Frameworks serve as a structured approach employed by
security analysts to dissect and comprehend the tactics,
techniques and procedures employed by cyberattackers.
These frameworks aid us in agonizing,
prioritizing and mitigating potential security threats,
targeting our organization's information security systems.
The first one I want to discuss today is called Mir
Minor is an attack framework designed against adversary tactics,
techniques and procedures or CTPS.
It goes through matrices which is a broad spectrum of tactics techniques.
They may use
the different tactics or high level objectives pursued by the Attackers.
The techniques which are specific methods or procedures employed data sources,
the types of information utilized to detect or prevent such attacks,
things like logs or network traffic,
the different mitigations or defensive measures that
organizations such as ours can adopt that
or mitigate and minimize the impact of such an attack
threat actor groups which employ specific tactics and techniques.
Each assigned a unique identifier.
For instance, a pt 67 may be in a specific threat group
that we're looking at
the software or malware tools utilized by an attacker.
These are mapped with the techniques,
they may execute the different campaigns or
instances of attacks executed by threat actors.
These are mapped to the text
techniques they've already used
and finally resources,
additional information aligning with the understanding
and defend against those specific threats.
The organizations or the tactics and techniques we
may have seen these can utilize research papers,
blog posts, even the dark web with the enterprise attack methodology.
This concentrates on the adversary techniques and behaviors that we have
seen in the past or may see in the future.
The initial access methodology they may use this is employed to
establish a foothold within our targeted network or within the network.
We're trying to defend these can be such things
as a phishing attack or exploiting a vulnerability,
the execution they may have utilized.
Did they pull off a specific phishing email with a specific link or
did they take advantage of a specific vulnerability using a specific malware?
This is the execution persistence once they got into our network,
did they open additional doors?
Maybe provide a back door into a new
aspect to our network that provides persistent access.
Uh This could also be root kit or scheduled
tests that they may be utilized inside of our system
privilege escalation. These actions are aimed at attaining elevated access.
I think I've used the janitor scenario before where a janitor
may have access to email but not access to servers.
And so you could do privilege escalation or
lateral escalation going either across up to get
access to a specific system or subsystem that the attacker is trying to get access to
defense evasion.
This is the strategies we employ to circumvent
detection and bypass security controls such as encryption or
opacification,
credentialed access. Can we grab credentials from a specific user?
Can we harvest credentials off a database or can
we force our way into getting more access?
These are the techniques of gathering intelligence
about the target system or network.
These can include network scanning or active directory enumeration,
lateral movement which I've kind of already covered.
But this is transversing laterally from one position
over to another which we've gained access.
We can also do such things as pass the hash or
desktop exploitation
collection.
This is the action of harvesting data or information
from a compromised system such as keylogging or taking screenshots
X filtration.
How do we get that data out or how did they get that data out from a compromised network
such as leverage a command and control server or external storage device
and the command and control itself.
The techniques for communicating with those
compromised systems involving a command and
control infrastructure and how that's utilized across the uh the system.
I'm in methodology. We're really talking about four specific points.
Adversaries who is attacking us, where are they attacking from
the infrastructure that we're utilizing or the
infrastructure that they have taken advantage of
and in our system in our network,
what capabilities they have,
do they have the capability of just using malware or do they
have the capability of doing some pretty advanced social engineering attacks?
And finally their targets? Who is their target?
Are we talking about specific people systems of vulnerability?
Uh What specifically are they addressing when it comes to this target?
The cyber kill chain recognizes seven distinct steps that threat.
Adversaries may utilize against an enterprise environment.
The first step is reconnaissance.
How do I develop a reconnaissance either via
passive or active measures to identify different traits,
assets or infrastructure that your organization may utilize
the recon stage, really kind of pinpoints,
not just the assets that you may
utilize but the vulnerabilities as well weaponization.
What kind of delivery system am I going to utilize?
What kind of malware am I going to utilize?
What kind of attack am I going to develop to target your specific systems?
This could be anything from a social engineering attack
like a spear phishing email or a phishing email,
maybe even phishing all the way down to malware use through a rootkit or Trojan.
We're really kind of developing that weapon against the infrastructure,
then there's delivery. How do I get that system into your environment?
Am I taking advantage of a vulnerability? What's the delivery methodology?
Now, this is an exploitation.
We're not actually executing the malware on your system,
but we're delivering it to your system.
This could be taking advantage of a vulnerability
without actually exploiting it.
This could be sending off a phishing email with a link in it.
That's the delivery phase. Exploitation is the actual exploitation of the system.
If I'm exploiting a vulnerability, then I'm taking that piece of malware,
I'm delivering it to the system and then I'm actually executing it.
That's the exploitation phase,
installation of new malware into the
system for persistence or for privilege escalation
and then finally command and control.
How do I uh circumvent your uh systems and provide a command
and control structure where I can maintain access to your enterprise environment
and further gain more control mechanisms over the different systems.
The
OSSTMM or open source security testing methodology model
is a widely applied in various practical scenarios
and utilizes penetration testing which serves as a
comprehensive guide for simulating attacks on systems,
networks, people or assets to come cover vulnerabilities.
Most companies or enterprise environments will use a third party
environment or a third party vendor to pull off penetration
penetration testing.
And that penetration testing utilizes a scope of
work that clearly identifies what they're testing for.
We can utilize security auditing which leverages the auditing
process to evaluate our system and infrastructure security.
It also facilitates the identification of vulnerabilities and the assessment of
security controls and how they are effective within our system.
We can do compliance certification or recertification. This is recognized by the
IO 2701 which identifies specific methodologies that we utilize
to ensure that we're complying with regulatory
Boies or contractual agreements for certification
and finally security training where
we're training security professionals and the
employees that are within our enterprise environment in a structured manner.
This age in the development and enhancement of their skill set,
their awareness and their expertise and security testing methodologies.
The oas web security testing framework is designed
specifically for web applications and web developers.
It's designed to go through six distinct phases
to identify different security vulnerabilities within web applications.
The first phase planning and preparation.
This initial phase involves defining objectives
for the security test and determining the
scope of the assessment that we're going to utilize against our web application.
Web information gathering or information gathering is phase two.
In this phase,
the tester gathers relevant information about the target web application.
This includes architecture functionality maybe potential attack vectors.
In phase three, we're doing a vulnerability identification.
We systematically assess web application for
security vulnerabilities such as Injection,
cross-site scripting SQL or session management flaws.
Step four exploitation.
Once we've identified a vulnerability,
we're going to attempt to exploit that and assess
the severity of the potential impact of that application
hoist exploitation.
The fifth phase testers are going to evaluate the level of access gained and
potential consequences that could be attributed to
that exploitation against that web application.
And the sixth phase reporting,
we're going to document and report out those test results.
We're going to present to our stakeholders. A consul
ilities discovered the severity rating and actual
recommendations for remediation of our web application.