SlideShare ist ein Scribd-Unternehmen logo

SEC599 - Breaking The Kill Chain

•Als PPTX, PDF herunterladen•
•
Erik Van Buggenhout
Erik Van Buggenhout

The document discusses Windows credential attacks and defenses. It describes common credential theft techniques like dumping credentials from LSASS memory using Mimikatz. It then covers various Windows credential hardening defenses over time like Protected Processes, Restricted Admin, and CredentialGuard. It demonstrates CredentialGuard's effectiveness at preventing credential theft compared to normal and older Windows configurations through a lab demo. The presentation aims to educate on real-world credential attacks while showing that effective defense is possible.

Internet
1 von 42
SANS Cyber Defense Defense is doable Breaking the Kill Chain NETWORK SECURITY 2018 – 25 September 2018 Erik Van Buggenhout & Stephen Sims
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Who are we? – SEC599 Authors & Instructors 2 Stephen Sims SANS Fellow @Steph3nSims Erik Van Buggenhout SANS Certified Instructor @ErikVaBu
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 3 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 4 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
Network Security 2018 – Defense is Doable - Breaking the Kill Chain The Cyber Kill Chain 5 Reconnaissan ce Delivery Installation Action on Objectives Weaponizatio n Exploitation Command & Control Adversary perspective Defender perspective
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What Is “Red Team” & “Blue Team”? 6 Vulnerability Assessments Penetration Tests Social Engineering “Offense” “Defense” Implementing Controls Security Monitoring Incident Response COMMON GOAL Improve organization security posture
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Although they share a common goal, blue and red teams are often not well-aligned, which leads to organizations not leveraging the full value of their team's expertise. They typically report to a different hierarchy, which leads to different objectives: While we don’t necessarily think a purple team is a “third” team, think of it as a concept aimed at bringing the red & blue teams together. Red & blue teams should be encouraged to work as a joint team, share insights & create a strong feedback loop. So, Why a Purple Team? 7 Report with many vulnerabilities = Well done! Success is measured by # of failed controls No big incentive to help blue team, as blue team failure = red team success! No alerts mean that preventive controls are working! Large volume of alerts means detection controls are working (though may need finetuning) No big incentive to help red team, as red team failure = blue team success!
Network Security 2018 – Defense is Doable - Breaking the Kill Chain The Purple Team Feedback Loop 8 VULNERABILITY REPORT REPORT ON REMEDIATED FLAWS What is happening now?: But how about some of the following actions?: • Red Team sharing TTPs of new actors with Blue Team • Red Team helping with vulnerability management process (not just assessment) • Blue Team sharing monitoring tactics in place with Red Team • Blue Team sharing playbooks with Red Team Offense must inform defense and defense must inform offense!
Network Security 2018 – Defense is Doable - Breaking the Kill Chain SEC599 – A True Purple Team Course 9 SEC599 – Defeating Advanced Adversaries – Purple Team Tactics & Kill Chain Defenses We illustrate what the adversaries are ACTUALLY doing with real-world examples and lab exercises We provide EFFECTIVE strategies to combat adversary tactics throughout all parts of the Kill Chain! SEC599 was built from the ground up by seasoned cyber security experts with vast experience in both blue team & red team operations:
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Purple Team – An Example Using Mimikatz & CredentialGuard 10 An example - As part of our “Lateral Movement” section, we will demonstrate how adversaries are stealing credentials from Windows systems using the infamous Mimikatz hacking tool. 1 During the first phase of the lab, you will dump credentials from the LSASS process memory, thereby experiencing the attack (and its impact) first-hand! 2 During the second phase of the lab, we will provide an in-depth explanation of how Windows 10 CredentialGuard works, after which it will be implemented. 3 During the third and final part of the lab, we will re-attempt dumping credentials from the LSASS process memory, thereby confirming effectiveness of our control!
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 11 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows credentials attacks 12 Aside from generic attacks such as phishing or keylogging, the table below lists some of the most common ways used by adversaries to obtain Windows credentials: SANS Senior Instructor Chad Tilbury has an excellent presentation on Windows Credentials Attacks, Mitigations & Defence: https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Introducing some of these tools – Capturing NTLMv2 13 For different reasons, Kerberos could not be available, in which case Windows will revert to NTLMv2 Challenge / Response authentication: Domain Controller 1. Request authentication Service Database Server 2. Challenge 3. Response Client Workstation 6. Server sends response to client The authenticating system uses the hashed credential to calculate a response based on the challenge sent by the server In a Windows domain environment, the NTLM challenge & response will be forwarded to the domain controller for validation of credentials 4. Forward Chal + Resp 5. Validation
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Introducing some of these tools – Responder – Capturing NTLMv2 14 Responder is (amongst others) an LLMNR, NBT-NS and MDNS poisoner. It will attempt to trick systems to connect / authenticate to the system it is running on. It will then attempt to sniff the authentication challenge (e.g. NTLMv2), which could be cracked by a password cracking tool.
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory 15 Once an initial entry point in the network has been obtained, dumping credentials from LSASS memory in particular has become extremely popular: • Open ups attack vector against users that aren’t locally configured (domain users). Furthermore, stolen credentials are in clear-text (Windows 7) or NT hash (Windows 10) format, so can immediately be reused in Pass-the-Hash attacks • Common attack flow: 1. Obtain local admin access to one system in domain 2. Lure domain admin to machine (e.g. Call Helpdesk) 3. Dump credentials from memory 4. Own the domain (“Domain dominance”) 5. Persist domain ownage (Golden ticket, DCSync, Skeleton Key,…) • Tools like Bloodhound create entire attack trees that reveal relationships between accounts and systems to facilitate this
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Common technique 16 Due to its size & complexity, it’s often difficult for administrators to retain a good overview of how privileges are assigned across the environment. Adversaries can leverage this to spot excessive privileges which can be used in lateral movement… AD structure diagrams The below diagram (generated by the attacking tool BloodHoundAD), reveals an interesting way of how adversaries could laterally move through the target environment: In a few steps, Erik could easily steal the hashes of Stephen, thereby obtaining Domain Admin privileges. User: Erik Group: Work- station admins PC: Work- station 1 Group: Domain admins User: Stephen HasSession
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Mimikatz 17 Due to its high reliability & flexibility, it is used by adversaries and penetration testers alike. Several variations have been created and it has been included as a module in the Metasploit Meterpreter attacking tool. Mimikatz is a free, open-source Windows tool built by Benjamin Delpy (@gentilkiwi) to extract credentials from Windows computers. Its second version is often referred to as “Kiwi”. “Mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.”
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Mimikatz in the news 18 The popularity of Mimikatz has sky-rocketed over the last few years: • In 2017, the NotPetya ransomware used various components of Mimikatz to supports its lateral movement • In several APT investigations, Mimikatz is part of the standard toolkit used by advanced adversaries (Amongst others, Oilrig, Cobalt Kitty & APT-28 have been observed to use (variants of) Mimikatz) • Penetration testing & red teaming frameworks include (variants of) Mimikatz: • Metasploit Meterpreter has a built-in Mimikatz module Powershell Empire has a built-in version of Mimikatz
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Some interesting Mimikatz features 19 • To prevent AV detection, Mimikatz supports an offline mode, where a dump of the LSASS process can be fed to Mimikatz. This dump-file can be created by built-in Windows tools (e.g. Task Manager) or the SysInternals toolkit. This removes the need of running a “hacking tool” like Mimikatz on the target system… • Mimikatz can impersonate a Domain Controller and replicate all password hashes using MS-DRSR (Directory Replication Service Remote Protocol), labelled “DCSync” in Mimikatz • Mimikatz can create AD persistence by generating golden tickets or installing a backdoor in memory of the Domain Controller (“Skeleton Key” attack)
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 20 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What’s left behind? 21 http://technet.microsoft.com/en-us/windows-server-docs/security/securing- privileged-access/securing-privileged-access-reference-material
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What’s left behind? – Mimikatz point of view 22
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Generic recommendations – Privileged Access Workstations 23 Domain controllers network Privileged Access Workstations Inner Network
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Generic recommendations – Identity & Access Management 24
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Restricted Admin 25 The idea of “Restricted Admin” mode is that credentials are not sent upon establishing of an RDP session, so the chances of capturing them using Mimikatz are lower! Source: https://docs.microsoft.com/en-us/windows/access-protection/remote-credential-guard
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Restricted Admin 26
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Protected Processes 27 In order to prevent hash dumping attacks aimed at the LSA process, Microsoft introduced “Protected Processes” as of Windows 8 & Windows Server 2012. • Protected processes were first introduced in Windows Vista for DRM (Digital Rights Management) purposes, but were adapted for “security purposes” in Windows 8 • The screenshot on the right provides an example of the lsass.exe process running as a “protected process” • Protected Processes are implemented in the Kernel software and can thus be defeated…
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Protected Processes 28
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Protected Processes 29
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Domain Protected Users 30 “Protected Users” enforces a number of restrictions on affected users, which try to defend against several of the attack strategies previously mentioned: Disable authentication using NTLM => Protect against Responder-style attacks Wdigest & CredSSP clear-text credentials no longer stored in LSASS => Less results when LSASS memory dumping On a device running Windows 8.1, passwords are not cached => Protect against dumping of cached credentials (default Windows: 10 latest users) Kerberos will not use DES or RC4 during pre-authentication => Protect against “Kerberoasting” attacks
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Introducing CredentialGuard 31
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows high-level architecture – Without CredentialGuard 32
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Having a look at the processes – Without CredentialGuard 33
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows high-level architecture – With CredentialGuard 34 When Credential Guard is enabled, the LSA process still runs in userland. The actual credentials are stored in the isolated LSA process (LsaIso.exe). This process does not run under Windows, but in the Virtual Secure Mode.
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows high-level architecture – With CredentialGuard 35
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Some caveats 36
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Some caveats – Another interesting attack strategy! 37
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Some caveats – Another interesting attack strategy! 38
Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 39 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Demo time 40
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Conclusion 41
Network Security 2018 – Defense is Doable - Breaking the Kill Chain Want to learn more? 42 Want to learn more? Join SEC599 - Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses • San Diego (CA) – November 2018 • Scottsdale (AZ) – December 2018 • Washington (DC) – December 2018 • Las Vegas (NV) – January 2019 • Reno (NV) – February 2019 • Baltimore (MD) – March 2019 More locations available at https://www.sans.org/course/defeating-advanced-adversaries- kill-chain-defenses

Empfohlen

Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016Matthew Dunwoody
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Windows 10 CredentialGuard vs Mimikatz - SEC599
Windows 10 CredentialGuard vs Mimikatz - SEC599Windows 10 CredentialGuard vs Mimikatz - SEC599
Windows 10 CredentialGuard vs Mimikatz - SEC599Erik Van Buggenhout
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabTeymur Kheirkhabarov
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 

Empfohlen

Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016Matthew Dunwoody
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Windows 10 CredentialGuard vs Mimikatz - SEC599
Windows 10 CredentialGuard vs Mimikatz - SEC599Windows 10 CredentialGuard vs Mimikatz - SEC599
Windows 10 CredentialGuard vs Mimikatz - SEC599Erik Van Buggenhout
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabTeymur Kheirkhabarov
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™Katie Nickels
 
Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Managementn|u - The Open Security Community
 
Cyber Defense Matrix: Reloaded
Cyber Defense Matrix: ReloadedCyber Defense Matrix: Reloaded
Cyber Defense Matrix: ReloadedSounil Yu
 
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumerationCeh v5 module 04 enumeration
Ceh v5 module 04 enumerationVi Tính Hoàng Nam
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Cyber kill chain
Cyber kill chainCyber kill chain
Cyber kill chainAnkita Ganguly
 
Zero Trust Framework for Network Security​
Zero Trust Framework for Network Security​Zero Trust Framework for Network Security​
Zero Trust Framework for Network Security​AlgoSec
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report Morane Decriem
 
cyber-security-reference-architecture
cyber-security-reference-architecturecyber-security-reference-architecture
cyber-security-reference-architectureBirendra Negi ☁️
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
Addressing the cyber kill chain
Addressing the cyber kill chainAddressing the cyber kill chain
Addressing the cyber kill chainSymantec Brasil
 
Bulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalBulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalMahmoud Yassin
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
Rothke secure360 building a security operations center (soc)
Rothke secure360 building a security operations center (soc)Rothke secure360 building a security operations center (soc)
Rothke secure360 building a security operations center (soc)Ben Rothke
 
Red team vs Penetration Testing
Red team vs Penetration TestingRed team vs Penetration Testing
Red team vs Penetration Testingavioren1979
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
Vapt life cycle
Vapt life cycleVapt life cycle
Vapt life cyclepenetration Tester
 
LIFT OFF 2017: Ransomware and IR Overview
LIFT OFF 2017: Ransomware and IR OverviewLIFT OFF 2017: Ransomware and IR Overview
LIFT OFF 2017: Ransomware and IR OverviewRobert Herjavec
 
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...Chris Gates
 

Weitere ähnliche Inhalte

Was ist angesagt?

Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™Katie Nickels
 
Cyber Defense Matrix: Reloaded
Cyber Defense Matrix: ReloadedCyber Defense Matrix: Reloaded
Cyber Defense Matrix: ReloadedSounil Yu
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Zero Trust Framework for Network Security​
Zero Trust Framework for Network Security​Zero Trust Framework for Network Security​
Zero Trust Framework for Network Security​AlgoSec
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report Morane Decriem
 
cyber-security-reference-architecture
cyber-security-reference-architecturecyber-security-reference-architecture
cyber-security-reference-architectureBirendra Negi ☁️
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
Addressing the cyber kill chain
Addressing the cyber kill chainAddressing the cyber kill chain
Addressing the cyber kill chainSymantec Brasil
 
Bulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalBulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalMahmoud Yassin
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
Rothke secure360 building a security operations center (soc)
Rothke secure360 building a security operations center (soc)Rothke secure360 building a security operations center (soc)
Rothke secure360 building a security operations center (soc)Ben Rothke
 
Red team vs Penetration Testing
Red team vs Penetration TestingRed team vs Penetration Testing
Red team vs Penetration Testingavioren1979
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 

Was ist angesagt? (20)

Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
 
Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Management
 
Cyber Defense Matrix: Reloaded
Cyber Defense Matrix: ReloadedCyber Defense Matrix: Reloaded
Cyber Defense Matrix: Reloaded
 
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumerationCeh v5 module 04 enumeration
Ceh v5 module 04 enumeration
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
 
Cyber kill chain
Cyber kill chainCyber kill chain
Cyber kill chain
 
Zero Trust Framework for Network Security​
Zero Trust Framework for Network Security​Zero Trust Framework for Network Security​
Zero Trust Framework for Network Security​
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report
 
cyber-security-reference-architecture
cyber-security-reference-architecturecyber-security-reference-architecture
cyber-security-reference-architecture
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center Fundamental
 
Addressing the cyber kill chain
Addressing the cyber kill chainAddressing the cyber kill chain
Addressing the cyber kill chain
 
Bulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalBulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat Landscapefinal
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for Beginners
 
Rothke secure360 building a security operations center (soc)
Rothke secure360 building a security operations center (soc)Rothke secure360 building a security operations center (soc)
Rothke secure360 building a security operations center (soc)
 
Red team vs Penetration Testing
Red team vs Penetration TestingRed team vs Penetration Testing
Red team vs Penetration Testing
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
 
Vapt life cycle
Vapt life cycleVapt life cycle
Vapt life cycle
 

Ähnlich wie SEC599 - Breaking The Kill Chain

LIFT OFF 2017: Ransomware and IR Overview
LIFT OFF 2017: Ransomware and IR OverviewLIFT OFF 2017: Ransomware and IR Overview
LIFT OFF 2017: Ransomware and IR OverviewRobert Herjavec
 
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...Chris Gates
 
12 Crucial Windows Security Skills for 2018
12 Crucial Windows Security Skills for 201812 Crucial Windows Security Skills for 2018
12 Crucial Windows Security Skills for 2018Paula Januszkiewicz
 
ThreatModeling.ppt
ThreatModeling.pptThreatModeling.ppt
ThreatModeling.ppttashon2
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceTom K
 
CyberSecurity - UH IEEE Presentation 2015-04
CyberSecurity - UH IEEE Presentation 2015-04CyberSecurity - UH IEEE Presentation 2015-04
CyberSecurity - UH IEEE Presentation 2015-04Kyle Lai
 
Cyber Hacking & Security - IEEE - Univ of Houston 2015-04
Cyber Hacking & Security - IEEE - Univ of Houston 2015-04Cyber Hacking & Security - IEEE - Univ of Houston 2015-04
Cyber Hacking & Security - IEEE - Univ of Houston 2015-04Kyle Lai
 
Security testing fundamentals - must need basics to learn Penetration Testing
Security testing fundamentals - must need basics to learn Penetration TestingSecurity testing fundamentals - must need basics to learn Penetration Testing
Security testing fundamentals - must need basics to learn Penetration TestingHaribabu Nandyal Padmanaban
 
01_Metasploit - The Elixir of Network Security
01_Metasploit - The Elixir of Network Security01_Metasploit - The Elixir of Network Security
01_Metasploit - The Elixir of Network SecurityHarish Chaudhary
 
Cyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTCyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTSimone Onofri
 
Microsoft Threat Protection
Microsoft Threat ProtectionMicrosoft Threat Protection
Microsoft Threat ProtectionThierry DEMAN
 
Symantec Cyber Security Services: Security Simulation
Symantec Cyber Security Services: Security SimulationSymantec Cyber Security Services: Security Simulation
Symantec Cyber Security Services: Security SimulationSymantec
 
ethical-hacking-18092013112412-ethical-hacking.ppt
ethical-hacking-18092013112412-ethical-hacking.pptethical-hacking-18092013112412-ethical-hacking.ppt
ethical-hacking-18092013112412-ethical-hacking.pptricagip499
 
Capture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception DefenseCapture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception DefenseFidelis Cybersecurity
 
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)Shah Sheikh
 
(SACON) Wayne Tufek - chapter two - kill chain
(SACON) Wayne Tufek - chapter two - kill chain(SACON) Wayne Tufek - chapter two - kill chain
(SACON) Wayne Tufek - chapter two - kill chainPriyanka Aash
 
Webinar Mastering Microsoft Security von Baggenstos
Webinar Mastering Microsoft Security von BaggenstosWebinar Mastering Microsoft Security von Baggenstos
Webinar Mastering Microsoft Security von BaggenstosJenniferMete1
 
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdf
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdftheVIVI-AD-Security-Workshop_AfricaHackon2019.pdf
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdfGabriel Mathenge
 
The EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsThe EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsAndrea Bissoli
 

Ähnlich wie SEC599 - Breaking The Kill Chain (20)

LIFT OFF 2017: Ransomware and IR Overview
LIFT OFF 2017: Ransomware and IR OverviewLIFT OFF 2017: Ransomware and IR Overview
LIFT OFF 2017: Ransomware and IR Overview
 
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
 
12 Crucial Windows Security Skills for 2018
12 Crucial Windows Security Skills for 201812 Crucial Windows Security Skills for 2018
12 Crucial Windows Security Skills for 2018
 
ThreatModeling.ppt
ThreatModeling.pptThreatModeling.ppt
ThreatModeling.ppt
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
 
CyberSecurity - UH IEEE Presentation 2015-04
CyberSecurity - UH IEEE Presentation 2015-04CyberSecurity - UH IEEE Presentation 2015-04
CyberSecurity - UH IEEE Presentation 2015-04
 
Cyber Hacking & Security - IEEE - Univ of Houston 2015-04
Cyber Hacking & Security - IEEE - Univ of Houston 2015-04Cyber Hacking & Security - IEEE - Univ of Houston 2015-04
Cyber Hacking & Security - IEEE - Univ of Houston 2015-04
 
Security testing fundamentals - must need basics to learn Penetration Testing
Security testing fundamentals - must need basics to learn Penetration TestingSecurity testing fundamentals - must need basics to learn Penetration Testing
Security testing fundamentals - must need basics to learn Penetration Testing
 
01_Metasploit - The Elixir of Network Security
01_Metasploit - The Elixir of Network Security01_Metasploit - The Elixir of Network Security
01_Metasploit - The Elixir of Network Security
 
Cyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTCyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APT
 
Microsoft Threat Protection
Microsoft Threat ProtectionMicrosoft Threat Protection
Microsoft Threat Protection
 
Symantec Cyber Security Services: Security Simulation
Symantec Cyber Security Services: Security SimulationSymantec Cyber Security Services: Security Simulation
Symantec Cyber Security Services: Security Simulation
 
ethical-hacking-18092013112412-ethical-hacking.ppt
ethical-hacking-18092013112412-ethical-hacking.pptethical-hacking-18092013112412-ethical-hacking.ppt
ethical-hacking-18092013112412-ethical-hacking.ppt
 
Capture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception DefenseCapture the Flag Exercise Using Active Deception Defense
Capture the Flag Exercise Using Active Deception Defense
 
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)
 
(SACON) Wayne Tufek - chapter two - kill chain
(SACON) Wayne Tufek - chapter two - kill chain(SACON) Wayne Tufek - chapter two - kill chain
(SACON) Wayne Tufek - chapter two - kill chain
 
Webinar Mastering Microsoft Security von Baggenstos
Webinar Mastering Microsoft Security von BaggenstosWebinar Mastering Microsoft Security von Baggenstos
Webinar Mastering Microsoft Security von Baggenstos
 
Windows network
Windows networkWindows network
Windows network
 
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdf
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdftheVIVI-AD-Security-Workshop_AfricaHackon2019.pdf
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdf
 
The EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsThe EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systems
 

Kürzlich hochgeladen

VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...SUHANI PANDEY
 
Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.soniya singh
 
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort ServiceBusty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort ServiceDelhi Call girls
 
Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts SweatshirtTrump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirtrahman018755
 
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...SUHANI PANDEY
 
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...SUHANI PANDEY
 
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...SUHANI PANDEY
 
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...SUHANI PANDEY
 
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.soniya singh
 
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...tanu pandey
 
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...Escorts Call Girls
 
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.soniya singh
 
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Bookingdharasingh5698
 
Al Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls DubaiAl Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls DubaiEscorts Call Girls
 
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort ServiceEnjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort ServiceDelhi Call girls
 
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...Neha Pandey
 
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls DubaiDubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubaikojalkojal131
 
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...Diya Sharma
 

Kürzlich hochgeladen (20)

VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
 
Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Sarai Rohilla Escort Service Delhi N.C.R.
 
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort ServiceBusty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
 
Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts SweatshirtTrump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirt
 
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
 
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
 
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
 
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
 
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
 
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
 
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
 
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
 
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
 
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
 
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
 
Al Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls DubaiAl Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls Dubai
 
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort ServiceEnjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
 
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
 
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls DubaiDubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
 
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
 

SEC599 - Breaking The Kill Chain

  • 1. SANS Cyber Defense Defense is doable Breaking the Kill Chain NETWORK SECURITY 2018 – 25 September 2018 Erik Van Buggenhout & Stephen Sims
  • 2. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Who are we? – SEC599 Authors & Instructors 2 Stephen Sims SANS Fellow @Steph3nSims Erik Van Buggenhout SANS Certified Instructor @ErikVaBu
  • 3. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 3 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
  • 4. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 4 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
  • 5. Network Security 2018 – Defense is Doable - Breaking the Kill Chain The Cyber Kill Chain 5 Reconnaissan ce Delivery Installation Action on Objectives Weaponizatio n Exploitation Command & Control Adversary perspective Defender perspective
  • 6. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What Is “Red Team” & “Blue Team”? 6 Vulnerability Assessments Penetration Tests Social Engineering “Offense” “Defense” Implementing Controls Security Monitoring Incident Response COMMON GOAL Improve organization security posture
  • 7. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Although they share a common goal, blue and red teams are often not well-aligned, which leads to organizations not leveraging the full value of their team's expertise. They typically report to a different hierarchy, which leads to different objectives: While we don’t necessarily think a purple team is a “third” team, think of it as a concept aimed at bringing the red & blue teams together. Red & blue teams should be encouraged to work as a joint team, share insights & create a strong feedback loop. So, Why a Purple Team? 7 Report with many vulnerabilities = Well done! Success is measured by # of failed controls No big incentive to help blue team, as blue team failure = red team success! No alerts mean that preventive controls are working! Large volume of alerts means detection controls are working (though may need finetuning) No big incentive to help red team, as red team failure = blue team success!
  • 8. Network Security 2018 – Defense is Doable - Breaking the Kill Chain The Purple Team Feedback Loop 8 VULNERABILITY REPORT REPORT ON REMEDIATED FLAWS What is happening now?: But how about some of the following actions?: • Red Team sharing TTPs of new actors with Blue Team • Red Team helping with vulnerability management process (not just assessment) • Blue Team sharing monitoring tactics in place with Red Team • Blue Team sharing playbooks with Red Team Offense must inform defense and defense must inform offense!
  • 9. Network Security 2018 – Defense is Doable - Breaking the Kill Chain SEC599 – A True Purple Team Course 9 SEC599 – Defeating Advanced Adversaries – Purple Team Tactics & Kill Chain Defenses We illustrate what the adversaries are ACTUALLY doing with real-world examples and lab exercises We provide EFFECTIVE strategies to combat adversary tactics throughout all parts of the Kill Chain! SEC599 was built from the ground up by seasoned cyber security experts with vast experience in both blue team & red team operations:
  • 10. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Purple Team – An Example Using Mimikatz & CredentialGuard 10 An example - As part of our “Lateral Movement” section, we will demonstrate how adversaries are stealing credentials from Windows systems using the infamous Mimikatz hacking tool. 1 During the first phase of the lab, you will dump credentials from the LSASS process memory, thereby experiencing the attack (and its impact) first-hand! 2 During the second phase of the lab, we will provide an in-depth explanation of how Windows 10 CredentialGuard works, after which it will be implemented. 3 During the third and final part of the lab, we will re-attempt dumping credentials from the LSASS process memory, thereby confirming effectiveness of our control!
  • 11. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 11 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
  • 12. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows credentials attacks 12 Aside from generic attacks such as phishing or keylogging, the table below lists some of the most common ways used by adversaries to obtain Windows credentials: SANS Senior Instructor Chad Tilbury has an excellent presentation on Windows Credentials Attacks, Mitigations & Defence: https://www.first.org/resources/papers/conf2017/Windows-Credentials-Attacks-and-Mitigation-Techniques.pdf
  • 13. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Introducing some of these tools – Capturing NTLMv2 13 For different reasons, Kerberos could not be available, in which case Windows will revert to NTLMv2 Challenge / Response authentication: Domain Controller 1. Request authentication Service Database Server 2. Challenge 3. Response Client Workstation 6. Server sends response to client The authenticating system uses the hashed credential to calculate a response based on the challenge sent by the server In a Windows domain environment, the NTLM challenge & response will be forwarded to the domain controller for validation of credentials 4. Forward Chal + Resp 5. Validation
  • 14. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Introducing some of these tools – Responder – Capturing NTLMv2 14 Responder is (amongst others) an LLMNR, NBT-NS and MDNS poisoner. It will attempt to trick systems to connect / authenticate to the system it is running on. It will then attempt to sniff the authentication challenge (e.g. NTLMv2), which could be cracked by a password cracking tool.
  • 15. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory 15 Once an initial entry point in the network has been obtained, dumping credentials from LSASS memory in particular has become extremely popular: • Open ups attack vector against users that aren’t locally configured (domain users). Furthermore, stolen credentials are in clear-text (Windows 7) or NT hash (Windows 10) format, so can immediately be reused in Pass-the-Hash attacks • Common attack flow: 1. Obtain local admin access to one system in domain 2. Lure domain admin to machine (e.g. Call Helpdesk) 3. Dump credentials from memory 4. Own the domain (“Domain dominance”) 5. Persist domain ownage (Golden ticket, DCSync, Skeleton Key,…) • Tools like Bloodhound create entire attack trees that reveal relationships between accounts and systems to facilitate this
  • 16. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Common technique 16 Due to its size & complexity, it’s often difficult for administrators to retain a good overview of how privileges are assigned across the environment. Adversaries can leverage this to spot excessive privileges which can be used in lateral movement… AD structure diagrams The below diagram (generated by the attacking tool BloodHoundAD), reveals an interesting way of how adversaries could laterally move through the target environment: In a few steps, Erik could easily steal the hashes of Stephen, thereby obtaining Domain Admin privileges. User: Erik Group: Work- station admins PC: Work- station 1 Group: Domain admins User: Stephen HasSession
  • 17. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Mimikatz 17 Due to its high reliability & flexibility, it is used by adversaries and penetration testers alike. Several variations have been created and it has been included as a module in the Metasploit Meterpreter attacking tool. Mimikatz is a free, open-source Windows tool built by Benjamin Delpy (@gentilkiwi) to extract credentials from Windows computers. Its second version is often referred to as “Kiwi”. “Mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.”
  • 18. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Mimikatz in the news 18 The popularity of Mimikatz has sky-rocketed over the last few years: • In 2017, the NotPetya ransomware used various components of Mimikatz to supports its lateral movement • In several APT investigations, Mimikatz is part of the standard toolkit used by advanced adversaries (Amongst others, Oilrig, Cobalt Kitty & APT-28 have been observed to use (variants of) Mimikatz) • Penetration testing & red teaming frameworks include (variants of) Mimikatz: • Metasploit Meterpreter has a built-in Mimikatz module Powershell Empire has a built-in version of Mimikatz
  • 19. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Dumping credentials from LSASS memory – Some interesting Mimikatz features 19 • To prevent AV detection, Mimikatz supports an offline mode, where a dump of the LSASS process can be fed to Mimikatz. This dump-file can be created by built-in Windows tools (e.g. Task Manager) or the SysInternals toolkit. This removes the need of running a “hacking tool” like Mimikatz on the target system… • Mimikatz can impersonate a Domain Controller and replicate all password hashes using MS-DRSR (Directory Replication Service Remote Protocol), labelled “DCSync” in Mimikatz • Mimikatz can create AD persistence by generating golden tickets or installing a backdoor in memory of the Domain Controller (“Skeleton Key” attack)
  • 20. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 20 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
  • 21. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What’s left behind? 21 http://technet.microsoft.com/en-us/windows-server-docs/security/securing- privileged-access/securing-privileged-access-reference-material
  • 22. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What’s left behind? – Mimikatz point of view 22
  • 23. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Generic recommendations – Privileged Access Workstations 23 Domain controllers network Privileged Access Workstations Inner Network
  • 24. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Generic recommendations – Identity & Access Management 24
  • 25. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Restricted Admin 25 The idea of “Restricted Admin” mode is that credentials are not sent upon establishing of an RDP session, so the chances of capturing them using Mimikatz are lower! Source: https://docs.microsoft.com/en-us/windows/access-protection/remote-credential-guard
  • 26. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Restricted Admin 26
  • 27. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Protected Processes 27 In order to prevent hash dumping attacks aimed at the LSA process, Microsoft introduced “Protected Processes” as of Windows 8 & Windows Server 2012. • Protected processes were first introduced in Windows Vista for DRM (Digital Rights Management) purposes, but were adapted for “security purposes” in Windows 8 • The screenshot on the right provides an example of the lsass.exe process running as a “protected process” • Protected Processes are implemented in the Kernel software and can thus be defeated…
  • 28. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Protected Processes 28
  • 29. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Protected Processes 29
  • 30. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Focused improvements - Windows 8 / 2012 – Domain Protected Users 30 “Protected Users” enforces a number of restrictions on affected users, which try to defend against several of the attack strategies previously mentioned: Disable authentication using NTLM => Protect against Responder-style attacks Wdigest & CredSSP clear-text credentials no longer stored in LSASS => Less results when LSASS memory dumping On a device running Windows 8.1, passwords are not cached => Protect against dumping of cached credentials (default Windows: 10 latest users) Kerberos will not use DES or RC4 during pre-authentication => Protect against “Kerberoasting” attacks
  • 31. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Introducing CredentialGuard 31
  • 32. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows high-level architecture – Without CredentialGuard 32
  • 33. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Having a look at the processes – Without CredentialGuard 33
  • 34. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows high-level architecture – With CredentialGuard 34 When Credential Guard is enabled, the LSA process still runs in userland. The actual credentials are stored in the isolated LSA process (LsaIso.exe). This process does not run under Windows, but in the Virtual Secure Mode.
  • 35. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Windows high-level architecture – With CredentialGuard 35
  • 36. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Some caveats 36
  • 37. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Some caveats – Another interesting attack strategy! 37
  • 38. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Some caveats – Another interesting attack strategy! 38
  • 39. Network Security 2018 – Defense is Doable - Breaking the Kill Chain What we’d like to discuss today 39 Quick Introduction The Cyber Kill Chain Windows credentials attacks A deep-dive: Windows credentials attack in the Kill Chain Windows credentials defenses A deep-dive: Effectiveness of Windows credential defenses Demo The proof is in the pudding!CredentialGuard VS
  • 40. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Demo time 40
  • 41. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Conclusion 41
  • 42. Network Security 2018 – Defense is Doable - Breaking the Kill Chain Want to learn more? 42 Want to learn more? Join SEC599 - Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses • San Diego (CA) – November 2018 • Scottsdale (AZ) – December 2018 • Washington (DC) – December 2018 • Las Vegas (NV) – January 2019 • Reno (NV) – February 2019 • Baltimore (MD) – March 2019 More locations available at https://www.sans.org/course/defeating-advanced-adversaries- kill-chain-defenses

Hinweis der Redaktion

  1. Welcome to SANS Security SEC599: Defeating Advanced Adversaries. In this course, you will build essential skills required to fend off today’s advanced cyber attacks. The course will be highly hands-on, as we help you develop skills by exercising them in hands-on, realistic lab settings. Although this is not a penetration testing course, we will have sufficient attention for the offensive side of the spectrum. We will provide you with a deep technical understanding of how advanced adversaries work, as this will help us be more efficient defenders. Likewise, we will inform you on how to respond to cyber security attacks, but will primarily focus on how to prevent and detect them. Our goal is to keep the course as interactive as possible. If you have a question, please let the instructor know. Discussions about relevant topics are incredibly important in a class like this, as we have numerous attendees with various levels of skill coming into the class. Share your insights and ask questions. The instructor does reserve the right, however, to take a conversation offline during a break or outside of class in the interest of time and applicability of the topic. As course authors, we welcome any comments, questions, or suggestions pertaining to the course material. We would also like to extend our thanks to Didier Stevens (a SANS ISC handler), whose contributions greatly helped improve the course. Erik Van Buggenhout erik.van.buggenhout@gmail.com www.nviso.be Stephen Sims ssims@sans.org www.sans.org Update: C01
  2. The Cyber Kill Chain ® As we are the defenders of digital assets of our company or organization, we face adversaries using digital methods to attack our digital assets. It would be useful to have a digital equivalent of the military kill chain so that we can structure our defenses accordingly. Different groups and organizations have worked on documenting adversaries' methods in a digital kill chain. Lockheed Martin developed the trademarked “Cyber Kill Chain ®”, which has risen in popularity to become one of the most used frameworks to describe cyber attacks. An alternative, slightly adopted variant is Dell SecureWorks’ “Cyber Kill Chain”. Both chains have more steps than the military kill chain. Lockheed Martin: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions On Objectives. Dell SecureWorks: Target Defined, Recon, Development, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives, Objective Met For the purpose of our course, we will follow a similar structure, as most online publications related to cyber attacks do the same. References: http://www.lockheedmartin.com/us/what-we-do/aerospace-defense/cyber/cyber-kill-chain.html https://www.secureworks.com/resources/wp-breaking-the-kill-chain
  3. What Is “Red Team” & “Blue Team”? Traditionally, information security efforts have been split in a red team and blue team. The red team is mostly focused on offensive activities, where they attempt to test / bypass security controls implemented by an organization. On the other hand, the blue team focuses is implementing security controls, monitoring their effectiveness and responding in case of incidents. Both however share a common goal: improving the defenses of the organization! The list below is by no means exhaustive, but includes a number of typical red team activities: Vulnerability assessments, where a report is delivered that provides insights; Penetration tests, where red teams attempt to abuse identified vulnerabilities; Social engineering, where the overall security awareness of the organization staff is tested. Likewise, the list below is by no means exhaustive, but includes a number of typical blue team activities: Implementing security controls in order to prevent adversaries (& the red team) obtaining unauthorized access to the organization’s environment; Perform security monitoring & threat hunting to detect unauthorized access and to improve the security controls that have been implemented; Incident response, where the blue team responds to detected incidents. In most organizations, at least a part of these blue and red team capabilities are delivered by third parties (e.g. contractors, specialized firms …)
  4. So, Why a Purple Team? Although they share a common goal, blue and red teams are often not well-aligned, which leads to organizations not leveraging the full value of their team's expertise. They typically report to a different hierarchy, which leads to different objectives… Even if they “get along”, they might not have an intuitive nature to work together… Robert Wood and William Bengston delivered an interesting presentation at RSA 2016 (“The Rise of the Purple Team”), where they highlight this problem. Consider the following: For the red team, an assessment report with many vulnerabilities means they have done a good job. Indeed, the success of the red team activities is measured by the number of failed (or bypassed) security controls. For the blue team, a lack of alerts means that preventive controls are working, while a large volume of alerts indicates that detection controls are working (although they may need finetuning). Given the above, there is no big incentive for either the red team or the blue team to help “the other side”… While we don’t necessarily think a purple team is a “third” team, think of it as a concept aimed at bringing the red & blue teams together. Red & blue teams should be encouraged to work as a joint team, share insights & create a strong feedback loop.
  5. The Purple Team Feedback Loop We would like to further expand on the Purple Team feedback loop. It’s vital to stress that a feedback loop is NOT just the red team delivering a penetration testing report full of vulnerabilities to the blue team, and the blue team responding how they remediated the flaws. This is what we observe in many organizations, but it missed out on a variety of other improvement possibilities: How about the red team sharing new TTPs (Tactics, Techniques & Procedures) with the blue team, so they can prepare for new red team exercises? How about the red team helping with the overall vulnerability management process and thus adapting its reporting style to the blue team vulnerability management process? (creating tickets or bug reports as opposed to writing a 120-page PDF) How about the blue team sharing existing monitoring in place with the Red Team, to help them better prepare their next red team engagement? How about the blue team sharing the existing incident response playbooks with the red team? This list is again not meant to be exhaustive, but it provides an interesting insight in additional knowledge sharing opportunities that could be leveraged as part of a strong feedback loop. Overall, we should “reward” the red team and blue team on the knowledge increase and progress that is made by both teams! Offense must inform defense and defense must inform offense!
  6. SEC599 – A True Purple Team Course SEC599 was authored with these problems in mind… How do we bridge the “gap” between the red and blue teams? In order to accomplish our goal, we assembled a team of experienced instructors with a key focus on red team operations (Stephen Sims & Erik Van Buggenhout) and added a number of our most well-known SANS ISC (Internet Storm Center) handlers (including malware analyst Didier Stevens). Together, they provide a unique mix of offensive & defensive skills bundled in 1 course! So how do we approach cyber security concepts throughout the course? In order to implement effective security controls, we are convinced it is vital to first understand how adversaries operate. We will thus first explain offensive security techniques, explaining how organizations are currently being compromised. These will be hands-on, and students will use the latest techniques to compromise a target network; Once completed, we will deliver an in-depth explanation of what defensive controls can help mitigate the attack technique used above. We will also deploy the mitigating control in our infrastructure, after which we test its successful implementation!
  7. Purple Team – An Example Using Mimikatz & CredentialGuard You may find that this does sound slightly theoretical. So, how does this work in practice? An ideal example to explain this approach is how we handle the lateral movement section of the course. One of the most popular techniques used by adversaries is to leverage the infamous Mimikatz hacking tool to dump hashes from the LSASS process. How do we approach this in SEC599? During the first phase of the lab, you will dump credentials from the LSASS process memory, thereby experiencing the attack (and its impact) first-hand! During the second phase of the lab, we will provide an in-depth explanation of how Windows 10 CredentialGuard works, after which it will be implemented. During the third and final part of the lab, we will re-attempt dumping credentials from the LSASS process memory, thereby confirming effectiveness of our control!