Traditional defenses are known to attackers. As I talk about in my
Kali Linux for Information Gathering course, step one of any attack
chain is reconnaissance. Knowing the target,
knowing their tools,
their services, and how are they keeping attackers out
is key for one very important reason.
These tools and services are all in the public
domain, used by thousands of companies.
Just because all the vulnerabilities of them are not public doesn't mean
they don't exist. As an attacker, or a pen tester for that matter, if I
know what operating system a company uses, what antivirus, EDR service,
or software they have running on the edge, opening ports to the world, I
can then set up my home lab, replicating this setup to help me find the
gaps, plan, and practice my attack. And if you're relying solely on known
good, I'm reverse engineering and cracking your defense.
I have likely used some of these tools,
researched them, or know resources out there where I
can find vulnerabilities for them.
Traditional defense is centered on preventing and keeping attackers
out of the network and will always be important to practice defense
in depth with the basics of patching, firewalls, or implementing
other relevant blocking controls.
Low‑hanging fruit will always keep you safe to a point, but it only
takes one click from one random employee buried deep in your org
chart to potentially set off a firestorm.
Active defense in cybersecurity refers to the proactive measures taken by an
organization to detect, prevent, and respond to cyber threats.
It involves taking a more aggressive stance on cybersecurity as opposed to
the traditional passive defense strategies that rely on detecting and
reacting to security incidents after they occur.
Now there's an old saying that it's not if but when as it relates to
cyber attacks and breaches. If you're on the internet,
your front door and maybe even your back door and side
windows are being knocked on and jiggled to see if you
accidentally left something unlocked.
If you missed a configuration on a machine that has now let the attacker in,
how can you be sure you know how to discover them once inside? Active
defense is the art of setting traps for an external attacker or an insider
threat even, getting them to give up their existence inside your walls. The
faster you can discover them,
the faster you can eliminate their presence and limit the damage.
Now active defense can take on many forms, as you see here.
Network monitoring, deception with honeypots and tokens,
red teaming, all good stuff. Many beyond what we'll cover in
this course. You will need tools to run active defense on your
network, so let's talk a little bit about why PowerShell maybe
the right tool for this job.