Download as PDF, PPTX
![Company Confidential
Thank You!
QUESTIONS?
Greg Foss
Greg . Foss [at] LogRhythm . com
@heinzarelli](https://image.slidesharecdn.com/black-hat2016-160912203210/75/Activated-Charcoal-Making-Sense-of-Endpoint-Data-62-2048.jpg)
Uploaded byGreg Foss
Activated Charcoal - Making Sense of Endpoint Data
The document discusses the critical importance of endpoint security and emphasizes that the endpoint is the new perimeter for protecting networks. It highlights the prevalence of phishing attacks, training employees, and implementing key focus areas such as incident response and security infrastructure as crucial elements of cybersecurity strategy. Additionally, it covers advanced threats like macro phishing attacks and the necessity of continuous monitoring and detection through automated tools and threat simulations.
More Related Content
Similar to Activated Charcoal - Making Sense of Endpoint Data
Activated Charcoal - Making Sense of Endpoint Data
- 1. Company Confidential Powered by ActivatedCharcoal Making Sense of Endpoint Data
- 2. Company Confidential Greg Foss Headof Global Security Operations OSCP, GAWN, GPEN, GWAPT, GCIH, CEH, Cyber APT
- 3. The Endpoint isthe new Perimeter
- 4. Company Confidential The easiestpath into any network…
- 5. Company Confidential Social Engineering Nothinglike a little pretext to get people to click on your links…
- 6. Company Confidential • Phishing •91% of ‘advanced’ attacks began with a phishing email or similar social engineering tactics. • http://www.infosecurity-magazine.com/view/29562/91-of- apt-attacks-start-with-a-spearphishing-email/ • 2014 Metrics • Average cost per breach => $3.5 million • 15% Higher than the previous year • http://www.ponemon.org/blog/ponemon-institute- releases-2014-cost-of-data-breach-global-analysis
- 7. Company Confidential Drive ByDownloads, Malvertizing, and Watering Hole Attacks Image Source: https://blog.kaspersky.com/what-is-malvertising/5928/
- 8.
- 9.
- 10. Training is Criticalto Success
- 11. Company Confidential Key FocusAreas: • Employees Image Source: http://www.cloudpro.co.uk/hr/5803/gov-offers-hr-workers-free-cyber-security-training
- 12. Company Confidential End UserTips - Phishing
- 13. Company Confidential All YouNeed is +
- 14.
- 15.
- 16. Company Confidential Rogue Wi-FiNetwork – Threat Simulation
- 17. Company Confidential USB Drop– Training Exercise : Case Study
- 18. Company Confidential Building aBelievable Campaign Use realistic files with somewhat realistic data Staged approach to track file access and exploitation
- 19. Company Confidential Profit Send anemail when the Macro is run… Use a bogus email (unlike I did here) – I know, I know. Bad OpSec.
- 20.
- 21. Company Confidential “Nobody’s goingto an an exe from some random USB” - Greg Yep… They ran it...
- 22. Company Confidential Now wehave our foothold… Fortunately they didn’t run this as an admin
- 23.
- 24. Company Confidential Key FocusAreas: • Employees • IT Staff • Roles and Responsibilities • Incident Response Duties • Configuration Monitoring • Malware Removal • Security Infrastructure
- 25. Company Confidential Key FocusAreas: • Employees • IT Staff • Security Staff • Table Top and Red vs Blue Exercises • Threat Simulation Leads to Process Improvement • Announced vs Unannounced Simulations or Penetration Testing
- 26. Company Confidential Purple TeamFTW! • Employees • IT Staff • Security Staff • Table Top and Red vs Blue Exercises • Threat Simulation Leads to Process Improvement • Announced vs Unannounced Simulations or Penetration Testing
- 27. Company Confidential Key FocusAreas: • Employees • IT Staff • Security Staff • Leadership
- 28. Company Confidential Key FocusAreas: • Employees • IT Staff • Security Staff • Leadership • Processes and Procedures
- 29. Continuous Monitoring andDetection
- 30. Company Confidential Automating OSINTand Response Domain Tools Passive Total VirusTotal Cisco AMP ThreatGRID Netflow / IDS Firewalls Proxy / DNS Endpoint SIEM API Integration SecOps Infrastructure
- 31.
- 32.
- 33.
- 34.
- 35. Company Confidential Correlate Network/ Log Activity with Endpoint Data
- 36. Company Confidential Macro PhishingAttacks • Common • Bypasses Most AV • Heavily Obfuscated • Newer attacks targeting Office 365
- 37. Company Confidential Macro AttackDetection
- 38. Company Confidential Full CommandLine Details
- 39. Company Confidential Full CommandLine Details
- 40. Company Confidential Be Careful– Don’t Jump To Conclusions…
- 41. Company Confidential Be Careful– Don’t Jump To Conclusions…
- 42. Centralized Logging andEvent Management
- 43.
- 44. Company Confidential Threat FeedConfiguration
- 45. Company Confidential Full EventAlerting
- 46.
- 47.
- 48. Company Confidential Carbon BlackEvent Forwarder LogRhythm => Use LEEF Format https://github.com/carbonblack/cb-event-forwarder
- 49.
- 50.
- 51.
- 52. Company Confidential Long TailAnalysis Strange activity can bubble to the surface when viewing the whole picture
- 53.
- 54.
- 55. Taking it aStep Further…
- 56. Company Confidential Additional Integration Alarming Triggeron Specific Watch List Hits
- 57.
- 58. Company Confidential Additional Integration Alarming AdminTracking Reporting
- 59. Company Confidential Additional Integration Alarming AdminTracking Reporting Automation Perform Actions Based on Alarms Observed
- 60. Company Confidential LogRhythmChallenge .com Booth #600 #logrhythmchallenge
- 61.
- 62. Company Confidential Thank You! QUESTIONS? GregFoss Greg . Foss [at] LogRhythm . com @heinzarelli