactics - So what’s the point? - Bring the education - Work together and keep communication high - Blue and Red have to equally contribute - Don’t throw over the fence - Make reports beneficial - Remediation?
  • 46. © 2015 Denim Group – All Rights Reserved Comments? Questions? Twitter: @beto_atx Email: acampa@denimgroup.com