Python is extensively used in the information security industry.
Whether an exploit development, networking,
debugging, encryption/decryption, reverse engineering,
fuzzing, web, forensics, malware analysis,
you name the function, you can probably find some use of Python for it.
Talking through some of the more common job titles,
security analysts find themselves having to process data quite regularly.
So many nightmares about logs,
sometimes you just have to gather them all up and
throw them in the air and scream.
There has to be a better way to get to the root.
Yes, we have solved a lot of this with SIEMs and log aggregators,
but what if you don't have the space to import and digest all the logs you want?
Sometimes you may not have the budget or find value in regularly
processing test environment servers in your SIEM,
but all of a sudden you're getting port scans coming from the box.
Python allows you to open a file,
process the information in that log or file, and produce
a report of the content in that file.
Another function of an analyst is to monitor environments and not at
the new installments against your hardening policies.
When you are spinning up new cloud infrastructure or
open tunnels between cloud services,
it can become cumbersome to manually work a compliance checklist.
Mistakes are easy to make. You don't want the security of your org
compromised because an analyst simply missed checking a specific
configuration that was set wrong.
Another use of Python could be to pull up a script, point it at the
infrastructure in question, and know all the checks are taken care of. What
I'm really getting at here with these examples is automation, your basic and
repeatable tasks that bear down heavy on getting it right in order to
maintain the proper security posture.
These tasks, with the help of Python, can be scheduled and automated to
do the heavy lifting for you. Shifting focus to the individual or team
responsible for the security awareness training in your business, Python
may be used by this group to help build tools to assist in demonstrating
how an attack is executed.
Maybe you set up a simulation to show how a password cracking attack
works to gain initial access into a target environment.
Once a foothold is established, the Python script can then traverse the system,
collecting information about the box, including accessing sensitive data.
We will then set up a command and control channel between a target and
an assumed attacker's infrastructure to exfiltrate the data out and
send other commands back to further attack.
In response to such an attack, incident responders can use Python to
understand what is going on inside the box or network compromised.
There are libraries and tools to help execute a memory dump where
packages like Scapy can be used to capture packets on a network to
understand where the compromise has spread. This leads to the forensics
being conducted to understand the attack.
You have the obvious malware analysis or binary analysis, but
Python is just as good as important functions like digging into
records to preserve file and folder metadata.
A chain of custody and protection against changes in the files can be
accomplished with crypto libraries that generate hashes of the
content. And to further put the exclamation point on this, here are a
few more uses you will see throughout the information security
community. There are many uses,
and every job can take advantage of the multitude of
packages and functions offered in this tool.
In the last clip for this module,
let's talk about how libraries and packages effectively work
and walk through some demos setting your environment up to
follow along in this course.