Hello and congratulations
on the completion of the initial
access area of
the minor attack framework.
So what
should we know at this point or what
should we know now?
What should we be able to apply
based on what we've learned here?
Well, we looked at initial
access overall.
We define what it was essentially
that the reactor gets into the
network initially and we define
some attack types and examples
just in that that first module
or that first lesson in this module.
And then we looked at external
remote services.
We define what external remote
services are.
We reviewed Lennix, Rabbitt and
Raybert, as far as it being a crypto
minor, that malware
that works to put that on systems
that have SSL open and it's also
geolocation sensitive.
We reviewed the threat group Oilrig.
We also looked at mitigation
techniques and best practice
detection techniques for external
remote services.
From there we got into spear fishing
links.
We define what those are.
We looked at Turlough, which is
another threat group.
We reviewed mitigation techniques
and detection techniques.
We then looked at supply chain
compromised. So we define what that
was essentially being
a piece of software or hardware
that is injected with
malware or code
that allows threat actors access to
systems.
We reviewed some examples of that,
such as the
cleaner incident that came
up last year and almost happened
again this year.
We reviewed mitigation techniques
such as code review and things of
that nature, and we got
into some detection techniques
as well.
We then looked at trusted
relationship, which is not the
same as the supply chain
compromised.
This is when a third party
has direct access to systems
and they have the either access
to data or access to systems,
and they are considered a trusted
provider. And we looked at managed
service providers and we draw on a
pyramid where we discussed
how many service providers or
larger software companies may have
access to multiple systems.
And then on that second tier, those
multiple systems could be banks,
health care providers, hospitals,
manufacturers, whatever the case may
be, that would have a multitude of
account information.
And so we talked about why as
an actor would look at compromising
that top tier relationship
that's gotten multiple
systems that it would have access to
versus focusing on individual
end users. And so why go after my
individual information, which is
still done
on a one for one basis when
the bank could be compromised and
then it's one to many or the managed
service provider could be
compromised and then it's one
to a lot.
We reviewed some mitigation
techniques here and detection
techniques that are more so on
the business side to take care
of, such as implementing controls to
monitor activity in this
relationship, as well as to
kind of keep tabs on when the
provider has access and maybe
limiting access as well.
We then looked at valid accounts,
which is essentially when a threat
actor gains access
to credentials or a list of
credentials that they can then use
against multiple systems
to provide them with access.
And this is especially dangerous if
you've got end users that reuse
accounts across multiple
systems. If I use the same
administrative account and password
on multiple network devices as well
as my domain admin account,
or if I use
the same credentials for my banking
applications as I do for
a job applications as I do
for health care applications.
And so that could become
dangerous if those accounts were in
fact compromised, they could be
reused across multiple
platforms.
And then we rounded everything else
out with a case study where
we reviewed
and should have been able to
apply minor attack framework
controls to the scenario
of HSBC and
their particular incident.
So you should have been able to come
up with that particular vector
that was most likely involved
here, as well as looking
at the mitigating controls and
detection controls that could
have been implemented, that may have
either prevented the particular
scenario or
would have made its impact a lot
less severe.
So we also looked at a component
of this. Where do we
have culpability as end users
of the particular systems and
by reusing our credentials across
multiple platforms?
Are we at
fault in any way, shape or form for
this as well? And so that was more a
question for you to ponder and
kind of make a determination on
as well.
So, again, congratulations
on completing the this module.
And I am.
I'm happy to be with you here, and I
look forward to seeing you again
soon.