Downloaded 10 times
Uploaded byAdrian Sanabria
Open Source Defense for Edge 2017
The document outlines strategies for building a security program with a zero budget, emphasizing the importance of people, processes, and open-source tools. It discusses foundational frameworks, network mapping, vulnerability scanning, and the necessity of documentation in managing security effectively. The author promotes a structured approach to security that focuses on identifying, protecting, detecting, responding, and recovering, while also encouraging community collaboration and continuous learning.
More Related Content
Similar to Open Source Defense for Edge 2017
![Blue Teamin' on a Budget [of zero]](https://cdn.slidesharecdn.com/ss_thumbnails/bsides-cleveland-170625154621-thumbnail.jpg?width=640&height=640&fit=bounds)
Open Source Defense for Edge 2017
- 1. Open Source Defense Buildinga Security Program with Zero Budget
- 2. NOTE: Special awkwardstandalone edition I use a lot of humor in my talks and I often try to avoid throwing too much text or explanation on slides. The resulting slides aren’t very useful without my voice overlaying them. Since many people ask for my slides following my talks, I do my best to modify the slide deck so that the bulk of the information is still useful, even without me. I still highly recommend the live edition. You can’t ask this one any questions ;)
- 3. Agenda •Budget challenges beyondCapEx/OpEx •Foundations: The big picture and where to start •Specific free & open-source tools to help at each step •Real-World Experiences and Fun Stories* *Randomly dispersed throughout
- 4. whoami – AdrianSanabria IT Practitioner Security Practitioner Security Consultant Industry Analyst Business Owner $
- 5.
- 7. What do wemean when we say “zero budget”? What do we mean when we say “zero budget”? We’re talking having little to no CapEx budget. There’s no getting around needing people. The more smart and creative your people, the more likely you will be to succeed with what we’re talking about today.
- 8. Security: What’s the“True Cost”? • Security = People + Processes + Products People • Salary • Training • Personal Dev • Management Processes • Plan (policy) • Build (controls) • Test (controls) • Improvement Products • CapEx/OpEx • Support • Time to Value • Labor:Value
- 9. Why FOSS? Because RichardStallman, of course! Ha… No, that was a joke. I’m sorry. There are better reasons.
- 10. Why FOSS? Not justfor people with budget constraints! It’s about time and control.
- 11. Commercial 1. Google search 2.Choose three 3. Contact vendors 4. Proof of concept 5. Wine & dine 6. Procurement 7. Implementation Elapsed time: weeks/months FOSS 1. Google search 2. Download 3. Configure Elapsed time: minutes/hours Why FOSS?
- 12. Shelfware Products that arepurchased, but never get used or never fully achieve their intended value
- 13. What ends upon the Shelf? What would keep them off the shelf?
- 14.
- 15. Start with asolid foundation.
- 16. Foundational Blueprints andFrameworks • NIST Standards and Frameworks • CIS Critical Security Controls • ISO 27000 • MITRE @ttack
- 18. Document everything! A coredocumentation repository is critical • Policy, procedure, how-tos, etc: MediaWiki Atlassian Confluence ($10 for up to 10 users) • Incident Response Ticketing/Documentation: RTIR (https://bestpractical.com/download-page) The Hive (https://thehive-project.org/)
- 19. Build from theground up 1. Identify 2. Protect and Harden 3. Detect 4. Respond 5. Recover
- 20.
- 21. The Asset DiscoveryDilemma Active Scanning? Nmap? Vuln Scanner? No. Ask your network! NetDB https://netdbtracking.sourceforge.net/ .ova available at https://www.kylebubp.com/files/netdb.ova
- 22. Other network mappingapproaches • nmap + ndiff/yandiff Not just for red teams. Export results, diff for changes. Alert if something changed. • Netdisco https://sourceforge.net/projects/netdisco Uses SNMP to inventory your network devices
- 23. Data Discovery • Usersare good at putting sensitive data on the network. • Find it with OpenDLP
- 24. OpenVAS • Fork ofNessus • Still maintained • Default vuln scanner in AlienVault • Does a great job in comparison w/ commercial products
- 25. Web Apps too! •Arachni Framework (arachni-scanner.com) • OWASP ZAP (Zed Attack Proxy) • Nikto2 (more of a server config scanner) • Portswigger Burp Suite (not free - $350) • For a comparison – sectoolmarket.com
- 26. In addition tofixing vulnerabilities… • Build in some additional security on your web servers. (also part of a secure configuration) • Fail2ban Python-based IPS that runs off of Apache Logs • Modsecurity Open source WAF for Apache & IIS
- 27. Build from theground up 1. Identify 2. Protect and Harden 3. Detect 4. Respond 5. Recover
- 28.
- 29.
- 30. Host-based IDS • MonitorCritical and Sensitive Files via Integrity Checks • Detects Rootkits • Can monitor Windows Registry • Alert on Changes
- 31. Windows 10 –Out of the box – CIS Benchmark 22%The goal shouldn’t be 100%, but we can do better than 22%! Also, you should probably try some basic Windows hardening best practices before spending $75 per endpoint on the latest next gen AI super-APT defenderer anti-badware silver bullet.
- 32. Secure Configuration • CISBenchmarks / DISA Stigs • Configuration Management, while not exciting, is important • Deploy configs across your enterprise using tools like GPO, Chef, Puppet, or Ansible • Change Management is also important • Use git repo for tracking changes to your config scripts
- 33. Explaining the nextslide: Patch it all! (kinda) The general idea here is that whenever someone gets breached, we hear the industry’s brightest loudest stars lob criticisms at the victims about ‘patching’ and ‘doing the basics’. In most cases, the critics have never had to install a patch across 35,000 endpoints running 27 distinct gold images across three major operating system versions. They’ve never had to deal with a vendor that had to ‘certify’ a patch before it is allowed to be installed. They don’t appreciate the fact that patching is singlehandedly the most disruptive thing that happens to an IT environment… on purpose.
- 34. PATCH IT ALL(kinda)
- 35.
- 36.
- 37. Build from theground up 1. Identify 2. Protect and Harden 3. Detect 4. Respond 5. Recover
- 38. What’s happening onthe endpoint? • Facebook-developed osquery is effectively free EDR • Agents for MacOS, Windows, Linux • Deploy across your enterprise w/ Chef, Puppet, Ansible, or SCCM • Do fun things like, search for IoCs (hashes, processes, etc.) • Pipe the data into ElasticStack for visibility & searchability • If you only need Windows, check out Microsoft Sysinternals Sysmon
- 39. What’s happening onthe network? • Elkstack • Suricata • Bro • Snort • SecurityOnion: put it all together
- 40. Logging and Monitoring •Central logging makes detection and analysis easier • Many options here, such as Windows Event Subscription, rsyslog • Can also pipe to one central location with dashboards, such as ElasticStack • Good idea to include DNS logs!
- 41.
- 42. Phishing Education PhishingFrenzy Social Engineering Toolkit (SET) GoPhish
- 43. Parting thoughts… • Buildversus Buy • Security Requirements don’t change, regardless of budget. • Build a strong foundation and branch out. • Consider scenarios – solve one scenario at a time, NOT all at once! • Stay curious and contribute to projects you like. • Community! Share ideas – learn from others • DOCUMENT EVERYTHING
- 44.
Editor's Notes
- #5 So my path has been interesting, and has aged me. This is what I look like now (Gollum) Donita did my hair and makeup today.
- #7 What do we mean when we say “zero budget”? We’re talking CapEx. There’s no getting around needing people. The more smart and creative your people, the more likely you will be to succeed with what we’re talking about today.
- #10 Because Richard Stallman!
- #15 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #16 This is the burj khalifa. It’s the tallest building in the world and you don’t build something this amazing without a strong foundation. I believe that the CIS-20 and the NIST Frameworks are great places to find guidance on how to build solid foundations. Your security program will only be as good as it’s foundation.
- #17 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #19 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #20 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #21 After you have all this data, map your damn network! This helps the security team, the IR team, and the network/systems admins. I know it’s not fun, but it’s important.
- #22 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #23 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #24 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #25 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #26 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #27 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #28 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #29 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #30 Now that you’ve got yourself a good foundation (you know whats out there, you know where your risk is, and you’re taking steps to eliminate it) you want to be notified when things are trying to break thru. Normall uses signatures or is looking for changes in behavior that might be malicious.
- #31 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #33 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #34 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #35 For the things you can patch, there are many options. If you can’t patch, you need to figure out how to isolate those devices and be alerted when things/people access them. Talk about vulnerability management program.
- #36 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #37 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #38 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #39 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #40 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #41 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- #42 User education is important. Our role is to be a consultant and an educator, for everyone in the organization.
- #43 I can’t stress how important this is… talk about users loving to click and the easy way in. 2FA is important… I know of no free one. Google Authenticator kind of…
- #44 Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?