Hello and welcome to
another application of the modern
attack framework discussion
today we are looking at our case
study for command and control.
So what if I told you there was
such a thing as zombies
and they are real, but
they're not actual flesh eating
beans. They are
things such as bot nets.
So when we talk about a zombie that
is an infected or impacted
system that essentially
is at the beck and call
of a command and control
server.
And so these can be used for things
like sending spam, infecting other
machines, connecting denial of
service attacks.
They can be made up of private
computers. And so your home computer
could be a zombie and you don't
know it. Infection methods are
usually delivered with email
attachments or compromised
software that you use.
So nothing in this world is
free. Keep that in mind.
So what are the points
that we should consider when it
comes to zombies and
command and control activity?
Well, how would you know if your
system is acting as a zombie?
What do we really have?
What capabilities do we have?
His home users
with our systems at home?
How do we detect whether or not
we've got malicious traffic leaving
the network?
How do we know what our system is
doing behind our back?
If we don't, then there may be some
things we need to work on.
And what methods do you currently
use to detect that activity?
Again, there's a number of things
that that end users at home can
use, but we do
want to focus on the business aspect
as well.
And so how would you know and
have you had any of your
IPS blacklisted recently?
So if you don't do any type of
malicious sending
or spamming, you're not a marketing
firm sending out a bunch of messages
and you get flagged as spamming.
If that's not your
M.O., then why
would something like that have
happened? Right.
So you have
to consider that there
may be an entity using your
likeness or your organization to
do evil.
And so you need to take the time,
effort and energy to look at
things like outgoing traffic
patterns. Are you making connections
to foreign
IPS in countries
that you normally don't do business
with or connecting the sites
that you know you're not connecting
to? And so doing this type
of investigation can help you to
track down potential systems that
could be impacted by
that command and control software
or other threat actor type
activities that may be taking place
on your network.
So with that, I want to thank you
for your time today, and I look
forward to seeing you again soon.