Stranded on Infosec Island: Defending the Enterprise with Nothing but Windows and Your Wits
•
1 j'aime•698 vues
This document provides an agenda and overview for an information security workshop on defending endpoints with Windows tools and knowledge. The workshop covers why malware is difficult to defeat due to shifting attack surfaces and blind spots like endpoints. It discusses how most security investments go to perimeter defenses rather than endpoints. The document outlines strategies for improving endpoint visibility and resilience through detection tools like EDR and hardening. It also discusses using real malware samples in hands-on labs to understand ransomware behavior and opportunities for disruption. The goal is to demonstrate how to achieve security with only Windows tools by leveraging detection and resilience over reliance on prevention alone.
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Stranded on Infosec Island: Defending the Enterprise with Nothing but Windows and Your Wits
Similaire à Stranded on Infosec Island: Defending the Enterprise with Nothing but Windows and Your Wits (20)
Plus de Adrian Sanabria
Plus de Adrian Sanabria (13)
Dernier
Dernier (20)
Stranded on Infosec Island: Defending the Enterprise with Nothing but Windows and Your Wits
- 1. STRANDED ON INFOSEC ISLAND: DEFENDING THE ENTERPRISE WITH NOTHING BUT WINDOWS AND YOUR WITS Adrian Sanabria Director of Research,Threatcare @sawaba
- 2. Help me better understand you and what you’re hoping to get out of this workshop! (6 Questions) https://bit.ly/InfoSecIslandSurvey Grab the latest copy of the slides • Use QR code to the right • Email sawaba@SendYourSlides.com with InfoSecWorld2018 as the Subject. https://clients.amazonworkspaces.com/ GETTING STARTED 1 2 3
- 3. WHOAMI – ADRIAN SANABRIA IT Practitioner Security Practitioner Security Consultant Industry Analyst Business Owner $
- 4. 9:00am - PART1 (90min) Why Malware Wins 10:30am – BREAK1 (15min) 10:45am – PART2 (75min) Defensive Strategy 12:00pm – LUNCH (45min) 12:45pm – PART3 (105min) Windows Defenses LABS 2:30pm – BREAK2 (15min) 2:45pm – PART4 (135min) Disrupting Malware LABS 5:00pm – FINISHED AGENDA
- 5. We’re going to play with some real malware. I’ve made efforts to minimize the risk. If you’re not 100% comfortable with that, don’t do it – look at a neighbor’s laptop or borrow a chromebook. I don’t recommend doing this on a corporate laptop unless you have permission or are planning on wiping it before putting it back on a production network. Neither Adrian, Threatcare, nor MISTI are responsible for any malware infections that occur. YOU HAVE BEEN WARNED IN ALL CAPS (which makes lawyers more comfortable) WARNING
- 7. WHAT’S THE POINT HERE? WHY “INFOSEC ISLAND”? Time Underused Resources Expense in Depth Agility
- 8. WHAT’S THIS ALL ABOUT? What if we already had everything we needed to stop attacks… …but didn’t realize it?
- 9. WHY IS THE ENDPOINT IMPORTANT? 1. This is where work happens 2. One of the easiest paths into a company 3. BYOD and ShadowIT are unsolved problems
- 10. WHY IS MALWARE SO DIFFICULT TO DEFEAT? 1. We no longer have one perimeter: we have many 2. Endpoint is a blind spot 3. Shifting the blame (we get hacked because users click links) 4. Discarding solutions because they weren’t perfect 5. Bad guys can shift tactics much more quickly 10
- 11. YET MOST OF OUR INVESTMENTS GO INTO ONE PERIMETER 11 90%+ of the security budget* * - varies quite a bit from company to company
- 12. THE BIG 4 ENTERPRISE BLIND SPOTS 12 Endpoint East-West Traffic Cloud/SaaS Data
- 14. RESILIENCE IS THE ULTIMATE GOAL 14 NGAV EDR Hardening
- 16. AV FAILED. WHY?
- 17. WHERE THE INDUSTRY FAILED Products that only work at corporate HQ Products that break the user Assuming any one layer must achieve 100% efficacy Products that bury the analyst in data Making consumers a secondary priority 17
- 18. SHOCKER: KILLING AV SHOULD BE THE GOAL. Thought: What if you could be secure without AV now? Thought: What if using AV was more of a risk than not using it?
- 19. UNDERSTANDING THE ATTACK SURFACE AND VECTORS 3 ways to get malware or hacked Direct: You run my code willingly Indirect: I trick you into doing something that results in you running my code Exploit: I use vulnerabilities in your software to get in… …and vulns are EVERYWHERE Malware delivery
- 20. SECURITY PRODUCTS ARE ATTACK SURFACE Found while researching AV security products: • malware is unpacked in the kernel • RCEs that give attacker SYSTEM/root • 7yro vuln-ridden OSS baked in Not just endpoint: AV engines are embedded EVERYWHERE Tavis Ormandy, Google Project Zero
- 21. SECURITY SOFTWARE: THE LOWEST-HANGING FRUIT? “Because Symantec uses a filter driver to intercept all system I/O, just emailing a file to a victim or sending them a link to an exploit is enough to trigger it - the victim does not need to open the file or interact with it in anyway.” 21
- 22. WHERE DID WE GO WRONG? 22
- 23. WHERE DID WE GO WRONG? 1.Not enough root cause analysis 2.Not enough process improvement (if any) 3.Even when we do succeed, we force the attacker to change tactics. Are we ready for that?
- 24. STORY TIME! Advanced Malware Detection, Day 1: ZEUS Advanced Malware Detection, Day 2: Advanced Malware Detection, Day 234:
- 25. STORY TIME! The bad guys will find a way to evade preventative controls.
- 26. DEFENSE EXPENSE IN DEPTH HAS FAILED Defense Attack 26 Phishing Email Malware Link C2 Comms Pivoting Exfiltration Email Security Security Awareness URL/IP reputation; Malware Sandbox Endpoint Security; IDS/IPS East/West Security Visibility Data Loss Prevention Failures User clicks Malicious link not detected AV misses malware, Network Security misses C2 Enterprise blind spot Alert doesn’t trigger, or is missed Conclusion? Thorough testing and configuration of defenses.
- 28. RANSOMWARE – A BIT DIFFERENT FROM ANYTHING WE’VE SEEN
- 29. RANSOMWARE’S DEPENDENCIES In order to work, ransomware must succeed in two tasks: 1. Create a situation of need 2. Enable the victim to pay Take either of these away and it doesn’t work. Ransomware wants needs to be seen.
- 30. RANSOMWARE’S DEPENDENCIES… DISRUPTED In other words: 1. If you have real-time backups with quick, easy recovery 2. If you’re not a Windows-heavy shop 3. You use off-prem DaaS Thought: what if malware was fragile and easily disrupted? Thought: what if the criminals screw up and no one can pay?
- 31. HOW DOES RANSOMWARE WORK? THE PAYLOAD Campaign Exploit Dropper Payload
- 32. HOW DOES THE PAYLOAD WORK? EXTORTION AT THE CORE Ransomware’s goal is to extort the victim into paying a ransom. First thing to check: is that really what you’re dealing with? Ransomware with no way to pay = WIPER
- 33. HOW DOES THE PAYLOAD WORK? ENCRYPTION Crypto ransomware uses encryption to hold all your files hostage. kinda… sometimes… some of
- 34. HOW DOES THE PAYLOAD WORK? KEY MANAGEMENT; GETTING PAID Ultimately, the decryption key is what you pay for – it’s everything • How and where does it get created? • Where is it stored? Thought: How much of Bitcoin’s current value is due to the success of ransomware?
- 36. HOW DOES THE DROPPER WORK? 1. The C2 and Dropper work together 2. Register victim 3. Assign payment address 4. Download payload(s) 5. Execute payload(s) 6. (Optionally) spread to other victims
- 38. HOW DOES THE EXPLOIT WORK? 1. Phishing is overwhelmingly most common 2. Wannacry/NotPetya are notable exceptions 3. Same way any other malware spreads
- 40. HOW DOES THE CAMPAIGN WORK? Again, much like any other malware campaign: 1. Buy/create C2 infrastructure (hack a bunch of WordPress sites) 2. Ransomware works with C2 to manage victims much like a botnet does, but with different goals 3. Set up scheme to cash out/launder payments 4. Set up phishing/exploit campaign
- 41. HOW DOES RANSOMWARE WORK FAIL: DISRUPTION Campaign Exploit Dropper Payload Disrupt Disrupt Disrupt Disrupt
- 42. OPPORTUNITIES FOR DISRUPTION Campaign Distribution channels DNS Email Security Exploit Patching Virtual Patching Mitigations Block Attack Vector Dropper EDR; Behavior Signature; AV; IoC DNS Web Proxy; SWG Payload EDR; Behavior Signature; AV; IoC Outbound Access Control Application Control
- 43. EXAMPLES: RANSOMWARE PREVENTION Prevention Kill any process attempting to stop the volume shadow service (VSS) If a powershell or CMD process is created shortly after opening an office document, inspect and/or quarantine the office document. Create a folder sure to be the first in an alphabetical list (__aardvarks). Trigger a containment action (e.g., isolate machine). Recovery Decryptors PayBreak https://eugenekolo.com/static/paybreak.pdf https://github.com/BUseclab/paybreak 43
- 44. 1. How else could we disrupt crypto-ransomware? 2. Other than encrypting files, how else could ransomware work? 3. How many endpoint products do you have and how are you using them? DISCUSSION: RANSOMWARE
- 45. BREAK TIME! REST YOUR BRAIN, (EMPTY) REFILL YOUR BODY
- 47. LAB TIME - LET’S BREAK STUFF!
- 48. 1.Run Amazon Workspaces 2.Enter the registration code on the right 3.Log in with your assigned failuser 4.Double-click Install Amazon WorkDocs 5.Navigate to Shared With Me InfectMe Ransomwares 6.Brace yourself 7.Double-click Wannacry.exe 8.Watch the horror unfold, note the changes, play around LAB INSTRUCTIONS WORKSPACES REG CODE: SLiad+LXZ8KE
- 49. THE IMPORTANCE OF DETECTION
- 50. A HEALTHY, BALANCED DIET Malware that bypassed AV PUPs & PUAs Ransom- ware Exploit kits Filter out as much as possible with preventative controls Detect the rest! A prevention-only approach is self- imposed blindness
- 51. DETECTION: PROS AND CONS Pros • Endpoints: No longer a blind spot Cons • Prevention vs detection is a question of cost • Labor-to-value ratio • Time-to-value ratio 51
- 52. PREVENTION VS DETECTION: PROS AND CONS Prevention (e.g., AV, NGAV) Detection (e.g., EDR) Required user input for normal operations Low to none Generally higher False positives Lower Higher False negatives Higher Potentially lower Detect/prevent non-malware threats Generally, no Yes Labor-to-value Low High
- 53. NGAV NEED: a better malware mousetrap WHAT: Automated detection of unknown threats WHY: auto- generated malware gets through EDR NEED: endpoint visibility; serious blind spot otherwise WHAT: Record detailed endpoint data WHY: detect attacks that defeat 1st layers of defense Hardening NEED: More permanent, resilient solutions WHAT: Wide variety of approaches WHY: Passive defenses reduce pressure on frontline defenses Remediation NEED: Contain and clean up threats WHAT: Containment and automated remediation WHY: Reduce expense and labor of dealing with threats ENDPOINT CATEGORIES: WHAT’S DRIVING THEM?
- 54. DO ENTERPRISES EVEN NEED BETTER AV? Hardening Windows ▪ CIS benchmarks (hardening) ▪ Ad-blocking ▪ Remove unnecessary software/features ▪ Least privilege: ▪ flash click-to-run, ▪ disable/restrict java plugin ▪ selective whitelisting Free/OSS Tools • Microsoft EMET • Microsoft AppLocker • Artillery (Binary Defense) • OSSEC (Trend Micro) • Wazuh (OSSEC) • El Jefe (Immunity) • Cylance Detect • Sandboxie (Invincea) • AIDE (FIM) • ROMAD • 0Patch 54
- 55. MY ROADMAP FOR ENDPOINT SECURITY 1.Find a better malware mousetrap 2.Threat-driven hardening 3.Detect/Stop Non-Malware attacks 4.Full-system visibility (EDR) 5.Data visibility 6.More resilient host 55 WHAT IF... malware was solved?
- 56. WHAT ARE YOUR ENDPOINT SECURITY PAIN POINTS AND GOALS? Pain Points 1. Cleaning up infections 24/7 2. Catch attacks that bypass preventative controls 3. Catch/prevent non-malware threats 4. Catch insider threats 5. Did a breach actually occur? Goals 1. Better prevention; hardening 2. Better detective controls, better endpoint visibility 3. Better endpoint visibility; hardening 4. Better endpoint visibility 5. Visibility into file movement, data exfiltration 56
- 57. MYTH #1: SOLVING MALWARE CHANGES EVERYTHING! No, it just shifts the problem – attackers don’t give up, they just change tactics to things like: 1. Interpreted languages (javascript, python, powershell) 2. Social engineering 3. Credential theft 4. Abuse of valid admin tools 5. Web attacks (SQL Injection, XSS, XSRF, etc.) 57
- 58. MYTH #2: ONCE THE BAD GUYS GET IN… GAME OVER! Common perspective of getting hacked (prevention only) 1. Attacker’s exploit succeeds. 2. Reality 1. Attacker’s exploit succeeds 2. Attempts to escalate privileges 3. Begins exploring network 4. Sniffs network 5. Pivots to another host using an exploit 6. Dumps and cracks credentials 7. Pivots with credentials 8. Creates domain admin account = detection opportunity Lesson: Layer detection with prevention
- 59. WHAT IS A RED FLAG? • Something that’s always bad, almost zero chance for false positive • Could be a combination of events (e.g., endpoint + network) • Strategy for filtering noise and addressing alert fatigue Examples: 1. ARP Route Poisoning 2. Dumping SAM 3. Account creation from non- admin systems 4. Pass-the-Hash 5. CryptAPI use not associated with sanctioned/installed app
- 60. Recon & early ops detection Exfiltration detection Data loss Detection Threat detection and response Threat Hunting WHEN DOES INCIDENT BECOME BREACH? 60 Initial Hacking Attempts Success! Attacker gets in, pivots, searches Exfiltration Days, Weeks Average of 146 99 days* Sale & Profit of stolen data Discovery DEFENDER Prevention Isolation Forensics IR Automation Security Analytics Data loss preventionDetection by Deception Fraud detection by a 3rd party Breach Occurs Customer Impact Timeline * Average dwell time, according to Mandiant’s M-Trends Reports
- 61. DETECTION CHALLENGES: FIGHTING THE NOISE 1. Have a baseline – otherwise everything will look suspicious! 2. Instead of tuning the default, consider starting from scratch 3. Explore other methods of alerting (ChatOps, sound, lighting) 4. Understand users/business and apply lessons to monitoring 5. Pick one very important scenario, and practice hard...
- 62. DETECTION CHALLENGES: FIGHTING THE FIRES 1. Get better prevention 1. Prevention is ‘free’ 2. IR is expensive 3. Minimize need for IR 2. Get tools and processes in place to enable root cause analysis 3. Practice IR as much as possible Process improvement 4. Automate IR workflows Process improvement 5. Never, ever skip lessons learned
- 63. Design defenses as if critical vulnerabilities are always present and as if patches will never come. Visibility and root-cause analysis are the key to finding red-flags which allow us to stop entire classes of attacks instead of specific, individual attacks. You don’t need a malware research lab – the work is often already done by researchers! KEY TO RESILIENCE IS VISIBILITY AND SIMPLICITY
- 64. SHAKING THINGS UP A BIT: WANNACRY Notable Facts • Spread as a worm, not via phishing • Patch was available 51 days prior • ETERNALBLUE code was easily discovered via binary analysis • Many behavioral red flags • Didn’t even try to hide • Didn’t work on WinXP Lessons Learned • Can’t blame users for this one • Patching IS part of basic hygiene, • Patching should NOT be viewed or depended on as a defensive measure • No AV vendor should have missed it
- 65. RANSOMWARE EXAMPLES Common Behaviors Mitigations Disables Shadow Copy Services (vssvc.exe) if net stop VSS, kill requesting process Use of CryptAPI from Win32 PE shim CryptAPI and save keys (see PayBreak) Random, invalid file extensions appended to files 1.create canary files/directories 2.kill any process using unrecognized file ext Very long domains Quarantine any system requesting DNS for domains > 40 chars
- 67. WHAT ABOUT REMEDIATION AND RESPONSE? • Remediation = cleaning up after the attack • Containment = isolating the incident • Automated Endpoint Remediation: can we stop reimaging PCs yet??? 67
- 68. WHAT ABOUT REMEDIATION AND RESPONSE? 68
- 69. LUNCH TIME! REST YOUR BRAIN, (EMPTY AND) REFILL YOUR BODY
- 71. PATCHING
- 72. LET’S TALK ABOUT PATCHING: PERSPECTIVE • Patching is disruptive • Patching is not defense • Patching is not a security control • Patching is necessary • Patch availability is beyond our control • Patching is hygiene
- 73. IS PATCHING REALLY THE ANSWER?
- 74. LET’S TALK ABOUT PATCHING: LOGISTICS Credit: NopSec’s 2016 State of Vulnerability Risk Management report
- 75. LET’S TALK ABOUT PATCHING: LOGISTICS Credit: Microsoft’s Security Intelligence Report, Volume 21
- 76. LET’S TALK ABOUT PATCHING: LOGISTICS Credit: Microsoft’s Security Intelligence Report, Volume 21
- 77. LET’S TALK ABOUT PATCHING: ALTERNATIVES Instead of emergency patching… How about… emergency mitigation Instead of waiting… Simulate the attack; understand it Instead of patch dependency… Assume failure
- 78. LET’S TALK ABOUT PATCHING: RESILIENCE “Build as if there is always a zero day and the patch is never coming”
- 79. HANDLING THE NEXT VULNERABILITY ‘CRISIS’ Summarizing: 1. Deep calming breaths, don’t panic 2. Vulnerability analysis 3. Patch assessment 4. Exploit assessment 5. Attack simulation, testing, mitigation
- 80. HANDLING THE NEXT VULNERABILITY ‘CRISIS’ Deep breaths; don’t panic https://www.wikihow.com/Breathe-Deeply
- 81. DON’T WORRY ABOUT THE MEDIA Leverage them to get to the real details
- 82. BREACH LESSONS
- 83. FORGET PATCHING FOR A MOMENT
- 84. HOW IT SEEMS LIKE IT HAPPENED Struts Vuln Sweet, sweet data Profit!
- 85. HOW MOST BREACHES ACTUALLY HAPPEN Scanning/Probing activity Struts vuln was exploited Hours/days of additional probing, searching and pivoting Eventually find sweet, sweet data Profit! Opportunities to detect/disrupt!
- 86. 1. What other mitigations could we use when we can’t patch? 2. How much breach planning has your org done? 3. Consider BONUS: Choose a breach and use it as a tabletop exercise in your organization DISCUSSION; QUESTIONS?
- 88. HOW DOES MALWARE GET INTO WINDOWS? From before: 3 ways Direct: You run the code Indirect: You’re tricked into running the code Exploits: Your vulnerabilities get exploited Sure, vampires use social engineering, but they do respect access controls… Key Attack surface 1. Browser 1. Image processing 2. HTML iFrame 2. Browser plugins 1. Flash 2. Java 3. Silverlight 4. ActiveX (really) 3. Files (via email, etc) 1. PDF 2. Office Docs 3. LNK files 4. Remote network exploit (rare, but… NotPetya!)
- 89. WHY’S IT ALWAYS WINDOWS? Hey operating systems, will you run my software? iOS “Only if it’s in the App Store!” MacOS “Only if it’s in the App Store*!” Android “Only if it’s in the Google Play Store*!” Windows “LOL, sure! YOLO!” * Or you choose to install from untrusted sources
- 90. WHAT DO WE GET WITH WINDOWS THESE DAYS? Built in or free from Microsoft 1. Win10 over Win7! 2. Windows Device Guard 3. Windows 10 S 4. Applocker 5. Sysmon 6. Event Viewer/Collector 7. Task Scheduler (really) 8. Controlled Folder Access 3rd party, but free (cheating is okay) 1. OSSEC 2. OSQuery 3. 0Patch
- 91. Trigger actions off EventIDs! TASK MANAGER, AKA IFTTT FOR WINDOWS
- 92. WINDOWS 10 – OUT OF THE BOX – CIS BENCHMARK
- 93. FREE HOST-BASED IDS: OSSEC • Monitors critical and sensitive files via integrity checks • Detects rootkits • Can monitor windows registry • Alert on Changes
- 94. WHAT’S HAPPENING ON THE ENDPOINT? •Facebook-developed osquery is effectively free EDR •Agents for MacOS, Windows, Linux •Deploy across your enterprise w/ Chef, Puppet, Ansible, or SCCM •Do fun things like, search for IoCs (hashes, processes, etc.) •Pipe the data into ElasticStack for visibility & searchability •If you only need Windows clients, check out Microsoft Sysinternals Sysmon
- 95. SECURE CONFIGURATION • Standards: CIS Benchmarks / DISA Stigs • Configuration Management: Consistency is key • Deploy configs using tools like GPO, Chef, Puppet, or Ansible • Change Management is also important • Alert on deviations and violations • Use git repo for tracking changes to your config scripts
- 96. LOGGING AND MONITORING •Central logging makes detection and analysis easier •Many options here, such as Windows Event Subscription, rsyslog •Can also pipe to one central location with dashboards, such as ElasticStack •Good idea to include DNS logs! •Greylog
- 97. LAB TIME!
- 98. What else could we do with triggers? DISCUSSION
- 99. BREAK TIME! REST YOUR BRAIN, (EMPTY AND) REFILL YOUR BODY
- 101. MALWARE BEYOND THE EXE – NEMUCOD-AES EXAMPLE
- 102. NEMUCOD-AES STEP1: PHISHING EMAIL From:townofwi@cloudwebx4.newtekwebhosting.com Sent: Thursday, July 6, 2017 02:41 PM To: ask@knoxvegaslaw.com Subject: Notification status of your delivery (UPS 006222692) Attachments: UPS-Receipt-006222692.zip Dear Customer, Your item has arrived at the UPS Post Office at July 04, but the courier was unable to deliver parcel to you. Please check the attachment for complete details! Thank you, , UPS Support Agent.
- 103. NEMUCOD-AES STEP2: PHISHING EMAIL ATTACHMENT UPS-Receipt-006222692.zip UPS-Receipt-006222692.doc.js
- 104. NEMUCOD-AES STEP3: C2 - LOADING THE NEXT STAGE 1. First Stage: UPS-Receipt-006222692.doc.js downloads 2nd stage 2. Second Stage: VBScript 1. Creates and runs Word Doc smokescreen 2. Downloads and runs Kovter, because… why not? 3. Downloads and creates php.exe 4. Downloads and creates php5.dll 5. See where this is going? ;) 3. Creates the php ransomware script (embedded in 2nd stage) 4. php.exe nemucod.php
- 105. NEMUCOD-AES LESSONS LEARNED How could we have stopped this?
- 106. LAB TIME!
- 107. FINISHED! WE MADE IT!
- 108. Adrian Sanabria Director of Research, Threatcare @sawaba THANK YOU P L E A S E F I L L O U T Y O U R E V A L U A T I O N S !
- 109. PERCENTAGES DON’T MAKE SENSE 1. A percentage isn’t useful when we’re dealing with numbers at this scale. 2. The number stopped isn’t nearly as important as stopping the right ones. 3. Percentages can’t effectively measure threats that don’t exist yet. 4. Persistent adversaries don’t give up because their initial attempts hit the 99%. Attacks simply don’t work this way.
- 110. PERCENTAGES DON’T MAKE SENSE: EXAMPLE The dog is gone.
- 111. PERCENTAGES DON’T MAKE SENSE: EXAMPLE
- 112. Defense C confidentiality A availability I integrity Offense D disclosure D denial & destruction D distrust Credit: Terrance Lillard ATTACKER GOALS $$$ $$$ $$$Extortion Extortion Sell data
- 113. CHANGING MINDSET 1. Defeatist statements 2. That ‘dwell time’ has become a metric 3. The 1m unfilled jobs myth/rumor 114
- 114. INFORMATION ASYMMETRY AV isn’t just protecting against ‘known threats’ It is a known threat. To the bad guys! 115 Conclusion? A detection engine will never stop determined adversaries.
- 115. MORE PRODUCTS, MORE PROBLEMS: THE 3RD PARTY DILEMMA 13% run one endpoint security product 26.9% run two 59% run three or more concurrently Why? 67% using endpoint config mgmt 65% using HIDS/HIPS 59% using FDE 56% using NAC 49% using FIM 47% using Whitelisting That’s a LOT of product to take care of and additional attack surface!
- 116. HOW I SEE THE MARKET Prevention (pre-execution) Detection and Data Collection (post-execution) Platform Hardening 90+ Vendors
- 117. BUZZWORD BINGO: NGAV AND EDR DEFINITIONS NGAV: The ability to stop threats without prior knowledge of them EDR: Endpoint Data Recorder (a slight acronym modification)
- 118. EXTRAS
- 119. CASB SDN VPC IT’S 2018 – DO YOU KNOW WHERE YOUR DATA IS? Traditional Data Center MDM Mobile SaaS Host FW Cloud
- 120. BECAUSE THIS IS WHERE YOUR EMPLOYEES ACTUALLY WORK 121 Conclusion: Security controls MUST travel with the asset.
Notes de l'éditeur
- My career path might be speeding the aging process.
- Time - Attacks don’t wait for budget approvals Or change control Underused Resources - You may already have everything you need; Native protections are often overlooked Expense in Depth - More products, more problems; More People; More Overhead; More distractions Agility - Self-sufficiency; Look amazing; Everyone likes the office MacGyver; Using your wits instead of your wallet always looks waaaay more impressive to co-workers, peers and on your resume.
- Why do we still spend so much on the perimeter? Simple answer: because we’re not sure what else we should be doing.
- Anyone know this acronym? Have you ever used it in trouble ticket notes? We’ve all poked fun at users because we needed to blow off some steam and frustration. Seriously though, you still have a problem to deal with, and blaming the user won’t get you any closer to solving it.
- I don’t have a crystal ball for this market, but if history is anything to go by, we have products that fit into three categories when we think in terms of durability. NGAV can and will be evaded, resulting in another cat-and-mouse game. A significant of EDR products will fall into the shelfware category, by the nature of how they work, and like SIEM, will only provide value to the security %1ers Hardening is the true end goal – increasing the resiliency of the platform to achieve a minimum safe environment for the user. The user should never have to be trained to be weary of clicking links or opening attachments. A minimum safe environment should make it safe to do so.
- How likely are you to click links and open attachments on a Windows PC vs Mac? iOS? Android? How many of you use one of these platforms and put AV on it? How many of you put AV on it because you feel like you have to, because CYA or compliance/regulation?
- Leap frog vs chess analogy – when we succeed, we create change in attacker tactics and behavior
- We typically don’t have the skills or spend the time to do root cause analysis When we succeed, we force the attacker to change behavior. Lack of root cause analysis and process improvement We need durable 5 year solutions, not 6 month solutions Ransomware example
- Advanced malware detection was capable of detecting and blocking ‘advanced’ and ‘custom’ malware, but not when it was sent over in advanced or custom ways.
- We’re doing all this for one reason: Windows is soft and vulnerable. So, why is all this failing to protect the endpoint? Tell story of Symantec engineer complaining that customers never turn on the more effective functionality.
- How is ransomware different? Ransomware WANTS to be seen. By the time you’re seeing it, it’s too late Don’t forget wipers!
- There have been a surprising number of cases where it looks like ransomware at first glance… until you realize there’s no way to pay.
- Crypto-ransomware usually doesn’t encrypt everything. Why? Speed. First ____ bytes of each file Only certain file types (sometimes only a dozen, sometimes hundreds) Skips some directories to avoid crashing the machine – they can’t get paid if they can’t
- The campaign can be disrupted by going after the distribution strategy (Email? Worm? Drive-by exploit kit?) The exploit can be disrupted by patching, blocking the attack vector, virtual patching, mitigations, etc. The Dropper can be disrupted by
- Does this sound
- How many people here have experienced ransomware first hand? After running WannaCry, imagine the impact if it happens to you unexpectedly. ALL WannaCry infections occurred transparently, NOT by any user action. People could have been doing anything when it happened. Fast-forward to NotPetya and that ransomware would spread even in fully-patched networks.
- Existing controls are vastly under-utilized Free stuff out there is useful and more ‘battle-tested’/proven than some very expensive commercial products I’ve had TONS of defenders tell me that they haven’t depended on anti-malware for years. They simply analyze the most common sources of infection, and harden their systems accordingly
- Find a better, more effective AV/NGAV to give you some breathing room E.g. You don’t use the java_plugin, but it’s enabled in all your employees’ browsers Ability to detect, prevent and stop non-binary attacks (Office macros, JS, VBS, Powershell, etc) If you can’t see, how do you know nothing was missed? Did the malware take anything? What did it steal? Where did it send it to? More systemic, in-depth hardening – i.e., make Windows more like iOS
- No, attacks are the threat we should be worried about, and regardless of what study you look at, a significant percentage of successful breaches don’t use malware at all.
- Point out: In the “reality” version, no malware was actually necessary, and if it was used, it was only to get the initial foothold. Mention: According to the most recent Verizon data breach report, at least 45% of attacks didn’t use malware at all.
- Ask Konrads or the audience to volunteer some other ones they’ve seen
- The point here is that the defender isn’t helpless – there’s something they can do at each stage of the attack campaign. The attacker stops to order a pizza The attacker stops to eat said pizza Baffled by Structured Query Language, the attacker searches online for ‘SQL CheatSheets’ The attacker takes a break to brag about his exploits to undercover FBI on online forums.
- For #2, mention Eric Ogren’s 200k/daily DLP alert anecdote
- Remediation vs containment
- Remediation vs containment
- For the things you can patch, there are many options. If you can’t patch, you need to figure out how to isolate those devices and be alerted when things/people access them. Talk about vulnerability management program.
- Ditto with breaches
- Swedish vampire movie. Really excellent. By the way, vampires respect access controls, malware doesn’t.
- Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- Too often in security and IT, the response to a new problem is “What should we buy to solve it?” …when the response should be Do we build or do we buy?
- Prizes for good answers!
- A dog is often a persistent risk when it comes to escaping a fenced yard. Sometimes they don’t even need 1% to escape.
- What? Zero percent? Yes, this is a zero percent example – they didn’t go through the fence, they jumped over it. They didn’t play your game, and as with these dogs, there’s no such thing as cheating for criminals – if they see a way around your trap instead of through it, they will.
- The “three Ds” that counter the CIA triad – how criminals make money off counterin each one. Also mention “Defense is Offense’s child” (John Lambert @ microsoft and Sergey Bratus)
- Helpless and defeatist statements like “It’s only a matter of time before the breach happens” and “there’s only two kinds of organizations, those that know they’ve been breached and those that don’t know yet” I’d argue that you also have the flipside – organizations that THOUGHT they had a breach, but actually DIDN’T. The reason they declared a breach was because, due to the lack of intelligence they had, they were forced to assume the worst! Indications that we’ve messed up as an industry: most of the 1 million cybersecurity jobs we supposedly have a need for are warm bodies in a SOC. Why? To compensate for noisy cybersecurity products the fact that “dwell time” is even a thing
- It takes more than a detection engine to protect an endpoint. When an AV engine (be it NG or sig-based) is available to the bad guys, they WILL figure out how to evade.
- Three Categories Prevention Detection/Data collection Platform Hardening Privilege Management Application Control Removing attack surface Dynamic attack surface reduction Hey, we see you don’t EVER USE X, Y or Z, so we’re going to turn them off, okay? OR, how about we do like Android 6? You don’t get permissions until they’re needed and then you get prompted to turn them on, and decide then and there whether or not you need them.
- And you know what? I like Endpoint Data Recorder better anyway, because a lot of EDR products out there have little to no detection or response capabilities.
- ‘BREAK IN CASE OF EMERGENCY’ explainer slides
- The conclusion? Security MUST travel with the endpoint. The endpoint has been and will continue to be the battleground where we will see the majority of attacks.