Hello and welcome to another
application of the MIETEK
framework discussion today
we are looking at data transfer
size limits.
So our objectives for this
discussion today are as follows.
We're going to be describing data
transfer size limits, some
mitigation techniques, as
well as some detection techniques.
So what is data transfer
size limits?
Well, this is when a
threat actor will exfiltrate
data in fixed size chunks
to limit packet sizes below a
certain threshold.
This is done to avoid triggering
triggering alerts concerning
data transfer threshold limits.
Now, a particular tool that is
out there that could do this is
oopsy.
And this is a Trojan used
by the oil rig advanced
persistent threat group to remotely
execute commands.
Now it can do things such as data
encoding, data transfer
size limits, file
deletion, obfuscation of files or
information.
And so, again, this is
when instead of sending everything
at once, you're trying to do it in a
single stream. They can break it up
into various sizes and
have that done over a period of time
versus all at once.
Mitigation techniques here are
going to be really using network
intrusion prevention to look for
traffic, to command and control
systems and looking
for malware type traffic or
activity.
So that's going to be the primary
mitigation technique for these
types of activities.
Detection techniques are going to be
circling around monitoring network
traffic for consistent fixed sized
data packets and other on
activities, looking for abnormal
things. Now, if you've got a packet
that's a few bytes and it's going
out every 10 minutes or so, that
may be hard to detect.
So really, again, understanding
the way your network communicates on
a regular basis, the type of
activity that you see from systems
and being able to flag abnormal
activity is going to be the key
to stopping these types of attacks
or finding these types of attack
activities.
So let's do a quick check on
learning for this quick discussion
today.
True or false, a data transfer
size limit is the max amount of data
you can transfer over the Internet.
All right, well, if you need
additional time, please pause the
video. So a data size
limit is the max amount
of data that you would
essentially transfer over
a packet or a particular
connection in bits and
pieces to ensure
that you avoid flagging certain
systems or controls.
And so this is a false statement.
Typically, data caps or
size limits are going to be
the max amount you can send over
like email or something of that
nature. But typically the Internet
itself doesn't have a max data
cap that you put on it.
So in summary of today's discussion,
we describe data transfer
size limits.
And we looked at a tool called Upsy
within that we did some
mitigation techniques discussion
and we looked at detection
techniques as well.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.