good morning everybody
thank you for coming to my presentation
there's actually a lot more of you out
there than I was anticipating so I will
admit I am a tad bit nervous so my name
is chase Palmer I am a security engineer
for lucid software so just want to
introduce myself a little bit and tell
you a little bit about Who I am for
about 10 years I worked in a PCI field I
worked for security metrics a local
company here in the Utah County area I
did spend a brief time working for the
government as a security analyst it
sounds really cool but it really wasn't
that great I do have a bit of an
entrepreneurial spirit I like to start
businesses that fail and then start up
new businesses my most recent adventure
is starting up a non-profit and I
currently sit as the board of president
of the board of directors on on that for
that nonprofit which also means that I
have to take care of all of the ins and
outs including all technology for that
organization and as I stated I currently
work as a security security engineer for
lucid software the creators of a product
called lucid chart you should go check
it out that would be the only plug that
I'll give for the for the company there
and I am a CI SP but there is a bit of a
caveat there just because I have my
cissp does not mean that I am a hacker
so I'm gonna admit that right up front
I'm sorry this microphone is some
problems so a lot of the things that I'm
going to discuss today really have to
deal with defending ourselves on a very
basic level against attackers and like I
said just because I have my se SSP does
not mean that I have a hack
I am speaking strictly from the point of
a defender more closely Blue team here
and I remember coming to my first
security conference and feeling
completely overwhelmed and I felt like
everything was going over my head I
would find presentations that were
really cool and very technical but they
didn't have much applicability to my job
and then I would find presentations that
applied to my job but then I just didn't
understand what's going on because I was
so new and so I really felt dumb like D
um dumb and so I decided to create this
presentation to kind of bring things
back to home base kind of security 101
and so I really wanted to reach out to
those people who kind of felt like I did
and who felt lost and let everybody know
that we all have a place to start we
have to start learning somewhere and as
I said this is my first time presenting
so I'm hoping that this will also help
me gain some confidence and speak in the
future maybe on some more complicated
topics but primarily I think sometimes
we get caught up in all of the great and
awesome things that we hear about at
these conferences and and if we forget
about some of these basics everything
that we've learned at these conferences
can be for naught and we just really end
up spinning or wasting a lot of our time
so I want to start off with just a list
of company any companies that we
probably have all heard of because these
guys make the news these are some of the
top breaches compromises that have that
have occurred in the last ten years and
some of these or at least one of these
is still ongoing because we continue to
hear about him in the news that the
initial reported breach was actually
larger than it was actually initially
reported but what about these guys
by raise of hand has anybody heard of
any of these companies I didn't think so
there are no hands out there these guys
aren't the newsworthy type but these all
suffered significant breaches of data
but that doesn't mean that they were any
less damaging each of these companies
have fewer than 250 employees which
classifies them according to us
definition as a small company or a small
business by raise of hand how many out
there are work for a company with fewer
than 250 employees see a few hands out
there how about less than 500 okay we
must work some big companies out there
so each of these companies lost
thousands and thousands of dollars
either in fines and fees or lawsuits
lost revenue or just flat-out stolen
money and the efficient services new
escrow group they actually collapsed
under the pressure but that was
primarily because everybody and their
dog was suing them for losing their
money so we have a tendency because of
the way that the media portrays hacking
and breaches as being big and kind of
very targeted type approaches that it's
easy for a small business to say well
I'm not a target I don't need to really
focus on this kind of thing why why
would anybody want to to hack my website
and so this is what a lot of people
would imagine hacking to be like and I
pretty sure there's a lot of us out
there that also wish that this is what
it hacking looked like but in reality
this is more like what it is I've had my
I've dabbled with Metasploit and that
kind of stuff and I can attest that this
is pretty much it sitting in a bedroom
we're out of just at a desk and you're
in your home it's it's not all that
fancy so when we're talking about
hackers you
have to realize that there are different
breeds out there and they're gonna take
different a slightly different
approaches and if you do a search on the
internet for threat actors you'll find
various different lists and groupings
that people will put threat actors into
this is the one this is the list that I
like to - this is how I like to
categorize them and if you can see on
the the chart down of the bar the graph
at the bottom
it shows kind of how the how broad and
untargeted attacks are - how focus they
can be based on the type of threat actor
and so you can see at the beginning that
with hobbyists or our script kiddies
these they're very untargeted they're
just kind of taking the shotgun method
and they're just just seeing what's out
there but the further down the line you
go you get down to disgruntled employees
who may have a vendetta out for a very
specific person you hear a lot about the
hacktivists and even then well a lot of
their stuff may be targeted towards
companies that they want to make a point
with they do still also make some pretty
broad attempts out there so the question
is is are you a target yep you better
believe it according to the Verizon
breach report or the breach
investigation report 58 percent of all
the breaches that occurred in 2017
occurred from a small business and in
the last 10 years that I've been in the
industry that this really hasn't changed
the number maybe has gone up maybe 1 or
2 percent in the last 10 years but by
and large the majority of attacks and
breaches are against small businesses so
why are small businesses targets well if
any of you boo if any of you have played
hide and seek with the two-year-olds
this is why hackers are lazy and but
they're really smart and so they're
going to go
for what's called the low-hanging fruit
and so they want to do as little work as
possible and number two small businesses
generally can't support or sorry excuse
me
small businesses support larger
companies and so they end up being a
platform into larger companies for
example with the Home Depot breach it
was actually the HVAC company that was
actually the entry point for the attack
and then they piggybacked off of them
into Home Depot's environment and then
last but certainly not least small
businesses just and generally don't have
the resources to be able to pay for the
staff or they just simply don't have the
manpower to be able to keep up with
what's going on and then really it's
it's all random small businesses and
large businesses businesses well I'll
get it may end up being a target at some
point we'll get to that in a little bit
so in order for us to be able to protect
ourselves we just need to be able to
understand things from the outside
perspective to help us realize how much
of a an actual how much we're actually
exposed to those threats so the cyber
killed chain was actually the first
thing I learned about at the very first
conference that I attended to and I
thought it was the coolest thing ever
and so I just kind of want to share that
with you because it really helps you get
into the mind of the hacker and the
methodologies are the ideas that they're
using to get into your system and I'll
take it step by step I'm going to break
it into three sections going to focus on
the different types of things that the
hackers are going to do at that stage
and then the things that we can do to
keep us from being that low-hanging
fruit and so we'll cover protect
protective controls detective controls
and corrective controls so at the very
beginning we're gonna have initial recon
the hackers going to be doing some
reconnaissance trying to figure out
what's out there to see what they can
possibly
exploit and so they're going to run
things such as port scans and
vulnerability scans and at some point if
they feel that they need to they will go
and actually do some manual testing your
website testing for stuff like
cross-site scripting and session
management so if anybody if any of you
have ever checked out fire your firewall
logs you will notice that that this
happens all the time
doesn't matter who you are just because
you're getting a port scan doesn't mean
that you're a target it just means that
the hacker has decided to scan an IP
range that includes your IP if you're
getting hit with a vulnerability scan
there's a good chance that a port scan
has discovered something that the hacker
is interested in and they're going to
check to see if that could possibly be
exploited and at that point you may have
become a target so what can we do to
stop them in this point this is actually
the best place to stop attackers since
they actually haven't gotten into your
network yet so the attackers are just
sniffing around to see what's out there
and so the idea is to make yourself as
small of the target as possible and so
practice it practices such as closing
unused ports and filtering traffic
filtering your traffic with firewall
rules and training your securities
trading sorry excuse me training your
staff for security awareness and robust
password policies and then my favorite
is actually to perform your own form
vulnerability scans vulnerability scans
will help you see what the attacker is
going to see hopefully before they do
and then other things such as risk
assessment so you can determine where
you want to put your effort and your
focus on I'm protecting I don't think we
all need to protect our cat pictures
that are stored on our hard drives but
some people think so
so the second port at that part of the
kill chain the hackers have gotten in
and they they found a vulnerability and
they've exploited it at this point they
are they have some access to your
network into your environment and
they're going to want to try to stay in
there so they're going to stall stuff
such as backdoors to be able to get in
even if you've changed change stuff on
your network they're going to try to
find other computers on your network so
they're going to do some additional
reconnaissance to see if there's any web
servers or databases or things like that
and then they're going to try to
escalate their privilege they're trying
to get into route they're trying to get
to admin or even to this system this
part of the kill chain can take some
time and so if you have the proper
measures in place you can really slow
down an attacker at this point or even
stop them before too much damage is done
so when you have the proper detective
controls in place it should notify you
when some unauthorized or malicious
activity is occurring so that you can
take action so some of those activities
may be trying to access or copy the
Oetzi shadow file or trying to access
your web root or database commands being
executed from an unprivileged user or an
unauthorized account or even as much as
applications being installed so these
notifications should go to key personnel
so that they can review them and then
they can take proper action whether that
is to close the hole that they are in or
or determine if any sort of data was
compromised at this point and the third
part of the kill chain it's too late
attackers in they've actually grabbed
your data they've exfiltrated it and
they're out they've bounced and if they
are a good hacker they will have tried
to clean up their tracks as much as
possible
there's really an endless possibility of
what could have happened here to your
system and so the amount of effort that
it's going to take to recover from this
attack is going to be dependent on what
kind of corrective controls you have in
place at this point I'm since I have the
Bitcoin image on there this kind of a
word advice or is my boss but it's a pro
tip never pay a ransom for ransomware
and never pay hush money to a hacker
there's no guarantee that a hacker will
actually decrypt your data after you've
paid the ransom and if you've read the
news uber has decided to pay out a
hundred and forty eight million dollars
in a settlement for paying hush money to
a hacker to try to keep their their
breach from reaching the news which is
still reach the news so oh well
and if you're really interested you can
go check out Reddit and find out about
the guy who socially engineered the
hacker to actually give up the
decryption key that was a good read that
was fun
so some of the corrective controls that
you can have in place are having your
system and data backups and having
server images and having a disaster
recovery plan and backups are really
going to be your best friend when it
comes to be able to recover from lost
data or corruption or ransomware you
just want to make sure that your backups
are as frequent as the data that is that
that as frequent as the data is changing
and so at lucid are our data is changing
by the minute and so we have a recovery
point of just of a couple minutes your
data may not change very frequently it
could be hours or days and so your
backup strategy could be very different
but you just want to try to get your
data is back as close as possible to the
time when before the breach without
losing as much without losing as much
data as possible
so I want to tell you guys a little bit
of a story of when I ran into a hacker
in real life so what happens when you
run into a hacker in the wild very much
like most wildlife don't panic if you've
prepared well enough and you have a
really good chance of surviving and if
you use your training you play your
cards right they will go away so I run a
wordpress site and WordPress is a really
effective platform for small businesses
who may not have the hoofers to be able
to develop a website but WordPress has a
lot of defaults and so if it's
misconfigured or if you don't do the
proper things there's a lot of exploits
or a lot of vulnerabilities that can be
exploited within WordPress and one of
those things is actually the login page
all WordPress sites come by default with
your domain slash WP login dot PHP and
so what I had noticed when I logged into
my web site and looked at my firewall
was that I was getting a lot of attempts
to access the WP dash login dot PHP page
and I was getting about 10 to 20 logins
per second and looking at those logs I
could see that they were using very
common pass or common usernames and a
lot of other things so I know they were
doing a dictionary attack but you can
also see that the target or where the
the origin the origination country of
all of these attacks was very spread out
there was no pattern to it and so I knew
it was a botnet and so I needed to do
what I could to in order to prevent this
dictionary brute-force attack from
getting into our website and so we
actually survived which is you know
really exciting for me that I had
actually had survived a live attack the
main thing that I did was I changed the
default URL for the log in from WP login
dot PHP to something else I did have the
web application
well and so as those IPS were making
those attempts the firewall was actually
blocking those attempts as an added
measure the Neto measure I had I
installed fail to ban on the on the host
so that those log those IP addresses
would continue to be blocked even after
the firewall had unblocked them with the
timeout
I do run regular vulnerability scanning
on the web or on the website so I knew
that's the plugins and stuff that I had
installed on there were didn't have any
vulnerabilities that could be exploited
that I was aware of and I had a robust
secure password policy so that that
dictionary attack couldn't use common
passwords and usernames to be able to
get in so at this point just want to
kind of run over a few things kind of my
speed round of I think I believe it's
five different items to be able to
reduce your target number one is defense
in depth it's it's not so much it's not
it's not good and it's not good security
practice to have just one security
measure in place to try to protect data
you want to layer those protections
which is why it's called defense in
depth and so items such as multi-factor
I think authentication having a firewall
in conjunction with a host firewall or
if we really want to get into the
details here having access to a
corporate database is predicted by
access control on a subnet access by a
VPN and also requiring MFA so if one of
these items fails there's other
protections in place in order to try to
protect that data on the other side of
that spectrum we have security through
obscurity and there's a bit of
controversy whether or not security
through obscurity is actually a security
layer security through obscurity is
basically thinking that you're going to
be hiding something you're that the
hackers not going to be fine even though
it's kind of out plain sight
the main example that that's easy to
really point out here is like hiding the
key under the doormat they're not going
to know what's there I'll know it's
there it's easy to get to but things
such as renaming files or folders to
something that doesn't indicate that
what the contents are or making a file
accessible through URL but it's not
being published so other examples is is
obscuring some of your code so that you
can't see exactly what that code is
doing and so obscurity is a valid
security layer or at least I believe
security is obscurity as a valid
security layer layer but it cannot be
relied on by itself it should be an item
that is included in your defense and
depth the second item is security
training your employees are going to be
your number one weakness and so you want
to want to try to boost that and you
want to make sure that your employees
are turned into your your frontline your
your greatest asset to being able to
protect your environment and so you want
to make sure that your employees are
trained regularly regularly on not only
security basics but also on role-based
items so items such as PCI compliance or
gdpr
things like that can apply to different
groups and they should be aware of that
firewall configurations you want to
start with a deny all rules if possible
or is it close to it just make sure you
don't lock yourself out of your firewall
I have can't tell you how many times
I've had to do a factory reset on a
firewall because I've accidentally
locked myself out never use any any any
rules that's a mouthful meaning we're
not just gonna let all traffic from all
sources come in to any ports we want to
make sure that you're regularly looking
at your rules as you add new
applications and services to your
network you may open up new firewall
rules and if you're not careful
those rules may actually end up
contradicting rules or earlier rules
opening up your network and advertently
the other thing is you also want to make
sure that the rule order is is proper
firewall rules typically go from the top
bottom and whatever hits whatever rule
matches first the firewall will take
that and the one that I've seen a lot
and I actually we need to make sure that
doesn't happen is making sure that you
don't have remote access to your
firewalls configuration if you need to
have it make sure that it's tucked
behind a VPN as I stated earlier
vulnerability scanning is one of my
favorite things so you want to learn
what the hackers going to be able to see
before
they do you want to run both internal
and external vulnerability scans because
once once the hacker is inside your
network they're also going to do
additional recon and so you'll want to
see what other vulnerabilities are on
and the internal side of your network if
you're developing applications you want
to run some dependency checks we all use
third-party libraries and so you want to
make sure that those open-source
third-party libraries don't have any
vulnerabilities on them and then you
also want to take care of those highs
and critical vulnerabilities asap most
should be your highest priority at Lucid
we use open Voss and the OWASP
dependency checker for our internal
internal scans and for our dependency
checker
externally we use security metrics for
our scans and finally we have our
keeping our software up-to-date we want
to patch regularly patching will help
plug those holes that software may have
accidentally left open or as new attacks
start to become prevalent we can stop
those from happening we don't want to
use software that's no longer supported
by the vendor
it's called sunsetting we may have heard
that with Windows XP and Windows Vista
but just as a heads up Windows 7 will be
sunsetted no longer be supported meaning
that there's not going to be anymore
patches for Windows 7 starting in
January 2020 so you want to be prepared
for that I was trying to look for when
Windows Server 2012 was actually gonna
be sunsetted but I couldn't find a date
that really meant anything but probably
one of the bigger things is using
outdated software like Office Office is
littered with vulnerabilities I think I
get updates for office maybe twice a
week and so using old old outdated
versions of office will leave you
vulnerable to malware type attacks and
then you also want to make sure that you
want keep track of the software that's
being used in your environment and now
it's over
you guys made it through my presentation
so are there any questions out there for
me great well thank you