Putting Cyber Attackers on the Defensive
•
1 like•471 views
This in-depth understanding of your cyber terrain informs your defense, allowing you to lay traps and pitfalls for would-be attackers. Knowing what attackers are looking for and how they are going to try to move throughout your network provides you with a key advantage. With this knowledge, Deception technology becomes a powerful weapon in your defensive arsenal.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Putting Cyber Attackers on the Defensive
Similar to Putting Cyber Attackers on the Defensive (20)
Recently uploaded
Recently uploaded (20)
Putting Cyber Attackers on the Defensive
- 1. Putting Cyber Attackers on the Defensive July 16, 2019 Rami Mizrahi Yishai Gerstle
- 2. © Fidelis Cybersecurity Featuring… 2 THE ATTACKER Yishai Gerstle Security Researcher THE DEFENDER Rami Mizrahi VP, Software Engineering - Deception
- 3. © Fidelis Cybersecurity Agenda ▪ Attacks & Attackers ▪ The Demo arsenals ▪ Attack Demos ▪ In details: tools & deployment ▪ Wrap-up 3
- 4. © Fidelis Cybersecurity Attacks & Attackers ▪ Attacks are becoming more & more advanced ▪ Methods of attacks are shared between attackers and online ▪ Recon phase is a key part of any attack – both before and during. ▪ We’ll start our attack demos from the Moment of Boom 4
- 5. © Fidelis Cybersecurity Attackers Arsenal 5 Attacker Type SKIDDIE – Script Kiddie Advanced attacker OS of choice Kali Ubuntu Enumeration methods Credentials collection Data validation ARP table, DNS Server Framework Metasploit Lateral movement
- 6. © Fidelis Cybersecurity Defenders Arsenal ▪ Using Fidelis Deception ▪ Focusing on two concepts as part of a Terrain based Cyber Defense ▪ Know your Terrain - Understanding your network ▪ Asset, subnets, domains and their connectivity ▪ Alter your Terrain - Using Deception to fool & catch attackers ▪ Decoys, Breadcrumbs, Network deception, Data deception 6
- 7. © Fidelis Cybersecurity SKIDDIE Attack Demo- Wall Port ▪ Weapon of choice: Kali machine ▪ Nmap scan – port scanning ▪ Responder – poison multicast requests 7
- 8. © Fidelis Cybersecurity SKIDDIE Attack Demo – Infected Asset ▪ Shell on infected asset: ▪ Metasploit commands automation using script ▪ Collect data, crack credentials ▪ Next hops: SSH, FTP, Shared ▪ File upload to ftp or shared 8
- 9. © Fidelis Cybersecurity ▪ Noisy alerts – in Deception and probably in other tools ▪ All activities monitored by deception ▪ Credentials usage is monitored ▪ Files uploaded are sent to Sandbox analysis 9 SKIDDIE Deception Activity
- 10. © Fidelis Cybersecurity Advanced Attacker – Demo – Wall Port ▪ Weapon of Choice: Ubuntu ▪ Wall Port: ▪ Responder – passive analysis 10
- 11. © Fidelis Cybersecurity Advanced Attacker – Demo – Infected Asset ▪ Shell on infected machine: ▪ Credentials collect ▪ Bloodhound view ▪ Validate against – ARP table, DNS server, pcap file ▪ Access next hop – RDP, SSH ▪ Non monitored networks – camera, scanner 11
- 12. © Fidelis Cybersecurity ▪ Fewer alerts ▪ Access to unmonitored systems ▪ Improve the Decoy validity with: ▪ ARP poisoning ▪ Breadcrumbs ▪ AD Deception 12 Advanced Attacker – Deception Activity
- 13. © Fidelis Cybersecurity Defenders in Details ▪ Deception Elements in detail: ▪ Decoys ▪ Breadcrumbs ▪ Network Deception ▪ Data Deception ▪ Active Directory Deception 13
- 14. © Fidelis Cybersecurity14 Attacker Type SKIDDIE – Script Kiddie Advanced attacker OS of choice Kali Ubuntu Enumeration methods Credentials collection Data validation ARP table, DNS Server Framework Metasploit Lateral movement Attackers Arsenal
- 15. © Fidelis Cybersecurity Wrap-up ▪ We reviewed two types of attackers – the noisy script kiddies and the stealthy advanced attackers. ▪ Attackers are always looking for ways to get into your network ▪ To protect your network, you must first understand what you have in it - know your terrain ▪ Using Deception helps you prepare your network for an attack and catch 15