MA
Uploaded byMITRE ATT&CK
PDF, PPTX3,667 views

Threat Modelling - It's not just for developers

The document discusses threat modeling and describes how to build threat intelligence from first principles when threat data is lacking. It provides background on the author and outlines a plan to discuss protecting networks through specific examples, understanding customers, preparing for conferences, and managing technical debt. Detection techniques and their corresponding ATT&CK techniques are also mapped out.

Technology◦
In this document
Powered by AI

Introduction to threat modelling emphasizing its relevance beyond developers and the importance of building threat intelligence.

Exploration of specific SD-WAN threat models. Focus on threat validation and deployment aspects.

Highlighting the need for knowing your customer concerning threats like credential stuffing and defense mechanisms.

Overview of research involving Mimikatz and UNIX systems, methods of defense against credential dumping.

Discussion of managing vulnerabilities and implementing auditing controls in a retail banking application.

Final thoughts on technologies, methods, and conceptual approaches to security beyond conventional metrics.

Provision of additional resources for further knowledge on threat models and detection techniques.

Embed presentation

Download as PDF, PPTX
Tim (Wadhwa-)Brown Security Research Lead, CX Technology & Transformation Group March 2022 It’s not just for developers Threat Modelling
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 2 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public ATT&CK is a game changer and where it works, it can enable blue and red to co-exist and work effectively together • However, what happens when it falls short and the threat intelligence and hypotheses doesn’t exist? • How do you build threat intelligence, threat models, threat simulations and threat hunt hypotheses from first principles?
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 3 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Introduction • TLDR • # whoami • # cat .plan
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 4 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public TLDR • Not a data scientist • Could play one in a movie • No particular brief to think blue or red • This is not a solved problem
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 5 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public # whoami • Tim (Wadhwa-)Brown • Backgroundin telecoms and financial services sectors • 15+ years at Portcullis (and now Cisco) • Security Research Lead, CX EMEAR Technology & Transformation Group • Ex-NCSC CHECK Team Leader (9 years) • CREST Registered Threat Intelligence Analyst • CREST Practitioner Intrusion Analyst • ISO 27001 LA • >150 CVEs to my name • Covering Windows, Linux, AIX and Solaris platforms • Userland through to kernel • Most recent research: Where 2 Worlds Collide: Bringing Mimikatz et al to UNIX, Black Hat Europe 2018
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 6 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public # cat .plan • Background • Protecting a typical network • Specific examples • Knowing your customer • Preparing for Black Hat • Managing (technical) debt • Conclusions
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 Protecting a typical network
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 MEF88 SD- WAN threat model
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 9 Examining the SD-WAN threat model
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 10 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How would you validate it? • Validating an SD-WAN implementation • Test against specification • Focus • Implementation • Operation • Use case • 94/113 threats in the current draft MEF88 threat model are deployment rather than design specific
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 Let’s look at some more specific examples
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Knowing your customer
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public The incident • Platform suffering from credential stuffing • T1078: Valid Accounts • Credential stuffing wasn’t in my vocabulary • Not sure what this is • Tools/configs identified on a “hacking forum”
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How did we defend against it? • Realised it’s using an old OpenSSL release • Engineer block based on TLS ciphers • Compare ciphers? • Easier, look at size of selected suites • SSL::cipher clientlist • Detection • DS0028: Logon Session • DS0002: User Account
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Preparing for Black Hat
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public The research • Where 2 worlds collide: Bringing Mimikatz et al to UNIX • T1003: OS Credential Dumping • T1558: Steal or Forge Kerberos Tickets • I wrote Linikatz
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How did would you defend against it? • Auditd • Check the syscalls • Check file access • -a always,exit-F dir=/var/lib/sss/db- F perm=rwx -k linikatz-sss • Look for static numeric values to match on • Constants • Size parameters • -a always,exit-F arch=b64 -S connect -F a2=0x2f-k linikatz-vas • Detection • DS0017: Command • DS0022: File • DS0009: Process
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Managing (technical) debt
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public The vulnerability • Insecure permissions on a retail banking application • T1005: Data from Local System • T1083: File and Directory Discovery • Uncooperative vendor • Legal moving slowly
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How did I defend against it? • ACLs and auditing • Scripting the generation of an auditing policy and bespoke ACLs based on the output of `find’ • Detection • DS0017: Command • DS0009: Process
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 find /opt/component -name –perm -o+w | while read filename do printf -- "-w %s -p r -k flag-%s-rn" “${filename}” “$(printf ”%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules printf -- "-w %s -p w -k flag-%s-wn" “${filename}” “$(printf ”%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules printf -- "-w %s -p w -k flag-%s-xn" “${filename}” “$(printf ”%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules printf -- "-w %s -p a -k flag-%s-an" “${filename}” “$(printf "%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules done A dirty script
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 Conclusions
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Technique Detection Technique Detection Technique Detection Initial Access Credentialed Access Discovery & Collection T1078: Valid Accounts DS0028: Logon Session T1003: OS Credential Dumping DS0017: Command T1083: File and Directory Discovery DS0017: Command DS0002: User Account T1558: Steal or Forge Kerberos Tickets DS0022: File T1005: Data from Local System DS0009: Process DS0009: Process Putting it all together…
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 • Security isn’t all hashes, hostnames and IPs, at least not to begin with • Be imaginative and encourage others to experiment • Study your target • Don’t be afraid to break out the white board • Think application-layer, not just network and transport • ATT&CK gives blue and red a shared language, make full use of it • Have fun! Final thoughts
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 Questions? twadhwab@cisco.com
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 27 Bonus material
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Useful links • All of the threats - Intelligence, modelling, simulation and hunting through an ATT&CKers lens • https://github.com/MEF- GIT/MEF-SDWAN- Application-Flow-Security- Threat-Model • Where 2 worlds collide: Bringing Mimikatz et al to UNIX • https://github.com/timb- machine/linux-malware
© 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public 29 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Useful links • Microsoft Threat Modeling Tool • https://github.com/cisco/j oy/ • https://man7.org/linux/ma n- pages/man1/strace.1.html • https://man7.org/linux/ma n- pages/man8/auditctl.8.htm l

More Related Content

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 

What's hot

PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
PDF
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 
PDF
Cyber Threat hunting workshop
byArpan Raval
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
ATT&CKcon Intro
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 
Cyber Threat hunting workshop
byArpan Raval
 

Similar to Threat Modelling - It's not just for developers

PPT
hacking and crecjing
byparth jasani
 
PDF
Cisco Connect Toronto 2017 - Security Through The Eyes of a Hacker
byCisco Canada
 
PPTX
Ccna sv2 instructor_ppt_ch1
bySalmenHAJJI1
 
PDF
Implementing Cisco Network Security Exam (210-260)
byJhoni Guerrero
 
PDF
CONFidence2015: Real World Threat Hunting - Martin Nystrom
byPROIDEA
 
PDF
Information Security Risk Management
byipspat
 
PDF
DEVNET-1190 Targeted Threat (APT) Defense for Hosted Applications
byCisco DevNet
 
PDF
CODE BLUE 2014 : Physical [In]Security: It’s not ALL about Cyber by Inbar Raz
byCODE BLUE
 
PDF
Cisco cybersecurity essentials chapter - 2
byMukesh Chinta
 
PPT
Ccna+sec+ch01+ +overview+security
bymysoria
 
PDF
It nv51 instructor_ppt_ch11
bynewbie2019
 
PDF
[CONFidence 2016] Gaweł Mikołajczyk - Making sense out of the Security Operat...
byPROIDEA
 
PPTX
apl5iy2ftxiwofbhsmxj-signature-584e2459f99b5370bda435f09b42cc84cc8c063b8cd454...
byChrysostomos Christofi
 
PDF
CNIT 123: Ch 13: Network Protection Systems
bySam Bowne
 
PPTX
012 2 ccna sv2-instructor_ppt_ch9
byBabaa Naya
 
PDF
Mfg workshop security
byRobert Albach
 
PPTX
CSE_Instructor_Materials_Chapter7.pptx
byMohammad512578
 
PDF
A modern approach to safeguarding your ICS and SCADA systems
byAlane Moran
 
PDF
Network security
bySri Manakula Vinayagar Engineering College
 
PDF
Hack Attacks Denied Complete Guide To Network Lockdown John Chirillo
byhhkektjqcj792
 
hacking and crecjing
byparth jasani
 
Cisco Connect Toronto 2017 - Security Through The Eyes of a Hacker
byCisco Canada
 
Ccna sv2 instructor_ppt_ch1
bySalmenHAJJI1
 
Implementing Cisco Network Security Exam (210-260)
byJhoni Guerrero
 
CONFidence2015: Real World Threat Hunting - Martin Nystrom
byPROIDEA
 
Information Security Risk Management
byipspat
 
DEVNET-1190 Targeted Threat (APT) Defense for Hosted Applications
byCisco DevNet
 
CODE BLUE 2014 : Physical [In]Security: It’s not ALL about Cyber by Inbar Raz
byCODE BLUE
 
Cisco cybersecurity essentials chapter - 2
byMukesh Chinta
 
Ccna+sec+ch01+ +overview+security
bymysoria
 
It nv51 instructor_ppt_ch11
bynewbie2019
 
[CONFidence 2016] Gaweł Mikołajczyk - Making sense out of the Security Operat...
byPROIDEA
 
apl5iy2ftxiwofbhsmxj-signature-584e2459f99b5370bda435f09b42cc84cc8c063b8cd454...
byChrysostomos Christofi
 
CNIT 123: Ch 13: Network Protection Systems
bySam Bowne
 
012 2 ccna sv2-instructor_ppt_ch9
byBabaa Naya
 
Mfg workshop security
byRobert Albach
 
CSE_Instructor_Materials_Chapter7.pptx
byMohammad512578
 
A modern approach to safeguarding your ICS and SCADA systems
byAlane Moran
 
Network security
bySri Manakula Vinayagar Engineering College
 
Hack Attacks Denied Complete Guide To Network Lockdown John Chirillo
byhhkektjqcj792
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 

Recently uploaded

PDF
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
PDF
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
PPTX
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
PDF
Greetings All Students Update 3 by Mia Corp
by©LDMMIA, ©Reiki Yoga
 
PDF
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
PDF
ElyriaSoftware — Powering the Future with Blockchain Innovation
byElyria Software
 
PDF
Generative AI in 2026: Hype, Bubble, Winter or The Real Deal?
byDr. Tathagat Varma
 
PDF
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
DOCX
Cloud Security, Serverless Security. Cybersecurity
byEdcelPacayraDuena
 
PDF
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
PDF
Hybrid Cloud vs Multi-Cloud Strategy 2025
byTeleglobal International
 
PDF
Day 1 - Cloud Security Strategy and Planning ~ 2nd Sight Lab ~ Cloud Security...
by2nd Sight Lab
 
PDF
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 
PDF
December Patch Tuesday
byIvanti
 
DOCX
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
PPTX
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
PDF
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
Security Technologys: Access Control, Firewall, VPN
byShielaLasala
 
PDF
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
Greetings All Students Update 3 by Mia Corp
by©LDMMIA, ©Reiki Yoga
 
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
ElyriaSoftware — Powering the Future with Blockchain Innovation
byElyria Software
 
Generative AI in 2026: Hype, Bubble, Winter or The Real Deal?
byDr. Tathagat Varma
 
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
Cloud Security, Serverless Security. Cybersecurity
byEdcelPacayraDuena
 
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
Hybrid Cloud vs Multi-Cloud Strategy 2025
byTeleglobal International
 
Day 1 - Cloud Security Strategy and Planning ~ 2nd Sight Lab ~ Cloud Security...
by2nd Sight Lab
 
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 
December Patch Tuesday
byIvanti
 
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
Security Technologys: Access Control, Firewall, VPN
byShielaLasala
 
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 

Threat Modelling - It's not just for developers

  • 1.
    Tim (Wadhwa-)Brown Security ResearchLead, CX Technology & Transformation Group March 2022 It’s not just for developers Threat Modelling
  • 2.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 2 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public ATT&CK is a game changer and where it works, it can enable blue and red to co-exist and work effectively together • However, what happens when it falls short and the threat intelligence and hypotheses doesn’t exist? • How do you build threat intelligence, threat models, threat simulations and threat hunt hypotheses from first principles?
  • 3.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 3 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Introduction • TLDR • # whoami • # cat .plan
  • 4.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 4 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public TLDR • Not a data scientist • Could play one in a movie • No particular brief to think blue or red • This is not a solved problem
  • 5.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 5 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public # whoami • Tim (Wadhwa-)Brown • Backgroundin telecoms and financial services sectors • 15+ years at Portcullis (and now Cisco) • Security Research Lead, CX EMEAR Technology & Transformation Group • Ex-NCSC CHECK Team Leader (9 years) • CREST Registered Threat Intelligence Analyst • CREST Practitioner Intrusion Analyst • ISO 27001 LA • >150 CVEs to my name • Covering Windows, Linux, AIX and Solaris platforms • Userland through to kernel • Most recent research: Where 2 Worlds Collide: Bringing Mimikatz et al to UNIX, Black Hat Europe 2018
  • 6.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 6 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public # cat .plan • Background • Protecting a typical network • Specific examples • Knowing your customer • Preparing for Black Hat • Managing (technical) debt • Conclusions
  • 7.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 7 Protecting a typical network
  • 8.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 8 MEF88 SD- WAN threat model
  • 9.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 9 Examining the SD-WAN threat model
  • 10.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 10 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How would you validate it? • Validating an SD-WAN implementation • Test against specification • Focus • Implementation • Operation • Use case • 94/113 threats in the current draft MEF88 threat model are deployment rather than design specific
  • 11.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 11 Let’s look at some more specific examples
  • 12.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 12 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Knowing your customer
  • 13.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 13 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public The incident • Platform suffering from credential stuffing • T1078: Valid Accounts • Credential stuffing wasn’t in my vocabulary • Not sure what this is • Tools/configs identified on a “hacking forum”
  • 14.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 14 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How did we defend against it? • Realised it’s using an old OpenSSL release • Engineer block based on TLS ciphers • Compare ciphers? • Easier, look at size of selected suites • SSL::cipher clientlist • Detection • DS0028: Logon Session • DS0002: User Account
  • 15.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 15 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Preparing for Black Hat
  • 16.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 16 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public The research • Where 2 worlds collide: Bringing Mimikatz et al to UNIX • T1003: OS Credential Dumping • T1558: Steal or Forge Kerberos Tickets • I wrote Linikatz
  • 17.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 17 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How did would you defend against it? • Auditd • Check the syscalls • Check file access • -a always,exit-F dir=/var/lib/sss/db- F perm=rwx -k linikatz-sss • Look for static numeric values to match on • Constants • Size parameters • -a always,exit-F arch=b64 -S connect -F a2=0x2f-k linikatz-vas • Detection • DS0017: Command • DS0022: File • DS0009: Process
  • 18.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 18 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Managing (technical) debt
  • 19.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 19 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public The vulnerability • Insecure permissions on a retail banking application • T1005: Data from Local System • T1083: File and Directory Discovery • Uncooperative vendor • Legal moving slowly
  • 20.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 20 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public How did I defend against it? • ACLs and auditing • Scripting the generation of an auditing policy and bespoke ACLs based on the output of `find’ • Detection • DS0017: Command • DS0009: Process
  • 21.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 21 find /opt/component -name –perm -o+w | while read filename do printf -- "-w %s -p r -k flag-%s-rn" “${filename}” “$(printf ”%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules printf -- "-w %s -p w -k flag-%s-wn" “${filename}” “$(printf ”%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules printf -- "-w %s -p w -k flag-%s-xn" “${filename}” “$(printf ”%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules printf -- "-w %s -p a -k flag-%s-an" “${filename}” “$(printf "%s” "${filename}" | tr "/" "_")”>>/etc/audit/rules.d/honeypot-component-dynamic.rules done A dirty script
  • 22.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 22 Conclusions
  • 23.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 23 Technique Detection Technique Detection Technique Detection Initial Access Credentialed Access Discovery & Collection T1078: Valid Accounts DS0028: Logon Session T1003: OS Credential Dumping DS0017: Command T1083: File and Directory Discovery DS0017: Command DS0002: User Account T1558: Steal or Forge Kerberos Tickets DS0022: File T1005: Data from Local System DS0009: Process DS0009: Process Putting it all together…
  • 24.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 24 • Security isn’t all hashes, hostnames and IPs, at least not to begin with • Be imaginative and encourage others to experiment • Study your target • Don’t be afraid to break out the white board • Think application-layer, not just network and transport • ATT&CK gives blue and red a shared language, make full use of it • Have fun! Final thoughts
  • 25.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 25 Questions? twadhwab@cisco.com
  • 27.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 27 Bonus material
  • 28.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 28 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Useful links • All of the threats - Intelligence, modelling, simulation and hunting through an ATT&CKers lens • https://github.com/MEF- GIT/MEF-SDWAN- Application-Flow-Security- Threat-Model • Where 2 worlds collide: Bringing Mimikatz et al to UNIX • https://github.com/timb- machine/linux-malware
  • 29.
    © 2022 Ciscoand/or its affiliates. All rights reserved. Cisco Public 29 © 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Useful links • Microsoft Threat Modeling Tool • https://github.com/cisco/j oy/ • https://man7.org/linux/ma n- pages/man1/strace.1.html • https://man7.org/linux/ma n- pages/man8/auditctl.8.htm l