Maybe even a little secretly.
I think this is always been one of my favorite topics to teach because of the fact that we will scare
the heck out of our students when it comes to security attack phases and the many ways that are easily
able to be accomplished in that area.
And then, of course, after scaring them, we can talk about solutions and countermeasures and we have
a ton to talk about.
And notice I'm really getting myself off the hook here legally, if you will, by saying some countermeasures.
That word some is placed very, very intentionally there.
There are other things that we can do, but these are some of the fundamentals that you need to be thinking
about restricting web access.
What I'm talking about here really is just hammering the hardening into your Web servers.
Web servers should be tested constantly for any new vulnerabilities.
You want to make sure that your Web servers are not leaking any metadata or data itself.
Very critical.
Another thing is obviously patching those Web servers.
So we're going to be consistently looking for any, as I said, leaks that might be occurring of any
information.
We are going to be training the crap out of our end users.
There I said it and crap is the official term.
Shout out to the folks at i.t.
Pro tv.
They had invented an internal certification called the certified reboot administrator pro.
I think it was the crap certification and it was a shirt that they created on April Fool's one year
and released a great YouTube about it.
Check it out.
So some great countermeasures in the area of training your end users.
Yeah, we're going to teach them to use pseudonyms.
And, you know, obviously we're going to be teaching them a lot about how they conduct themselves in
social media and really giving away very little about their job.
Often times, right, social media, you know, maybe they're going to be instructed to keep that completely
personal and not be discussing corporate business.
Maybe it's the opposite.
Maybe they'll be given guidelines on exactly how they're supposed to speak about the organization.
We're going to be carefully monitoring all of the information that we release for an organization anywhere.
So we're going to have teams reviewing public website information, teams reviewing what we've told
journalists.
You get the idea.
Monitor all self release of information.
And we are going to be self testing here, pen testing big time.
You're going to be consistently running different types of reconnaissance tests against your own infrastructures
to make sure there is rock solid as you think they are.
You're going to want to reduce or eliminate the caching of your web content.
So we want our web content to be fresh out there.
And the less caching, the less subject we are to attack.
And we are going to have a very strong security policy when it comes to end users, and we are going
to train them how to adhere to that policy.
Something else you want to make sure you engage in is really restricting DNS.
We're going to be very careful about gene transfers.
We're going to be very, very strict about the use of internal versus external DNS servers or will engage
in split DNS when it comes to Web servers, FTP servers, any servers, hosting a public information.
We are going to make sure to harden those, as I said earlier, and we are going to ensure metadata
like directory listings and things of that nature are not available.
We're going to set privacy on our who is service, even if that requires paying a little bit extra.
And we're going to avoid domain level cross-linking.
Now, what this is a reference to is the, you know, free access between or even within the same domain
sometimes.
So what you want to think about is some departments are not going to be sharing information with other
departments, just like your organization is not going to be openly sharing information with other organizations.
So we're just going to be very, very, very careful about linking information outside of our domain
of control.
And again, sometimes this can even refer to inside your organization.
We are hardening all of our devices that may be exposed to any external and internal reconnaissance
attack.
So harden.
Harden.
Filter.
If you don't need ICMP echoes and echo responses in a certain area of your network, then they should
be filtered.
If you have no use for traceroute in areas of your network, they should be filtered.
We are only going to be calling upon the mechanisms that we need for management of our systems when
we absolutely have to have those mechanisms.
Many times we'll do it privilege based or role based.
So you can trace root, you can ping, but your end user cannot.
We want to contact the archive.org and we want to just let them know that we want old copies of our
stuff deleted.
We want to engage in the hiding of our IPS whenever possible.
Oftentimes, VPNs are doing this for us in an automated fashion.
We'll use mobile device management systems so that mobile devices are not geotagging when our end users
are taking photographs.
We'll do other things with the mobile device management as well to mobile devices to ensure that they
are secure.
We'll be very careful about where we store certain data.
Right.
All data is not created equal.
Some of it is extremely sensitive and maybe it's not even stored online.
Other stuff can be stored online, but it must get the strongest of encryption.
So yes, there are plenty of countermeasures that you can implement to guard against this.
So common phase of foot printing against your organization or you yourself.
These are just some of the countermeasures and I'm sure you remember that training came up repeatedly
as we went through these countermeasures.
Notice, lots of these are going to require strict policies and training so that your consumers, your
clients, your fellow peers can carry out the security policy you're asking them to.
Thanks so much for watching.