SlideShare una empresa de Scribd logo

Building a Successful Internal Adversarial Simulation Team - Chris Gates & Chris Nickerson

•
•
Chris Gates
Chris Gates

Brucon 2016 The evolution chain in security testing is fundamentally broken due to a lack of understanding, reduction of scope, and a reliance on vulnerability “whack a mole.” To help break the barriers of the common security program we are going to have to divorce ourselves from the metrics of vulnerability statistics and Pavlovian risk color charts and really get to work on how our security programs perform during a REAL event. To do so, we must create an entirely new set of metrics, tests, procedures, implementations and repeatable process. It is extremely rare that a vulnerability causes a direct risk to an environment, it is usually what the attacker DOES with the access gained that matters. In this talk we will discuss the way that Internal and external teams have been created to simulate a REAL WORLD attack and work hand in hand with the Defensive teams to measure the environments resistance to the attacks. We will demonstrate attacks, capabilities, TTP’s tracking, trending, positive metrics, hunt integration and most of all we will lay out a road map to STOP this nonsense of Red vs BLUE and realize that we are all on the same team. Sparring and training every day to be ready for the fight when it comes to us.

Tecnología
1 de 73
aka: Some new term to use because we keep screwing up terminology and treating people like children with a crayon box Adversarial Modeling Exercises Simulation
HI…I’m Chris
and…I’m Chris
•  Cursing •  Racism •  Religious Prejudice •  Sex •  Drugs •  Daddy / Abandonment issues •  Socio Economic Hate crimes •  Thin Skin •  Lack of sense of humor •  Sexual orientation •  Sexism •  Violence •  Vomiting •  Abuse • Truth • Fear • Honesty • Facts • Emotions • Opinions
Chris Gates - Sr. Incident Response Engineer - Uber Twitter: @carnal0wnage Blog: carnal0wnage.attackresearch.com Talks: slideshare.net/chrisgates
http://www.pentest-standard.org/
A story •  Got Red Teamed at work •  It was not fun •  I’m usually the person bringing the pain, not receiving it •  Tons of thoughts and emotions
A story Initially
A story Then… reflection
A story Then… realization •  I was probably that a$$hole on the phone •  Actually, I’m sure of it •  Super difficult to give valid recommendations in a generic way •  I’m blind to internal processes, roadmaps, politics
A story We give recommendations like these:
A story •  Do a bunch of complex recommendations, then you’ll be “secure” •  Most org fail at the basics, but basics aren’t sexy •  In fact tell an org they need to do a bunch of basic hardening and see if you get follow-on work
Problems With Testing Today •  Limited metrics •  Increased Tech debt •  Fracturing of TEAM mentality •  Looks NOTHING like an attack •  Gives limited experience •  Is a step above Vuln Assessment •  Is NOT essential to the success of the organization •  Is REALLY just a glorified internal pentest team
Building a successful internal Adversarial Simulation Team
Easy! Standard players: (limited scope, limited flexibility) Step #1: Get people who can do the hack Step #1.5: Complain about the scope Step #2: Hack all the things! Step #3: Write up stuff to tell people why the hax iz bad. Advanced players: ( increased scope and flexibility) Step #4: Tell Defense Team how u did hax Step #5: Defense team does defensive’y stuff or blames team that refuses to patch the thing Step #6: repeat
Terminology: Gotta get a few things straight first •  We keep screwing up terms •  Vulnerability Assessment person ( U ran a Vuln scanner?) •  Penetration Tester ( U hit autopwn) •  Red Teamer ( U hit autopwn and moved laterally? Maybe even found “sensitive stuff”) •  Purple Teamer (U did all of the above but charged more to talk with the defense teams during the test) •  ADVERSARIAL ENGINEER (U exist to simulate real world TTP’s, generate experience, and provide metric scoring of corporate readiness/resistance to attack)
https://attack.mitre.org/wiki/Main_Page
#1 You need a charter and a Problem statement
Charter •  Analyze real world threats against $Company. •  Develop attack models which validate our detection capabilities. •  Validate our detection, prevention, and response against real world threats. •  Provide metrics around $Company’s corporate readiness/ resistance to various attacks across a broad set of threat tactics, techniques, and procedures (TTPs)  via table top exercises, automated, and manual testing. •  GOAL: Predict likelihood of successful attacks before they happen
#2 Define how you will accomplish solving the problem and how the team will get/consume projects
Red Team Management Blue Team Add Item to Concerns List Collaboration, Prioritization, and Sequencing Meeting Categorize Type of Work and Time Requirement. Penetration Testing and Adversary Simulation Assessment (Full or Mini) TTP Replay Consulting and Assistance Assign Work to appropriate resources Summarize, Document, and Report Findings Update Internal Documentation, Processes, and Methodology Threat Intel New Vuln or Technique? Enter into Vuln DBVuln? Enter into Matrix Technique? End Gather Budget Information and Approvals Notify affected groups of requested work and expected timeline Update Attack Wiki TTP Matrix
#3 Create a repeatable strategy for execution of simulations
•  Unit testing for you detection rules •  You don’t deploy untested code to prod do you? •  Automate attacks and verify responses
Example
Example
Example
#4 Creation of an information sharing platform and knowledgebase
#5 Assemble your team and tools Think ahead, This is not your normal pentest team! •  Servers •  Storage •  Hardware •  Tools •  Implants •  Customizations •  Virtualization infrastructure •  Access to all defensive tools •  Built out lab environments to recreate / replicate •  Cracking Rigs and more…
#6 Create formal collateral •  Introduction of the team and it’s capabilities •  Services Line Card •  Engineering bios and availability •  Scoping documentation/questionnaires •  Rules of engagement •  Internal information handling policy, procedure, process •  Engagement request process •  Defensive Team Collaboration Workflow •  Threat Intel Team Collaboration Workflow •  Approval notification Protocols •  Templated / Automated reporting output •  Team Member Skill matrix
#7 Defensive Coverage Assessment
#8 Provide Metrics that evaluate each TTP from a protective, detective and response perspective
Color Key: Detec-on Maturity Protec-on Maturity 0 No Detec-on Controls No Protec-on Controls 1 Non-Centralized Logging Par-ally Deployed 2 Centralized Logging, but no Alerts Fully Deployed but Defeatable 3 Centralized Logs, Reac-ve, Insufficient Alerts, false nega-ves or posi-ves (Func-onal) Fully Deployed, Non-Defeatable 4 Centralized, Automated Alerts, Proac-ve, Requires response, no false posi-ves (Stable) Fully Deployed, Non-Defeatable, and Aler-ng in place
Technique Func0on Methods for detec0on Methods for protec0on Detec0on Mat urity Protec0on Mat urity Last Test Date LSASS password/ hash recovery Local Security Authority Subsystem Service (LSASS) is a process in MicrosoH Windows opera0ng systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. (from Wikipedia) For the purposes of Single Sign On (SSO) in Windows environments, lsass also stores the NT hash and some0mes, in the case of wdigest, the cleartext creden0als of users who have logged into the system. These can be recovered by dumping the contents of the process in memory through use tools such as procdump and mimikatz. The most op0mal way to detect this is to iden0fy processes that are crossproc'd into lsass. The signal to noise ra0o here is high, due to the nature of lsass' func0on. Typically meterpreter uses rundll32 to run, so iden0fying rundll32 into lsass along with processes injected into winlogon that cross process into lsass will reliably iden0fy malicious ac0vity An automated password management tool such as CyberArk can be used to randomize passwords and change them aHer every use, thus decreasing the efficacy of mimikatz as any recovered creden0al will likely be expired. Further, on all windows 8/2012+ desktops and servers, wdigest should be disabled in accordance with the following KB ar0cle from MicrosoH: h]ps://support.microsoH.com/en-us/kb/ 2871997 Enforcing the principle of Least User Access will also help mi0gate the effec0veness of mimikatz as it will limit the access provided by the compromised creden0als. Lastly, adding some form of Two Factor Authen0ca0on, such as smart cards, can further limit the usefulness of the recovered creden0als. Rules wri]en in carbon black to detect cross process ac0vity from rundll32 into lsass Rule wri]en to iden0fy PowerShell crossproc into lsass. Addi0onal rule wri]en to detect an injected process into winlogon with cross process ac0vity into lsass . 32FA (user-land only), some CyberArk usage, some creden0als flushed every 24 hours 1 4/7/2016
#9 Evaluate adversarial skill to determine urgency of simulation
#10 Re-prioritize workload of Adversarial team based on TTP last test date (decay) or based on other external drivers (ex. TTP is used in a current attack campaign)
#11 Defensive Measurement Now that we have measured RT ability to conduct attacks Now we need to gather defensive metrics •  Total Coverage •  Mean Time to Detection •  Mean Time to Remediation •  % Successful Eradication •  Protection Metrics •  Automated vs Manual Detection •  Automated vs Manual Response
Adversarial Simulation Dashboard
Total Protection/Detection/Response Potential P/D/R Actual P/D/R $Company asks “What do we do next, buy more stuff?” Execution Gap Coverage Gap
Future Work
The Future •  Automate Red Team / Blue Team correlation •  Automate Attack Path simulation •  Predict impact of new attacks without running them •  Predicting probability of attack chains •  Reduced risk testing model •  Zero testing debt •  Response metrics via API queries of security tooling •  Tracking defensive TTPs •  Understand how all security tooling come together
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Chris Nickerson

Recomendados

Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Jorge Orchilles
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMCon
Jorge Orchilles
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE - ATT&CKcon
 
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Chris Gates
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 

Recomendados

Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Jorge Orchilles
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMCon
Jorge Orchilles
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE - ATT&CKcon
 
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Chris Gates
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report
Morane Decriem
 
Purple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyPurple Team Use Case - Security Weekly
Purple Team Use Case - Security Weekly
Jorge Orchilles
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
Jorge Orchilles
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
Mark Arena
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
Deepak Kumar (D3)
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
👀 Joe Gray
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeam
Dan Vasile
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testing
Amine SAIGHI
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
Hostway|HOSTING
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Christopher Korban
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018
Christopher Korban
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
Erik Van Buggenhout
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 
Home Arcade setup (NoVA Hackers)
Home Arcade setup (NoVA Hackers)Home Arcade setup (NoVA Hackers)
Home Arcade setup (NoVA Hackers)
Chris Gates
 
DevOOPS: Attacks and Defenses for DevOps Toolchains
DevOOPS: Attacks and Defenses for DevOps ToolchainsDevOOPS: Attacks and Defenses for DevOps Toolchains
DevOOPS: Attacks and Defenses for DevOps Toolchains
Chris Gates
 

Más contenido relacionado

La actualidad más candente

MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
👀 Joe Gray
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 

La actualidad más candente (20)

Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report
 
Purple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyPurple Team Use Case - Security Weekly
Purple Team Use Case - Security Weekly
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeam
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testing
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
 

Destacado

Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
Chris Gates
 
DevOops & How I hacked you DevopsDays DC June 2015
DevOops & How I hacked you DevopsDays DC June 2015DevOops & How I hacked you DevopsDays DC June 2015
DevOops & How I hacked you DevopsDays DC June 2015
Chris Gates
 

Destacado (20)

Home Arcade setup (NoVA Hackers)
Home Arcade setup (NoVA Hackers)Home Arcade setup (NoVA Hackers)
Home Arcade setup (NoVA Hackers)
 
DevOOPS: Attacks and Defenses for DevOps Toolchains
DevOOPS: Attacks and Defenses for DevOps ToolchainsDevOOPS: Attacks and Defenses for DevOps Toolchains
DevOOPS: Attacks and Defenses for DevOps Toolchains
 
Going Purple : From full time breaker to part time fixer: 1 year later
Going Purple : From full time breaker to part time fixer: 1 year later Going Purple : From full time breaker to part time fixer: 1 year later
Going Purple : From full time breaker to part time fixer: 1 year later
 
Open Canary - novahackers
Open Canary - novahackersOpen Canary - novahackers
Open Canary - novahackers
 
Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
 
ColdFusion for Penetration Testers
ColdFusion for Penetration TestersColdFusion for Penetration Testers
ColdFusion for Penetration Testers
 
Cloud Security Monitoring at Auth0 - Art into Science
Cloud Security Monitoring at Auth0 - Art into ScienceCloud Security Monitoring at Auth0 - Art into Science
Cloud Security Monitoring at Auth0 - Art into Science
 
Home Lab Fundamentals - The Why's and How's
Home Lab Fundamentals - The Why's and How'sHome Lab Fundamentals - The Why's and How's
Home Lab Fundamentals - The Why's and How's
 
La informática se creó en las calles: Microhistorias de Apple y Microsoft
La informática se creó en las calles: Microhistorias de Apple y MicrosoftLa informática se creó en las calles: Microhistorias de Apple y Microsoft
La informática se creó en las calles: Microhistorias de Apple y Microsoft
 
Auditing Mobile Applications
Auditing Mobile ApplicationsAuditing Mobile Applications
Auditing Mobile Applications
 
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
 
Pentesting
PentestingPentesting
Pentesting
 
Cloud Security Monitoring at Auth0 - Security BSides Seattle
Cloud Security Monitoring at Auth0 - Security BSides SeattleCloud Security Monitoring at Auth0 - Security BSides Seattle
Cloud Security Monitoring at Auth0 - Security BSides Seattle
 
Appsec DC - wXf -2010
Appsec DC - wXf -2010Appsec DC - wXf -2010
Appsec DC - wXf -2010
 
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
 
Top Security Challenges Facing Credit Unions Today
Top Security Challenges Facing Credit Unions TodayTop Security Challenges Facing Credit Unions Today
Top Security Challenges Facing Credit Unions Today
 
hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2
hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2
hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2
 
Windows attacks - AT is the new black
Windows attacks - AT is the new blackWindows attacks - AT is the new black
Windows attacks - AT is the new black
 
DevOops & How I hacked you DevopsDays DC June 2015
DevOops & How I hacked you DevopsDays DC June 2015DevOops & How I hacked you DevopsDays DC June 2015
DevOops & How I hacked you DevopsDays DC June 2015
 
Dirty Little Secrets They Didn't Teach You In Pentest Class v2
Dirty Little Secrets They Didn't Teach You In Pentest Class v2Dirty Little Secrets They Didn't Teach You In Pentest Class v2
Dirty Little Secrets They Didn't Teach You In Pentest Class v2
 

Similar a Building a Successful Internal Adversarial Simulation Team - Chris Gates & Chris Nickerson

How an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software SystemsHow an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software Systems
Security Innovation
 

Similar a Building a Successful Internal Adversarial Simulation Team - Chris Gates & Chris Nickerson (20)

Janitor vs cleaner
Janitor vs cleanerJanitor vs cleaner
Janitor vs cleaner
 
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
 
Software Security Initiative Capabilities: Where Do I Begin?
Software Security Initiative Capabilities: Where Do I Begin? Software Security Initiative Capabilities: Where Do I Begin?
Software Security Initiative Capabilities: Where Do I Begin?
 
Attack Simulation and Hunting
Attack Simulation and HuntingAttack Simulation and Hunting
Attack Simulation and Hunting
 
Fun with Application Security
Fun with Application SecurityFun with Application Security
Fun with Application Security
 
The_Pentester_Blueprint.pdf
The_Pentester_Blueprint.pdfThe_Pentester_Blueprint.pdf
The_Pentester_Blueprint.pdf
 
WTF is Penetration Testing
WTF is Penetration TestingWTF is Penetration Testing
WTF is Penetration Testing
 
Truth and Consequences
Truth and ConsequencesTruth and Consequences
Truth and Consequences
 
So, you wanna be a pen tester
So, you wanna be a pen testerSo, you wanna be a pen tester
So, you wanna be a pen tester
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
When is a Red Team a Red Team
When is a Red Team a Red TeamWhen is a Red Team a Red Team
When is a Red Team a Red Team
 
How an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software SystemsHow an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software Systems
 
Sexy defense
Sexy defenseSexy defense
Sexy defense
 
So, you wanna be a pen tester ctsc2017
So, you wanna be a pen tester ctsc2017So, you wanna be a pen tester ctsc2017
So, you wanna be a pen tester ctsc2017
 
JavaLand 2022 - Debugging distributed systems
JavaLand 2022 - Debugging distributed systemsJavaLand 2022 - Debugging distributed systems
JavaLand 2022 - Debugging distributed systems
 
GOTO night April 2022 - Debugging distributed systems
GOTO night April 2022 - Debugging distributed systemsGOTO night April 2022 - Debugging distributed systems
GOTO night April 2022 - Debugging distributed systems
 
ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011
 
Debugging distributed systems
Debugging distributed systemsDebugging distributed systems
Debugging distributed systems
 
KringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive SecurityKringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive Security
 
The Journey to DevSecOps
The Journey to DevSecOpsThe Journey to DevSecOps
The Journey to DevSecOps
 

Más de Chris Gates

Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
Chris Gates
 
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
Chris Gates
 
LasCon 2014 DevOoops
LasCon 2014 DevOoops LasCon 2014 DevOoops
LasCon 2014 DevOoops
Chris Gates
 
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXfSOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
Chris Gates
 
Hacking Oracle Web Applications With Metasploit
Hacking Oracle Web Applications With MetasploitHacking Oracle Web Applications With Metasploit
Hacking Oracle Web Applications With Metasploit
Chris Gates
 
Attacking Oracle with the Metasploit Framework
Attacking Oracle with the Metasploit FrameworkAttacking Oracle with the Metasploit Framework
Attacking Oracle with the Metasploit Framework
Chris Gates
 

Más de Chris Gates (15)

Reiki 101 - Defcon29 MHHV
Reiki 101 - Defcon29 MHHVReiki 101 - Defcon29 MHHV
Reiki 101 - Defcon29 MHHV
 
WeirdAAL (Awesome Attack Library) CactusCon 2018
WeirdAAL (Awesome Attack Library) CactusCon 2018WeirdAAL (Awesome Attack Library) CactusCon 2018
WeirdAAL (Awesome Attack Library) CactusCon 2018
 
WeirdAAL (AWS Attack Library)
WeirdAAL (AWS Attack Library) WeirdAAL (AWS Attack Library)
WeirdAAL (AWS Attack Library)
 
PENETRATION TESTING FROM A HOT TUB TIME MACHINE
PENETRATION TESTING FROM A HOT TUB TIME MACHINEPENETRATION TESTING FROM A HOT TUB TIME MACHINE
PENETRATION TESTING FROM A HOT TUB TIME MACHINE
 
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
 
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
 
LasCon 2014 DevOoops
LasCon 2014 DevOoops LasCon 2014 DevOoops
LasCon 2014 DevOoops
 
MSF Auxiliary Modules
MSF Auxiliary ModulesMSF Auxiliary Modules
MSF Auxiliary Modules
 
Lares from LOW to PWNED
Lares from LOW to PWNEDLares from LOW to PWNED
Lares from LOW to PWNED
 
Open Source Information Gathering Brucon Edition
Open Source Information Gathering Brucon EditionOpen Source Information Gathering Brucon Edition
Open Source Information Gathering Brucon Edition
 
Big Bang Theory: The Evolution of Pentesting High Security Environments
Big Bang Theory: The Evolution of Pentesting High Security EnvironmentsBig Bang Theory: The Evolution of Pentesting High Security Environments
Big Bang Theory: The Evolution of Pentesting High Security Environments
 
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXfSOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
 
Hacking Oracle Web Applications With Metasploit
Hacking Oracle Web Applications With MetasploitHacking Oracle Web Applications With Metasploit
Hacking Oracle Web Applications With Metasploit
 
Attacking Oracle with the Metasploit Framework
Attacking Oracle with the Metasploit FrameworkAttacking Oracle with the Metasploit Framework
Attacking Oracle with the Metasploit Framework
 
Client-Side Penetration Testing Presentation
Client-Side Penetration Testing PresentationClient-Side Penetration Testing Presentation
Client-Side Penetration Testing Presentation
 

Último

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Roshan Dwivedi
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
Safe Software
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Miguel Araújo
 

Último (20)

AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 

Building a Successful Internal Adversarial Simulation Team - Chris Gates & Chris Nickerson

  • 1. aka: Some new term to use because we keep screwing up terminology and treating people like children with a crayon box Adversarial Modeling Exercises Simulation
  • 2.
  • 5.
  • 6. •  Cursing •  Racism •  Religious Prejudice •  Sex •  Drugs •  Daddy / Abandonment issues •  Socio Economic Hate crimes •  Thin Skin •  Lack of sense of humor •  Sexual orientation •  Sexism •  Violence •  Vomiting •  Abuse • Truth • Fear • Honesty • Facts • Emotions • Opinions
  • 7.
  • 8.
  • 9. Chris Gates - Sr. Incident Response Engineer - Uber Twitter: @carnal0wnage Blog: carnal0wnage.attackresearch.com Talks: slideshare.net/chrisgates
  • 10.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.
  • 18.
  • 19. A story •  Got Red Teamed at work •  It was not fun •  I’m usually the person bringing the pain, not receiving it •  Tons of thoughts and emotions
  • 22. A story Then… realization •  I was probably that a$$hole on the phone •  Actually, I’m sure of it •  Super difficult to give valid recommendations in a generic way •  I’m blind to internal processes, roadmaps, politics
  • 23. A story We give recommendations like these:
  • 24. A story •  Do a bunch of complex recommendations, then you’ll be “secure” •  Most org fail at the basics, but basics aren’t sexy •  In fact tell an org they need to do a bunch of basic hardening and see if you get follow-on work
  • 25.
  • 26. Problems With Testing Today •  Limited metrics •  Increased Tech debt •  Fracturing of TEAM mentality •  Looks NOTHING like an attack •  Gives limited experience •  Is a step above Vuln Assessment •  Is NOT essential to the success of the organization •  Is REALLY just a glorified internal pentest team
  • 27. Building a successful internal Adversarial Simulation Team
  • 28. Easy! Standard players: (limited scope, limited flexibility) Step #1: Get people who can do the hack Step #1.5: Complain about the scope Step #2: Hack all the things! Step #3: Write up stuff to tell people why the hax iz bad. Advanced players: ( increased scope and flexibility) Step #4: Tell Defense Team how u did hax Step #5: Defense team does defensive’y stuff or blames team that refuses to patch the thing Step #6: repeat
  • 29.
  • 30. Terminology: Gotta get a few things straight first •  We keep screwing up terms •  Vulnerability Assessment person ( U ran a Vuln scanner?) •  Penetration Tester ( U hit autopwn) •  Red Teamer ( U hit autopwn and moved laterally? Maybe even found “sensitive stuff”) •  Purple Teamer (U did all of the above but charged more to talk with the defense teams during the test) •  ADVERSARIAL ENGINEER (U exist to simulate real world TTP’s, generate experience, and provide metric scoring of corporate readiness/resistance to attack)
  • 31.
  • 33.
  • 34.
  • 35. #1 You need a charter and a Problem statement
  • 36. Charter •  Analyze real world threats against $Company. •  Develop attack models which validate our detection capabilities. •  Validate our detection, prevention, and response against real world threats. •  Provide metrics around $Company’s corporate readiness/ resistance to various attacks across a broad set of threat tactics, techniques, and procedures (TTPs)  via table top exercises, automated, and manual testing. •  GOAL: Predict likelihood of successful attacks before they happen
  • 37. #2 Define how you will accomplish solving the problem and how the team will get/consume projects
  • 39. #3 Create a repeatable strategy for execution of simulations
  • 40.
  • 41.
  • 42. •  Unit testing for you detection rules •  You don’t deploy untested code to prod do you? •  Automate attacks and verify responses
  • 46. #4 Creation of an information sharing platform and knowledgebase
  • 47.
  • 48. #5 Assemble your team and tools Think ahead, This is not your normal pentest team! •  Servers •  Storage •  Hardware •  Tools •  Implants •  Customizations •  Virtualization infrastructure •  Access to all defensive tools •  Built out lab environments to recreate / replicate •  Cracking Rigs and more…
  • 49. #6 Create formal collateral •  Introduction of the team and it’s capabilities •  Services Line Card •  Engineering bios and availability •  Scoping documentation/questionnaires •  Rules of engagement •  Internal information handling policy, procedure, process •  Engagement request process •  Defensive Team Collaboration Workflow •  Threat Intel Team Collaboration Workflow •  Approval notification Protocols •  Templated / Automated reporting output •  Team Member Skill matrix
  • 51.
  • 52. #8 Provide Metrics that evaluate each TTP from a protective, detective and response perspective
  • 53. Color Key: Detec-on Maturity Protec-on Maturity 0 No Detec-on Controls No Protec-on Controls 1 Non-Centralized Logging Par-ally Deployed 2 Centralized Logging, but no Alerts Fully Deployed but Defeatable 3 Centralized Logs, Reac-ve, Insufficient Alerts, false nega-ves or posi-ves (Func-onal) Fully Deployed, Non-Defeatable 4 Centralized, Automated Alerts, Proac-ve, Requires response, no false posi-ves (Stable) Fully Deployed, Non-Defeatable, and Aler-ng in place
  • 54. Technique Func0on Methods for detec0on Methods for protec0on Detec0on Mat urity Protec0on Mat urity Last Test Date LSASS password/ hash recovery Local Security Authority Subsystem Service (LSASS) is a process in MicrosoH Windows opera0ng systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. (from Wikipedia) For the purposes of Single Sign On (SSO) in Windows environments, lsass also stores the NT hash and some0mes, in the case of wdigest, the cleartext creden0als of users who have logged into the system. These can be recovered by dumping the contents of the process in memory through use tools such as procdump and mimikatz. The most op0mal way to detect this is to iden0fy processes that are crossproc'd into lsass. The signal to noise ra0o here is high, due to the nature of lsass' func0on. Typically meterpreter uses rundll32 to run, so iden0fying rundll32 into lsass along with processes injected into winlogon that cross process into lsass will reliably iden0fy malicious ac0vity An automated password management tool such as CyberArk can be used to randomize passwords and change them aHer every use, thus decreasing the efficacy of mimikatz as any recovered creden0al will likely be expired. Further, on all windows 8/2012+ desktops and servers, wdigest should be disabled in accordance with the following KB ar0cle from MicrosoH: h]ps://support.microsoH.com/en-us/kb/ 2871997 Enforcing the principle of Least User Access will also help mi0gate the effec0veness of mimikatz as it will limit the access provided by the compromised creden0als. Lastly, adding some form of Two Factor Authen0ca0on, such as smart cards, can further limit the usefulness of the recovered creden0als. Rules wri]en in carbon black to detect cross process ac0vity from rundll32 into lsass Rule wri]en to iden0fy PowerShell crossproc into lsass. Addi0onal rule wri]en to detect an injected process into winlogon with cross process ac0vity into lsass . 32FA (user-land only), some CyberArk usage, some creden0als flushed every 24 hours 1 4/7/2016
  • 55.
  • 56.
  • 57.
  • 58. #9 Evaluate adversarial skill to determine urgency of simulation
  • 59.
  • 60.
  • 61. #10 Re-prioritize workload of Adversarial team based on TTP last test date (decay) or based on other external drivers (ex. TTP is used in a current attack campaign)
  • 62.
  • 63. #11 Defensive Measurement Now that we have measured RT ability to conduct attacks Now we need to gather defensive metrics •  Total Coverage •  Mean Time to Detection •  Mean Time to Remediation •  % Successful Eradication •  Protection Metrics •  Automated vs Manual Detection •  Automated vs Manual Response
  • 64.
  • 65.
  • 66.
  • 68.
  • 69.
  • 70. Total Protection/Detection/Response Potential P/D/R Actual P/D/R $Company asks “What do we do next, buy more stuff?” Execution Gap Coverage Gap
  • 72. The Future •  Automate Red Team / Blue Team correlation •  Automate Attack Path simulation •  Predict impact of new attacks without running them •  Predicting probability of attack chains •  Reduced risk testing model •  Zero testing debt •  Response metrics via API queries of security tooling •  Tracking defensive TTPs •  Understand how all security tooling come together