Congratulations for reaching the end of this course.
If there is one thing to take away from this course,
it is that all security solutions can be bypassed by an attacker with time,
money or skills at his or her disposal.
As an attacker, you probably already know this.
As someone working on the defensive side of information security,
this should reinforce your belief that you must
implement a layered approach to security.
Although we did bypass the antivirus and the perimeter,
it doesn't mean that we cannot get caught when operating in secure environments.
Most security‑conscious organizations may have a SIM, also known as a
security information management system operated by a team of skilled
security analysts and engineers leveraging well‑known frameworks such as
they MITRE ATT&CK framework. Antivirus solutions simply cannot afford to
have many false positives, because it would prevent end users from being
productive.
A team of analysts operating a SIM can handle false positives to some extent
and react if an alert is deemed to be malicious. On top of that, using a SIM
can help correlate various events or alerts triggered by various systems,
which can uncover malicious activity.
Additionally,
attacks can be thwarted by hardening endpoints, such as making use
of application whitelisting and limiting opportunities to execute
arbitrary code using scripting languages,
among other things. As an attacker, understanding how endpoints
can be hardened and how these mechanisms can be bypassed will
also be required in some circumstances.