Hello and welcome to another
application of the moderate tech
framework discussion today
we are looking at data compressed
data compression as a means
for moving information outside
of the organization exfiltration.
So the objectives of
today's discussion are to look at
the term data compressed within the
context of the framework.
So mitigation techniques and some
detection techniques as well.
So let's go ahead and jump
right in.
So data compressed in
mind is when a threat actor will
compress data that is collected
prior to exfiltration to minimize
the amount of data sent over the
network.
It can be done with custom programs
or common compression methods such
as seven, zip, rar, zip
and zip.
All of these you should likely
or would likely be aware of
in just kind of general use
cases.
Now, mitigation techniques
is what we're jumping right into
from that standpoint.
We can use network intrusion
prevention to block specific file
types. We can also block those file
types maybe through other means,
such as our firewall or our mail
gateway, and keep
them from leaving the network over
unencrypted channels.
Now, a threat actor may use
attempts, other attempts to bypass
that, such as encrypting the
channel in which they are sending
traffic out. And unless your devices
can decrypt traffic and they have
that capability, which is generally
painful to set up, but it could be
something that you're doing.
It may not see those
file types being sent out of the
network.
Now, detection techniques
here are again going back
to monitoring for command line
arguments and other activities
dealing with compression utilities.
There is a normal use case for these
in day to day business activity,
but it never hurts to
have some mechanism set up to
especially evaluate that from the
command line standpoint, because
generally users day to day users
aren't going to be doing that
through the command line. They're
going to be doing it through the
utility itself.
Now, with that, let's do a quick
check on learning.
True or false?
Data compression is when any threat
actor encrypts information to make
the payload smaller.
All right, well, if you need
additional time, please pause this
video. So data compression is
not a threat.
Actor encrypts information to make
the payload smaller.
It's when they compress
the information to make the
information smaller, to make the
data set smaller so that they can
more easily send it outside of
the network.
So this is a false statement
as it is written.
So with that in mind, let's jump
into our summary for today's
discussion.
We described and looked at data
compressed as it is written in
the moderate tech framework.
We looked at mitigation techniques
and we talked detection techniques
as well. Again, some of
these activities a little bit harder
to find and note.
So really taking some
controls above and beyond
our standard things like antivirus
and network intrusion prevention to
kind of combat some of the sneaky
ways that threat actors will attempt
to remove information from our
environment.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.