Hello and welcome to
another application of the moderate
tech framework discussion
today we're going to give in to our
case study on defense
evasion.
So we have to start with a question.
What's watching your back?
So in this instance, we're talking
about what tools, people,
processes, whatever the case,
are watching the back of your
business. So what's keeping
you safe?
What is making sure that the
I's are dotted and the T's are
crossed from a security standpoint?
So that is the first thing that we
want to ponder.
But we're going to start really
this discussion with another
look at dwell time
and dwell time is always important
for us, especially when we talk
about defense invasion, because
threat actors, when successful,
go for months,
days, years, hours,
whatever the case may be undetected.
And so I've heard several metrics
throughout the last few years
and they include anything
from twenty seconds to maybe 30
seconds of time that a threat out
there actually needs our network to
successfully start stealing
proprietary information,
credentials, whatever the case may
be.
And so when we get into the act
of days or hours of
detection not happening
and the threat after successfully
evading defenses, we now talk
about losses or damages
that are much, much greater in scope
and scale.
And so to start with our first
bullet, a thorough analysis of
global breach data from twenty
eighteen indicates that half of all
organizations last year took 50
days or longer to detect the
intrusion.
Previously, this number was up
fifty seven days in twenty
seventeen. So it looks like we had a
slight reduction between
20, 17 and 18.
But 50 days is still
quite the number.
In some cases, businesses were
learning of attacks from other
agencies up to six months
after a breach, which is huge.
I can't imagine how embarrassing it
would be to have another entity
tell me that my systems were
compromised under my nose.
So crypto mining tools and
ransomware were among those that
were easiest to spot, typically
organizations that were previously
compromised or targeted by
attackers.
And so a lot of times
when we talk about
threat actors, we often
think of them as a
business or an organization
of organized crime.
And so in their cases, a lot of
times these entities specialize in
doing certain things.
And so you've got a guy that's
really good at stealing passwords
and whether that's really good at
stealing secret source information
and whether that's good with
ransomware.
And so really, when we
get to a phase of compromise
where it's ransomware or crypto
mining tools that are very
those are very noticeable things.
And so you can't really hide
ransomware on production
systems. It pretty much cripples
production and stops
business as usual.
So what was happening before
ransomware was deployed was the
threat actor present.
Was something going on
on the network that you weren't
aware of up to the point that that
ransomware was deployed?
And so those are things
that keep us up at night as security
professionals. And how do we start
to reduce the curb or
reduce the time it takes for us to
either see threat actors on our
systems or stop them entirely?
Now, there are different
tools out there, but to name a few
that threat actors are using to
evade your defenses and
stay kind of on a network
without being detected so quick.
CAT is one and it's a simple
Unix utility that can read and write
data across the network connections
using TCP UDP while encrypting
the data. So if you're looking for
plaintext information or
activities, they may not be picked
up if your systems are not set up
to decrypt information prior to
it leaving the network.
There's also DNS to TCP,
which was designed to relay
connections through DNS traffic.
Does it need to run with specific
privileges? And so we may
remember Target's incident.
I know that they were taking ping
packets and moving.
Credit card information over those
connections and so this is just
another way that we can try to use a
different service to hide
information, shelter
is used to inject shortcode
into native Windows applications.
This is just three tools
in the great scope of
tools that are out there.
And so really, your challenge
here is something that you need to
start thinking about is
what are we doing
in our organizations to
find threat actors if they get
on our systems?
If all other things failed to
include the human element, what
are we doing to
get these entities out
and keep them out?
As stated, they're trying
to get back into our networks if
they compromised them before.
Was that through phishing?
Was that through direct exploitation
of Web based instances
or systems? Was that through
manipulation of devices that are
supposed to be protecting our
network?
Was that through a human
element that introduced an infection
willingly for money or
information?
There's no telling, really, if we
don't have the tools or the
processes in place
to look for these things
and to detect these things.
And so I challenge you
to sit down and come up with
scenarios where a threat actor has
impacted your network or infected
your network.
How would you know what would make
you aware? What steps would you
take to even start looking for them
if they were using process Halloween
or software packing or some of these
other things to hide?
And if the answer is I'm not sure,
or if you take liberties
and what your actual capabilities
are, that puts you at a
disadvantage.
So I challenge you to look for open
source tools or to look for
techniques that are within your
wheelhouse that you could actually
deploy and use in your network.
And if you find that there are gaps,
I also challenge you to start
talking to your business leaders
to see how those could be filled,
taking into mind your culture and
capabilities.
So with that in mind, I want
to thank you for your time today,
and I look forward to seeing you
again soon.