Then what is hacking?
That's a loaded question.
What is hacking?
Hacking, a lot of times, takes on a negative connotation.
It's not always.
But hacking is really learning how something works and then manipulating it
in a way unexpected by the system developer or designer to make it do
something it's not necessarily normally going to do.
Hacking is bending the rules a bit, manipulating the system to achieve a
result other than the creator's original intent.
Exploiting system vulnerabilities,
compromising security controls, modifying system application features, and
can be used to steal and redistribute intellectual property, leading to business
loss and a whole bunch of other possibilities.
Hacking has a five step cycle, and our easy counsel five step hacking cycle
starts with phase one, footprinting and reconnaissance.
You have passive, which we just introduced
the term passive, and you have active, which means either directly or not
directly engaging the target to extract useful information.
So you're gathering information prior to attack.
Phase two is scanning.
In scanning, you will send out crafted packets to elicit very specific responses
from your target systems to gather information.
In the gaining access phase, you are
actually gaining OS application network level access.
At that point, you're crossing the threshold.
Maintaining access ensures you can continue to revisit the system.
So gaining access is one thing, being able to revisit the system at will is another.
That involves potentially taking additional steps to maintain access.
Installation of a root kit, a backdoor, malware, or the creation of a user
account, starting a service, some other way to access the system.
Then finally, clearing tracks.
Once you get you've gained
access, insured, ongoing, or maintenance of access, phase five is for clearing
tracks, which a lot of times that's cleared in log files.
Cyber Kill Chain Methodology.
You lock in Keith Martin has their patented...
Not to be patented, but their signature
Cyber Kill Chain Methodology, which is a sequence of steps.
It's a component of intelligence driven
defense for identification and prevention of malicious intrusion activities.
Helps professionals to understand the
adversary's tactics, techniques, and procedures beforehand.
We have a couple of different
methodologies, the meter and cyber kill from Lockheed Martin.
Broken into several steps, reconnaissance,
weaponization, delivery, exploitation, command and control,
installation, and then actions on objectives.
We're not going to do a lot with that directly.
We do want to understand that it exists.
If on your second pass you want to come
back through and read that a little bit more detail, look at examples of,
definitely have at it.tactics, techniques, and procedures.
Ttps refer to patterns of activities and methods associated with specific threat
actors or groups of threat actors.tactics, the way an attacker performs the
attack, techniques, technical methods used by the attacker, and procedures,
organizational approaches that threat actors follow to launch an attack.
There's also the meter attack framework,
which is similar in concept to Lockheed Martin.
It involves a pre attack and attack phase, recon, weaponization,
delivery, exploit, control, execute, and maintain.
Then there's a Diamond model of intrusion
analysis, which offers a framework for identifying the clusters of events
that are correlated on any of the systems on an organization.
This is a little bit different.
This is incident handling and response.
It's coordination.
Couple of terms here, adversary, an opponent who is behind the attack.
The victim is the target that's been
exploited or where the attack was performed.
The capability is attack strategies or how the attack was performed.
The infrastructure is what the adversary used to reach the victim.