Hello and welcome to another
application of the minor attack
framework.
Today, we're going to be looking at
our case study and some
considerations for lateral
movement.
Primarily, what we're going to focus
on, really, is what are we doing
to detect lateral movement?
What are some things we should
consider and ask ourselves?
And what can we take back to the
office and really start to peel
through and see what we're doing
and what we've got going on?
So we have to start with some
considerations.
What are some things that must
be done?
What we cannot get complacent
from alert, fatigue.
And so some organizations,
depending on how
things are waitlisted within
their systems, how their baseline,
there could be a lot of false
positives and a lot of alerts
that are just pouring in.
And people get
snow blind and they really don't
look between the lines.
They kind of just accept it as
normal activity.
And they just it's the status quo.
So we can't get to a point
where we get snow blinded to
alerts and we get complacent and
we're not looking right.
We also need to be aware
of how our network is laid out
and how it works.
If we don't know what is normal
and what is not normal, how
can we properly address
threat actors or what could be
malicious activity?
And then the last thing we really
need to consider is we have to have
the ability to hunt for threats
and proactively investigate
activity.
So none of these two matter.
These things don't matter if we
can't do this.
So if we don't have the resources,
we don't have the capability.
We really can't investigate
any activity.
We can't be proactive in any
respect.
And so that takes us into some
points that we should consider.
All right, though, some poor
administrator is going to hear from
a manager this this next week.
After they watch this video, they're
going to ask, when was the last time
we had an event or an incident?
And the administrators probably
going to say, have you been watching
those videos again in
this case, if you've
got a system, OK,
and this is something to consider.
And so this will kind of play into
the second bullet.
If you've not had an event or
an incident ever,
ever, and
you have a connection to the
Internet and your users get
email, you have to question
how you're tracking this particular
metric with respect to risk
management for the.
Org right.
We're not talking just
the I.T. folk or the helpdesk
folk or the system administrator
keeping track of
these things. It's what is
management's awareness?
Of the last time they dealt with an
event or an incident and typically
these are things that explode and
people are going crazy and we're
trying to figure out how to fix
everything and how to get back to
business as usual.
But there are what I like to call
near misses.
There are incidents that come
up, events that come up where we
kind of block the attacker
and we're successful, but
that never makes it up the chain.
So knowing whether or not the things
we're implementing are successful
and they're helping us to reduce
risk.
Right wing spin, that's a lot of
times where we get to the feeling of
we're spending money to spend money,
but I don't see the benefit.
So you have to ask the questions.
Right.
And if you utilize a third party
to do some threat, honey,
and alert you on events or
incidents, how often do you hear
from them?
What are some of the things that
they're alerting you on?
Are they alerting you on near misses
or are they alerting you on
suspicious processes or do they
handle all of that?
And if they do, when's the last time
you've been given a brief
understanding of what it is that
they're doing?
And I have to say this, and it's
because I've seen that a lot of
organizations.
OK, let's just say here that there's
a graph and there's really
nothing here on X or Y as far as the
axis. But let's say that this is
a baseline that gets
a plot.
Anything that hits above
this baseline
will generate an alert.
This is an event, but
anything that hits below
this threshold
does not get an event or an alert.
Right. So you have to ask yourself,
a lot of organizations apply
what I like to call a standard
baseline configuration,
meaning that regardless of how
normal activity looks and abnormal
activity looks within the
environment, this is the
standard.
This is what we apply, regardless
of what you are as an organization
or what you do.
Right. So that one event
that happens
may not be substantial.
It may not matter, but there may be
things down here in the ether.
Right.
That we would consider abnormal
or an event or even an incident.
And so if you were never
baseline to find
out that, hey, some
of these things
are in fact suspicious, but some
of these things are not and
you should really be here,
but you're here.
You are missing
all of the things that happen in
between these two points.
Right. So you need
to make sure that you're engaging
this third party to better
understand how this
is reducing risk and how
your systems were baseline.
If they apply a standard baseline,
they don't. They didn't engage you
to understand if these activities
were normal. They didn't engage you
to understand if these things were
malicious. They just snapped on a
basic baseline
and they checked the box and you're
on boarded.
That could be a problem.
So you need to go back and ask those
hard questions and really understand
what it is that
they're seeing and whether or not it
is normal activity.
And, you know, otherwise, how
would you know if a tractor was
moving through your network, which
is our third bullet?
And if the answer is, well, I
consume these types of services,
I have these types of people in my
departments, then go to them
and ask, how will I know?
What would we see?
What would be something that should
be alerted on in?
There could be certain activities
like EMAP scans or
attempts to take over processes
in the network that may end up under
that baseline that you're not
getting alerts on.
And this could literally be a
threat actor making
lateral movement through the network
and they don't ever hit
that baseline.
So keep those things in mind, ask
those questions and ensure that if
you were consuming this type of
service or if you are
doing this type of work internally,
that you are asking these questions
responsibly and that you have a
good, comfortable understanding
of the things that you're doing
to reduce risk and mitigate
the ability of a threat actor to
move unnoticed through your
systems.
So with that in mind, I
want to thank you for your time
today.
I look forward to seeing you again
soon.