This presentation on security awareness was presented at the SANS Community Night (21 Feb 2013).

1. Patching your employee’s brain
Pieter Danhieux
WARNING: This is NOT a TECHNICAL talk … or at least not after slide #5
Securing The Human - © 2012 Pieter Danhieux 1

2. Agenda
• Context
• Patching Humans
• Top mistakes
Securing The Human - © 2012 Pieter Danhieux 2

3. Context
• Operation “Aurora” (2009) - spoofed emails with links to 0day
• Operation “Night dragon” (2010) – spear phishing executives & remote
workers
• HBGary hack (2011) – social engineering emails
Excel sheet
• RSA (2011) – spoofed email with excel sheet
with executive
salaries!
PDF Win-A-
Google
Nexus 4
Evil attachment
.xls .pdf .docx .ppt
Securing The Human - © 2012 Pieter Danhieux 3

4. Targeted Attacks for dummies
1. Generate evil code with Metasploit Framework or use Didier Steven’s code
msf > use payload/windows/exec
msf payload(exec) > set CMD calc
msf payload(exec) > set EXITFUNC thread
msf payload(exec) > generate -t vba
2. Copy/Paste VBA code into MS Office Excel document
3. Use Ninja-skills to find a convincing way to deliver the document
Aarrgh
De t e c t hh.
ed by
S****
. Now
my De
mo wi
ll
fail!!
Securing The Human - © 2012 Pieter Danhieux 4

5. Targeted Attacks for dummies – 2nd Try
1. Generate evil code with Metasploit Framework or use Didier Steven’s code
2. Copy/Paste VBA code into MS Office Excel document
3. Check whether the AV engines alert during your demo
4. Spent 10 minutes during the SEC542 class at SANS Belgium to find a work
around and conclude that S***’s fancy named “Heuristic detection system”
is based on …. string matching.
5. Use Ninja-skills to find a convincing way to deliver the document
Securing The Human - © 2012 Pieter Danhieux 5

6. Context
“I clicked on a Friend’s
link on Facebook …”
“I opened a PDF from a
known sender …”
“I logged into my
online banking and it
did not work …”
Securing The Human - © 2012 Pieter Danhieux 6

7. Context
Look for common mistakes in your own
organization
– Laptop loss with VPN token and PIN written
on a paper
– Losing sensitive information in a public
place
– Sharing passwords when colleagues go on
annual leave
Unintentional mistakes … because we humans
fail in understanding and identifying insecure
situations!
Securing The Human - © 2012 Pieter Danhieux 7

8. Disclaimer
All characters appearing in this work are fictitious. Any
resemblance to real persons, living or dead, is purely
coincidental.
Securing The Human - © 2012 Pieter Danhieux 8

9. Humans fail at evaluating risk
Being killed by a shark Death by a vending machine by
shaking it to get free stuff
Threat = evil shark Threat = evil vending machine
Impact = probably death Impact = R.I.P
Likelihood = 1 in 251 800 800 Likelihood = 1 in 112 000 000
0.6 people killed each year in the US 10 to 13 people killed each year in the US
Source: http://www.bookofodds.com/content/view/full/252163
Source: http://www.bookofodds.com/content/view/full/248157
Securing The Human - © 2012 Pieter Danhieux 9

10. Humans fail at evaluating risk
Could your mother/father/wife/colleague identify the cyber criminal below?
Kristina Svechinskaya Gary McKinnon aka Jonathan James aka
Stole $9Mil with Solo c0mrade
ZeusBot Hacked into 97 US Military Hacked into DTRA
and NASA systems (NASA)
Securing The Human - © 2012 Pieter Danhieux 10

11. Now The Real examples
Securing The Human - © 2012 Pieter Danhieux 11

12. What we security people want ..
Miauwkes! A
Security Alert!
Let’s notify my good
friends at
+1800SECURITY
and ask what to do
Securing The Human - © 2012 Pieter Danhieux 12

13. What really happens..
You f**ing – PUUT
– stupid computer –
PUUT – how the
f*ck – PUUT – do I
remove this – PUUT
– alert
*click* *click* *click
Securing The Human - © 2012 Pieter Danhieux 13

14. Humans need patching
Security Awareness is Nr. 7 in
Australia’s Intelligence Agency “35
Strategies to Mitigate Targeted Cyber
Intrusions”
1. Understand that everyone can be
a target
2. Teach everyone how to recognize
potential attacks at work and at
home
3. Show them how to react and not
to react
= An Intrusion Detection/Prevention System
with thousands of (sometimes intelligent) sensors
Securing The Human - © 2012 Pieter Danhieux 14

15. Agenda
• Context
• Patching Humans
• Top mistakes
Securing The Human - © 2012 Pieter Danhieux 15

16. Social
Executives Networks
PCI DSS Soc. Engin. Hacked!
Protecting
PII Kids IT Staff
Securing The Human - © 2012 Pieter Danhieux 16

17. Download for free from
http://www.securingthehuman.org/resources/
Securing The Human - © 2012 Pieter Danhieux 17

18. Security Awareness Program
• Define what you want them to understand in
the next 6 to 12 months
– Less is more Promoting
– Start with the basics Awareness &
Change
• Deliver Key Messages
Long Term
– Induction brochures Sustainment
– Class-room training / “Free lunch” sessions
– Computer-based training
Metrics
• Reinforce Key Messages
• Evaluate effectiveness
Securing The Human - © 2012 Pieter Danhieux 18

19. Sample 1 Year Program
Jan Feb Mar Apr May Jun
Protecting Social
Kids Networks Passwords
1 2 3 4
Induction Program for new employees
5 6 7 8
IT Staff
Mobile Mobile
PCI DSS Devices Devices
Executives
Jul Aug Sep Oct Nov Dec
Securing The Human - © 2012 Pieter Danhieux 19

20. Deliver Key Message - Example
Securing The Human - © 2012 Pieter Danhieux 20

21. Reinforce Key Messages
Have your
employees come up
with a good way on
how to
communicate a
message …
Securing The Human - © 2012 Pieter Danhieux 21

22. Reinforce Key Messages
Source: http://mn.gov/oet/support/training/cyber-security-awareness/
Securing The Human - © 2012 Pieter Danhieux 22

23. Reinforce Key Messages
Source: http://mindfulsecurity.com/2009/10/23/free-passwords-security-awareness-posters/
Securing The Human - © 2012 Pieter Danhieux 23

24. Evaluate effectiveness
1. Metrics of the Program
– # of people who attend the training or viewed CBT
– Results of employees on Quiz questions
2. Metrics in Operational Processes
– # security incidents reported to the helpdesk
– # laptop losses with/without passwords
– # unescorted visitors
– # vulnerabilities in software code
– # unpatched systems
Securing The Human - © 2012 Pieter Danhieux 24

25. Evaluate effectiveness
3. Metrics by assessing your organization
– Get password statistics
Source: http://www.l0phtcrack.com
Securing The Human - © 2012 Pieter Danhieux 25

26. Evaluate effectiveness
3. Metrics by assessing your organization 77% clicked on
– Simulate the security threat obvious
• Spear phishing on executives malicious links
• Social Engineering the Helpdesk in the email
• Red Team / Blue Team exercises
– Learn from the results
• Was the attack timely detected?
• How was the incident identified?
• How did the employee(s) react?
• Which technical security controls failed?
• Which management processes failed?
Securing The Human - © 2012 Pieter Danhieux 26

27. Agenda
• Context
• Patching Humans
• Top mistakes
Securing The Human - © 2012 Pieter Danhieux 27

28. Top mistakes
1. Consider Security Awareness as a one-off project
instead of a continuous program
2. Execute without thinking or measuring tangible
results
3. Use material that is inappropriate for the AGAIN
organizational culture
4. Drive Security Awareness through Compliance / IT
Security / Consultants without organizational
support
5. Trying to make your employees security experts
Securing The Human - © 2012 Pieter Danhieux 28

29. Useful resources
• The SANS Institute – Securing The Human
http://www.securingthehuman.org
• ENISA - How To Raise Information Security Awareness
http://www.enisa.europa.eu/act/ar/deliverables/2010/new-users-guide
• NIST - SP800-50
http://csrc.nist.gov/publications/nistpubs/800-50/NIST-SP800-50.pdf
• Microsoft – ISATP
http://technet.microsoft.com/en-us/security/cc165442
• Mindful Security – Free Cartoons
http://mindfulsecurity.com
Securing The Human - © 2012 Pieter Danhieux 29

30. #who am I
$finger
Login: pdanhieux Name: Pieter Danhieux
Directory: /geeks/pdanhieux Shell: /bin/sh
On since 2011 on ttysAustralia
On since 1981 on ttysBelgium (messages off)
Mail at <pdanhieux@gmail.com>
Phone at +61 429 503 077 / skype://pdanhieux
Twitter @PieterDanhieux
$id
uid=501(pdanhieux) gid=20(humans) groups= 19(nviso), 20 (SANS Institute), 22 (BAE Systems Detica), 23 (GIAC
Security Expert, CISSP), 24 (BruCON), 666 (The Hex Factor), 1000 (Ernst & Young)
$sudo shutdown –h now
Securing The Human - © 2012 Pieter Danhieux 30