SlideShare a Scribd company logo

Taking the Attacker Eviction Red Pill (v2.0)

•Download as PPTX, PDF•
•
Frode Hommedal
Frode Hommedal

Covertly contain risks while learning from the attacker. Contain: Isolate the attacker but don’t fully evict. Evict: Full removal of the attacker. Remediate: Fix underlying issues that allowed the infiltration. Recover: Restore full functionality. Realign: Change security posture. Each has pros and cons. The right choice depends on your metrics.

Technology
1 of 56
Taking the Attacker Eviction RED PILL
Taking the Attacker Eviction RED PILL Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Or how to structure your thinking when countering espionage and sabotage from “APT”
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 In this talk we will look at the attempted eviction of a mission driven and well organized adversary
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Beware that this is work in progress and still a bit rough around the edges
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response PICERL: Prepare Identify Contain Eradicate Recover Lessons Learned NIST: Preparation Detect & Analyze Contain & Eradicate & Recover Post IncidentActivities Bottom Line: Eventually you will try to get the attacker off your network
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response PICERL: Prepare Identify Contain Eradicate Recover Lessons Learned NIST: Preparation Detect & Analyze Contain & Eradicate & Recover Post IncidentActivities Bottom Line: Eventually you will try to get the attacker off your network
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Turns out there’s a lot of uncertainty to deal with when responding to a targeted and advanced “APT breach”
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response when facing an APT threat Best Practice: Scope before you start responding. Common Misstep: Acting too soon, giving your adversary time to adapt.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response when facing an APT threat Best Practice: Scope before you start responding. Common Misstep: Acting too soon, giving your adversary time to adapt.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 It turns out “acting too soon” is a thing when responding to an APT threat
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 If you want to respond effectively you need to reduce the uncertainty and understand when it’s the right time to act
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Understanding common APT patterns
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intrusion Patterns of “APT” threats Sting Operation: Also called “smash and grab”. A direct attack to get a specific piece of information. Persistent Infiltration: A long running campaign against you, where your adversary will gain and sustain unauthorized access to your infrastructure for a long period of time. Response: When responding, you should take into consideration what kind of pattern you are seeing.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intrusion Patterns of “APT” threats Sting Operation: Also called “smash and grab”. A direct attack to get a specific piece of information. Persistent Infiltration: A long running campaign against you, where your adversary will gain and sustain unauthorized access to your infrastructure for a long period of time. Response: When responding, you should take into consideration what kind of pattern you are seeing.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The Structure of an APT infiltration Access: An APT infiltration is all about access.They work a lot to gain and sustain access. Extract: The purpose of gaining access is to find and extract useful information (or abuse your infrastructure). Deliver: All of this is done to deliver on goals set for the attacker’s mission.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The Structure of an APT infiltration Access: An APT infiltration is all about access.They work a lot to gain and sustain access. Extract: The purpose of gaining access is to find and extract useful information (or abuse your infrastructure). Deliver: All of this is done to deliver on goals set for the attacker’s mission.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The Structure of an APT infiltration Access: An APT infiltration is all about access.They work a lot to gain and sustain access. Extract: The purpose of gaining access is to find and extract useful information (or abuse your infrastructure). Deliver: All of this is done to deliver on goals set for the attacker’s mission.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Providing Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Observing Collection: What you are observing though is only the collection part of a much bigger process.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intermission
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The IR and eviction process should not really be about evicting the attackers but rather keeping them out and preventing them from effortlessly re-entering
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 It also shouldn’t be about cleaning networks but rather mitigating risk as effectively as possible
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 And sometimes this actually means leaving your network compromised while covertly containing the most important risks by using what you learn from the attackers
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 So how do we make that decision?
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 By structured analytical thinking using analytical models
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 DwellTime The time an attacker has stayed undetected in your network. Short: Hours to day. Good changes of catching up with the attacker. Medium: Days to weeks.You may catch up if you have a capable and enabled team. Long: Months to years. Depending on the attacker your chances are in all fairness pretty slim without a full purge or migration.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 DwellTime The time an attacker has stayed undetected in your network. Short: Hours to day. Good changes of catching up with the attacker. Medium: Days to weeks.You may catch up if you have a capable and enabled team. Long: Months to years. Depending on the attacker your chances are in all fairness pretty slim without a full purge or migration.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intrusion Patterns of APT threats Sting Operation: Also called “smash and grab”. A direct attack to get a specific piece of information. Persistent Infiltration: A long running campaign against you, where your adversary will gain and sustain unauthorized access to your infrastructure for a long period of time. Response: When responding, you should take into consideration what kind of pattern you are seeing.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 TheThreatType Matrix ThreatType: Strategic |Tactical | Operational Capability: Low | Medium | High Strategic: You are a high priority and long term target for your adversary Tactical: You are a short/medium term target for a specific reason Operational: You are a target because the attacker wants infrastructure
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 TheThreatType Matrix ThreatType: Strategic |Tactical | Operational Capability: Low | Medium | High Strategic: You are a high priority and long term target for your adversary Tactical: You are a short/medium term target for a specific reason Operational: You are a target because the attacker wants infrastructure
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 TheThreatType Matrix ThreatType: Strategic |Tactical | Operational Capability: Low | Medium | High Strategic: You are a high priority and long term target for your adversary Tactical: You are a short/medium term target for a specific reason Operational: You are a target because the attacker wants infrastructure
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The RiskType Matrix RiskType: Strategic |Tactical | Operational Impact: Low | Medium | High Strategic: Affects your org’s long term strategic goals Tactical: Affects your org’s current and near future execution Operational: Affects your org’s (IT) operation
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The RiskType Matrix RiskType: Strategic |Tactical | Operational Impact: Low | Medium | High Strategic: Affects your org’s long term strategic goals Tactical: Affects your org’s current and near future execution Operational: Affects your org’s (IT) operation
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The RiskType Matrix RiskType: Strategic |Tactical | Operational Impact: Low | Medium | High Strategic: Affects your org’s long term strategic goals Tactical: Affects your org’s current and near future execution Operational: Affects your org’s (IT) operation
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Threat Metrics to help you navigate CTI Matric: Identifying knowledge gaps. ThreatType Matric: Identifying type of threat. RiskType Matric: Identifying type of risk. Intrusion Pattern: Identifying type of infiltration. DwellTime: Identifying length of infiltration.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 With these models in mind we will look at some response patterns
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Wrap up
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 So what truth is THE RED PILL of attacker eviction exposing? A way more complex and adversarial incident response reality than most responders are ready to acknowledge
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Yet the key takeaway is that if you understand your attacker you will be able to improve your response significantly
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Then you can apply the right response pattern to the identified intrusion pattern and the identified threat and risk types
Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Always outnumbered. Never outgunned! @FrodeHommedal no.linkedin.com/in/hommedal frodehommedal.no

Recommended

Taking the Attacker Eviction Red Pill [updated]
Taking the Attacker Eviction Red Pill [updated]Taking the Attacker Eviction Red Pill [updated]
Taking the Attacker Eviction Red Pill [updated]
Frode Hommedal
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
Splunk
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for you
Toby Kohlenberg
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Prachi Mishra
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 

Recommended

Taking the Attacker Eviction Red Pill [updated]
Taking the Attacker Eviction Red Pill [updated]Taking the Attacker Eviction Red Pill [updated]
Taking the Attacker Eviction Red Pill [updated]
Frode Hommedal
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
Splunk
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for you
Toby Kohlenberg
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Prachi Mishra
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
Chi En (Ashley) Shen
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligence
Deep Shankar Yadav
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
Katie Nickels
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
The Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence MatrixThe Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence Matrix
Frode Hommedal
 
Getting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsGetting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigations
Olakanmi Oluwole
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
ATT&CKing with Threat Intelligence
ATT&CKing with Threat IntelligenceATT&CKing with Threat Intelligence
ATT&CKing with Threat Intelligence
Christopher Korban
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
Infosec
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with SplunkSplunk
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
mohamed nasri
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!
MITRE ATT&CK
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Mark Arena
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE - ATT&CKcon
 
osint - open source Intelligence
osint - open source Intelligenceosint - open source Intelligence
osint - open source Intelligence
Osama Ellahi
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
Matthew Dunwoody
 
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
Puppet
 

More Related Content

What's hot

[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
Chi En (Ashley) Shen
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligence
Deep Shankar Yadav
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
Katie Nickels
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
The Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence MatrixThe Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence Matrix
Frode Hommedal
 
Getting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsGetting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigations
Olakanmi Oluwole
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
ATT&CKing with Threat Intelligence
ATT&CKing with Threat IntelligenceATT&CKing with Threat Intelligence
ATT&CKing with Threat Intelligence
Christopher Korban
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
Infosec
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with SplunkSplunk
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
mohamed nasri
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!
MITRE ATT&CK
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Mark Arena
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE - ATT&CKcon
 
osint - open source Intelligence
osint - open source Intelligenceosint - open source Intelligence
osint - open source Intelligence
Osama Ellahi
 

What's hot (20)

[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligence
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
The Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence MatrixThe Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence Matrix
 
Getting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsGetting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigations
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
ATT&CKing with Threat Intelligence
ATT&CKing with Threat IntelligenceATT&CKing with Threat Intelligence
ATT&CKing with Threat Intelligence
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
 
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
 
osint - open source Intelligence
osint - open source Intelligenceosint - open source Intelligence
osint - open source Intelligence
 

Viewers also liked

No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
Matthew Dunwoody
 
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
Puppet
 
Ace Up the Sleeve
Ace Up the SleeveAce Up the Sleeve
Ace Up the Sleeve
Will Schroeder
 
Pwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShellPwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShell
Beau Bullock
 
Obfuscating The Empire
Obfuscating The EmpireObfuscating The Empire
Obfuscating The Empire
Ryan Cobb
 
A Case Study in Attacking KeePass
A Case Study in Attacking KeePassA Case Study in Attacking KeePass
A Case Study in Attacking KeePass
Will Schroeder
 
Invoke-Obfuscation nullcon 2017
Invoke-Obfuscation nullcon 2017Invoke-Obfuscation nullcon 2017
Invoke-Obfuscation nullcon 2017
Daniel Bohannon
 
BSides London 2017 - Hunt Or Be Hunted
BSides London 2017 - Hunt Or Be HuntedBSides London 2017 - Hunt Or Be Hunted
BSides London 2017 - Hunt Or Be Hunted
Alex Davies
 
WMI for Penetration Testers - Arcticcon 2017
WMI for Penetration Testers - Arcticcon 2017WMI for Penetration Testers - Arcticcon 2017
WMI for Penetration Testers - Arcticcon 2017
Alexander Polce Leary
 
SANS DFIR Prague: PowerShell & WMI
SANS DFIR Prague: PowerShell & WMISANS DFIR Prague: PowerShell & WMI
SANS DFIR Prague: PowerShell & WMI
Joe Slowik
 
Building Better Backdoors with WMI - DerbyCon 2017
Building Better Backdoors with WMI - DerbyCon 2017Building Better Backdoors with WMI - DerbyCon 2017
Building Better Backdoors with WMI - DerbyCon 2017
Alexander Polce Leary
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs Blue
Will Schroeder
 
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
Chris Thompson
 
Keeping Up with the Adversary: Creating a Threat-Based Cyber Team
Keeping Up with the Adversary: Creating a Threat-Based Cyber TeamKeeping Up with the Adversary: Creating a Threat-Based Cyber Team
Keeping Up with the Adversary: Creating a Threat-Based Cyber Team
Priyanka Aash
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniques
Symantec Security Response
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
Balaji Rajasekaran
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Kavya racharla ndh-naropanth_fin_jp-final
Kavya racharla ndh-naropanth_fin_jp-finalKavya racharla ndh-naropanth_fin_jp-final
Kavya racharla ndh-naropanth_fin_jp-final
PacSecJP
 

Viewers also liked (18)

No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
 
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
PuppetConf 2017: Inviting Windows to the Puppet Party- Chris Kittell & Derek ...
 
Ace Up the Sleeve
Ace Up the SleeveAce Up the Sleeve
Ace Up the Sleeve
 
Pwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShellPwning the Enterprise With PowerShell
Pwning the Enterprise With PowerShell
 
Obfuscating The Empire
Obfuscating The EmpireObfuscating The Empire
Obfuscating The Empire
 
A Case Study in Attacking KeePass
A Case Study in Attacking KeePassA Case Study in Attacking KeePass
A Case Study in Attacking KeePass
 
Invoke-Obfuscation nullcon 2017
Invoke-Obfuscation nullcon 2017Invoke-Obfuscation nullcon 2017
Invoke-Obfuscation nullcon 2017
 
BSides London 2017 - Hunt Or Be Hunted
BSides London 2017 - Hunt Or Be HuntedBSides London 2017 - Hunt Or Be Hunted
BSides London 2017 - Hunt Or Be Hunted
 
WMI for Penetration Testers - Arcticcon 2017
WMI for Penetration Testers - Arcticcon 2017WMI for Penetration Testers - Arcticcon 2017
WMI for Penetration Testers - Arcticcon 2017
 
SANS DFIR Prague: PowerShell & WMI
SANS DFIR Prague: PowerShell & WMISANS DFIR Prague: PowerShell & WMI
SANS DFIR Prague: PowerShell & WMI
 
Building Better Backdoors with WMI - DerbyCon 2017
Building Better Backdoors with WMI - DerbyCon 2017Building Better Backdoors with WMI - DerbyCon 2017
Building Better Backdoors with WMI - DerbyCon 2017
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs Blue
 
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
 
Keeping Up with the Adversary: Creating a Threat-Based Cyber Team
Keeping Up with the Adversary: Creating a Threat-Based Cyber TeamKeeping Up with the Adversary: Creating a Threat-Based Cyber Team
Keeping Up with the Adversary: Creating a Threat-Based Cyber Team
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniques
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
 
Kavya racharla ndh-naropanth_fin_jp-final
Kavya racharla ndh-naropanth_fin_jp-finalKavya racharla ndh-naropanth_fin_jp-final
Kavya racharla ndh-naropanth_fin_jp-final
 

Similar to Taking the Attacker Eviction Red Pill (v2.0)

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
MITRE - ATT&CKcon
 
201408 fire eye korea user event press roundtable
201408 fire eye korea user event press roundtable201408 fire eye korea user event press roundtable
201408 fire eye korea user event press roundtable
JunSeok Seo
 
Anatomy of the Compromised Insider
Anatomy of the Compromised InsiderAnatomy of the Compromised Insider
Anatomy of the Compromised Insider
Imperva
 
The Cyber Threat Intelligence Matrix: Taking the attacker eviction red pill
The Cyber Threat Intelligence Matrix: Taking the attacker eviction red pillThe Cyber Threat Intelligence Matrix: Taking the attacker eviction red pill
The Cyber Threat Intelligence Matrix: Taking the attacker eviction red pill
Frode Hommedal
 
Opsec for security researchers
Opsec for security researchersOpsec for security researchers
Opsec for security researchers
vicenteDiaz_KL
 
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
Core Security
 
Threat Hunters
Threat HuntersThreat Hunters
Threat Hunters
infosec train
 
Using the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modelingUsing the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modeling
Eric Jernigan MSIA, CISSP, CISM, CRISC
 
Mastering next gen-siem-usecases-part1
Mastering next gen-siem-usecases-part1Mastering next gen-siem-usecases-part1
Mastering next gen-siem-usecases-part1
Priyanka Aash
 
What will Sirtfi change for FIM4R?
What will Sirtfi change for FIM4R?What will Sirtfi change for FIM4R?
What will Sirtfi change for FIM4R?
Hannah Short
 
D3LDN17 - A Pragmatists Guide to DDoS Mitigation
D3LDN17 - A Pragmatists Guide to DDoS MitigationD3LDN17 - A Pragmatists Guide to DDoS Mitigation
D3LDN17 - A Pragmatists Guide to DDoS Mitigation
Imperva Incapsula
 
Adaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber AttacksAdaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber Attacks
Jermund Ottermo
 
Understanding Cyber Attack - Cyber Kill Chain.pdf
Understanding Cyber Attack - Cyber Kill Chain.pdfUnderstanding Cyber Attack - Cyber Kill Chain.pdf
Understanding Cyber Attack - Cyber Kill Chain.pdf
slametarrokhim1
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
Priyanka Aash
 
Module 2 (footprinting)
Module 2 (footprinting)Module 2 (footprinting)
Module 2 (footprinting)
Wail Hassan
 
Intelligence driven defense webinar
Intelligence driven defense webinarIntelligence driven defense webinar
Intelligence driven defense webinar
ThreatConnect
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat
FireEye, Inc.
 
LIFARS - Financial Cybercrime
LIFARS - Financial CybercrimeLIFARS - Financial Cybercrime
LIFARS - Financial Cybercrime
LIFARS
 

Similar to Taking the Attacker Eviction Red Pill (v2.0) (20)

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
 
201408 fire eye korea user event press roundtable
201408 fire eye korea user event press roundtable201408 fire eye korea user event press roundtable
201408 fire eye korea user event press roundtable
 
Anatomy of the Compromised Insider
Anatomy of the Compromised InsiderAnatomy of the Compromised Insider
Anatomy of the Compromised Insider
 
The Cyber Threat Intelligence Matrix: Taking the attacker eviction red pill
The Cyber Threat Intelligence Matrix: Taking the attacker eviction red pillThe Cyber Threat Intelligence Matrix: Taking the attacker eviction red pill
The Cyber Threat Intelligence Matrix: Taking the attacker eviction red pill
 
Opsec for security researchers
Opsec for security researchersOpsec for security researchers
Opsec for security researchers
 
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
 
Threat Hunters
Threat HuntersThreat Hunters
Threat Hunters
 
Using the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modelingUsing the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modeling
 
Mastering next gen-siem-usecases-part1
Mastering next gen-siem-usecases-part1Mastering next gen-siem-usecases-part1
Mastering next gen-siem-usecases-part1
 
What will Sirtfi change for FIM4R?
What will Sirtfi change for FIM4R?What will Sirtfi change for FIM4R?
What will Sirtfi change for FIM4R?
 
Fidelis Cybersecurity Overview
Fidelis Cybersecurity OverviewFidelis Cybersecurity Overview
Fidelis Cybersecurity Overview
 
D3LDN17 - A Pragmatists Guide to DDoS Mitigation
D3LDN17 - A Pragmatists Guide to DDoS MitigationD3LDN17 - A Pragmatists Guide to DDoS Mitigation
D3LDN17 - A Pragmatists Guide to DDoS Mitigation
 
Adaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber AttacksAdaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber Attacks
 
Understanding Cyber Attack - Cyber Kill Chain.pdf
Understanding Cyber Attack - Cyber Kill Chain.pdfUnderstanding Cyber Attack - Cyber Kill Chain.pdf
Understanding Cyber Attack - Cyber Kill Chain.pdf
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
 
Module 2 (footprinting)
Module 2 (footprinting)Module 2 (footprinting)
Module 2 (footprinting)
 
Intelligence driven defense webinar
Intelligence driven defense webinarIntelligence driven defense webinar
Intelligence driven defense webinar
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat
 
SecurityOperations
SecurityOperationsSecurityOperations
SecurityOperations
 
LIFARS - Financial Cybercrime
LIFARS - Financial CybercrimeLIFARS - Financial Cybercrime
LIFARS - Financial Cybercrime
 

Recently uploaded

UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Product School
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
KatiaHIMEUR1
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
OnBoard
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
ControlCase
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
Frank van Harmelen
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Tobias Schneck
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
91mobiles
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 

Recently uploaded (20)

UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 

Taking the Attacker Eviction Red Pill (v2.0)

  • 1. Taking the Attacker Eviction RED PILL
  • 2. Taking the Attacker Eviction RED PILL Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017
  • 3. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Or how to structure your thinking when countering espionage and sabotage from “APT”
  • 4. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 In this talk we will look at the attempted eviction of a mission driven and well organized adversary
  • 5. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Beware that this is work in progress and still a bit rough around the edges
  • 6. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response PICERL: Prepare Identify Contain Eradicate Recover Lessons Learned NIST: Preparation Detect & Analyze Contain & Eradicate & Recover Post IncidentActivities Bottom Line: Eventually you will try to get the attacker off your network
  • 7. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response PICERL: Prepare Identify Contain Eradicate Recover Lessons Learned NIST: Preparation Detect & Analyze Contain & Eradicate & Recover Post IncidentActivities Bottom Line: Eventually you will try to get the attacker off your network
  • 8. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Turns out there’s a lot of uncertainty to deal with when responding to a targeted and advanced “APT breach”
  • 9. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response when facing an APT threat Best Practice: Scope before you start responding. Common Misstep: Acting too soon, giving your adversary time to adapt.
  • 10. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Incident Response when facing an APT threat Best Practice: Scope before you start responding. Common Misstep: Acting too soon, giving your adversary time to adapt.
  • 11. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 It turns out “acting too soon” is a thing when responding to an APT threat
  • 12. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 If you want to respond effectively you need to reduce the uncertainty and understand when it’s the right time to act
  • 13. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Understanding common APT patterns
  • 14. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intrusion Patterns of “APT” threats Sting Operation: Also called “smash and grab”. A direct attack to get a specific piece of information. Persistent Infiltration: A long running campaign against you, where your adversary will gain and sustain unauthorized access to your infrastructure for a long period of time. Response: When responding, you should take into consideration what kind of pattern you are seeing.
  • 15. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intrusion Patterns of “APT” threats Sting Operation: Also called “smash and grab”. A direct attack to get a specific piece of information. Persistent Infiltration: A long running campaign against you, where your adversary will gain and sustain unauthorized access to your infrastructure for a long period of time. Response: When responding, you should take into consideration what kind of pattern you are seeing.
  • 16. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The Structure of an APT infiltration Access: An APT infiltration is all about access.They work a lot to gain and sustain access. Extract: The purpose of gaining access is to find and extract useful information (or abuse your infrastructure). Deliver: All of this is done to deliver on goals set for the attacker’s mission.
  • 17. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The Structure of an APT infiltration Access: An APT infiltration is all about access.They work a lot to gain and sustain access. Extract: The purpose of gaining access is to find and extract useful information (or abuse your infrastructure). Deliver: All of this is done to deliver on goals set for the attacker’s mission.
  • 18. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The Structure of an APT infiltration Access: An APT infiltration is all about access.They work a lot to gain and sustain access. Extract: The purpose of gaining access is to find and extract useful information (or abuse your infrastructure). Deliver: All of this is done to deliver on goals set for the attacker’s mission.
  • 19. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
  • 20. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
  • 21. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
  • 22. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Provide Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Collection: What you are observing though is only the collection part of a much bigger process.
  • 23. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Why you are targeted by an APT attack team Adversarial Relationship: For you to ever be targeted by an APT attack team you must be relevant for some kind of adversarial relationship. Providing Access: And you must provide access to something that will help the offensive party gain an advantage in that relationship. Observing Collection: What you are observing though is only the collection part of a much bigger process.
  • 24. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intermission
  • 25. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The IR and eviction process should not really be about evicting the attackers but rather keeping them out and preventing them from effortlessly re-entering
  • 26. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 It also shouldn’t be about cleaning networks but rather mitigating risk as effectively as possible
  • 27. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 And sometimes this actually means leaving your network compromised while covertly containing the most important risks by using what you learn from the attackers
  • 28. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 So how do we make that decision?
  • 29. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 By structured analytical thinking using analytical models
  • 30. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 DwellTime The time an attacker has stayed undetected in your network. Short: Hours to day. Good changes of catching up with the attacker. Medium: Days to weeks.You may catch up if you have a capable and enabled team. Long: Months to years. Depending on the attacker your chances are in all fairness pretty slim without a full purge or migration.
  • 31. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 DwellTime The time an attacker has stayed undetected in your network. Short: Hours to day. Good changes of catching up with the attacker. Medium: Days to weeks.You may catch up if you have a capable and enabled team. Long: Months to years. Depending on the attacker your chances are in all fairness pretty slim without a full purge or migration.
  • 32. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Intrusion Patterns of APT threats Sting Operation: Also called “smash and grab”. A direct attack to get a specific piece of information. Persistent Infiltration: A long running campaign against you, where your adversary will gain and sustain unauthorized access to your infrastructure for a long period of time. Response: When responding, you should take into consideration what kind of pattern you are seeing.
  • 33. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 TheThreatType Matrix ThreatType: Strategic |Tactical | Operational Capability: Low | Medium | High Strategic: You are a high priority and long term target for your adversary Tactical: You are a short/medium term target for a specific reason Operational: You are a target because the attacker wants infrastructure
  • 34. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 TheThreatType Matrix ThreatType: Strategic |Tactical | Operational Capability: Low | Medium | High Strategic: You are a high priority and long term target for your adversary Tactical: You are a short/medium term target for a specific reason Operational: You are a target because the attacker wants infrastructure
  • 35. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 TheThreatType Matrix ThreatType: Strategic |Tactical | Operational Capability: Low | Medium | High Strategic: You are a high priority and long term target for your adversary Tactical: You are a short/medium term target for a specific reason Operational: You are a target because the attacker wants infrastructure
  • 36. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The RiskType Matrix RiskType: Strategic |Tactical | Operational Impact: Low | Medium | High Strategic: Affects your org’s long term strategic goals Tactical: Affects your org’s current and near future execution Operational: Affects your org’s (IT) operation
  • 37. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The RiskType Matrix RiskType: Strategic |Tactical | Operational Impact: Low | Medium | High Strategic: Affects your org’s long term strategic goals Tactical: Affects your org’s current and near future execution Operational: Affects your org’s (IT) operation
  • 38. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The RiskType Matrix RiskType: Strategic |Tactical | Operational Impact: Low | Medium | High Strategic: Affects your org’s long term strategic goals Tactical: Affects your org’s current and near future execution Operational: Affects your org’s (IT) operation
  • 39. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
  • 40. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
  • 41. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
  • 42. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
  • 43. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
  • 44. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
  • 45. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 The CyberThreat Intelligence Matrix Mapping your knowledge gaps. Depth of knowledge: Footprint | Arsenal |Tradecraft Stages of attack: Prep. | Intrusion | Execution Presentation: https://www.slideshare.net/Frod eHommedal/the-cyber-threat- intelligence-matrix Essay: https://www.mnemonic.no/secu rity-report/making-your-move
  • 46. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Threat Metrics to help you navigate CTI Matric: Identifying knowledge gaps. ThreatType Matric: Identifying type of threat. RiskType Matric: Identifying type of risk. Intrusion Pattern: Identifying type of infiltration. DwellTime: Identifying length of infiltration.
  • 47. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 With these models in mind we will look at some response patterns
  • 48. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
  • 49. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
  • 50. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
  • 51. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Response Patterns for your consideration Ignore: Ignorance or actively ignoring. Disrupt: Continuous remediation. Engage: A game of chess heavily reliant on intelligence and a high operational tempo. Clean: Scope, shut down and clean. Migrate: Build new and migrate.
  • 52. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Wrap up
  • 53. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 So what truth is THE RED PILL of attacker eviction exposing? A way more complex and adversarial incident response reality than most responders are ready to acknowledge
  • 54. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Yet the key takeaway is that if you understand your attacker you will be able to improve your response significantly
  • 55. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Then you can apply the right response pattern to the identified intrusion pattern and the identified threat and risk types
  • 56. Taking the Attacker Eviction Red Pill Frode Hommedal | Telenor | CM2017 Always outnumbered. Never outgunned! @FrodeHommedal no.linkedin.com/in/hommedal frodehommedal.no

Editor's Notes

  1. This talk is about models. Models to help you structure your thinking when you plan your response to an APT breach.
  2. More specifically it will focus on models to structure your thinking regarding the eviction of your attacker from your infrastructure.
  3. More specifically it will focus on models to structure your thinking regarding the eviction of your attacker from your infrastructure.
  4. You’re not cleaning up garbage. You’re (literally) chasing rats. Highly intelligent and organized rodents with malicious intent. This makes it all very fluid and unpredictable.
  5. Compromised assets might actually not be your biggest risks. And sometimes ”cleaning up” your compromised assets will leave you worse off containing the biggest risks.
  6. ”Purge” is sometimes called “nuke and pave”. Or maybe it’s “scorched earth”?
  7. This is military forces used against civilians, in peace time. This is being a fire fighter, and every fire you fight is lit by an arsonist. This is the absence of rule of law. This is being constantly outnumbered and outgunned.