1
00:00:08,600 --> 00:00:13,000
Welcome everyone to the Blue Team Village incident response panel.

2
00:00:13,040 --> 00:00:19,940
We have an awesome group here for you today with unique experiences and perspectives on security incidents and incident response.

3
00:00:19,940 --> 00:00:22,140
I'm really excited for today's discussion.

4
00:00:22,320 --> 00:00:32,620
But before we get started, take a look at the poll we posted on the Blue Team Village Twitter earlier today about ransomware and whether or not victims of ransomware should pay the ransom.

5
00:00:32,740 --> 00:00:36,740
We are going to get on that topic in a bit and we would like your input in the poll.

6
00:00:37,140 --> 00:00:45,260
Also, please post questions for the panel in the Blue Team Village Discord in the Talks Track 1 channel, which we'll be monitoring.

7
00:00:46,140 --> 00:00:47,700
My name is Russell Mosley.

8
00:00:47,700 --> 00:00:51,240
I go by SmokeEm on Twitter and I'm a lead with the Blue Team Village.

9
00:00:51,240 --> 00:00:57,740
I've been a Blue Teamer for my entire career, building and managing security operations at small and mid-sized companies.

10
00:00:58,000 --> 00:00:59,740
So I wear a lot of hats.

11
00:00:59,740 --> 00:01:01,600
I've done everything from sysadmin.

12
00:01:01,600 --> 00:01:09,920
I've been an IT director, a security ops lead, a compliance auditor, and today I'm a CISO at a rapidly growing government contractor.

13
00:01:10,160 --> 00:01:14,180
All my experiences involve developing and managing small teams.

14
00:01:14,240 --> 00:01:21,500
And as a result, I've had the opportunity to do a lot of different things in the security field and build decent security programs without a huge budget.

15
00:01:21,680 --> 00:01:24,980
I'd like to introduce my co-host, Xavier Ashe.

16
00:01:25,500 --> 00:01:26,540
Xavier?

17
00:01:26,760 --> 00:01:29,840
Good afternoon, everyone, or good morning to where you're at.

18
00:01:29,840 --> 00:01:31,840
So my name is Xavier Ashe.

19
00:01:31,840 --> 00:01:33,700
I go by Rubix1138.

20
00:01:33,980 --> 00:01:37,380
My IR experience is a little varied.

21
00:01:37,380 --> 00:01:42,460
I was an IR team lead at bit nine slash carbon black.

22
00:01:42,480 --> 00:01:48,680
And also I was able to start the first IR team at SunTrust, now Truist.

23
00:01:48,740 --> 00:01:52,620
So 28-year veteran, been around for a while.

24
00:01:52,620 --> 00:01:57,900
I can remember when my IR plan was you have to scan every floppy by hand.

25
00:01:57,900 --> 00:01:59,320
That's me.

26
00:01:59,720 --> 00:02:00,560
Cool.

27
00:02:00,560 --> 00:02:03,220
Next I'd like to introduce Lip Moose.

28
00:02:03,220 --> 00:02:09,660
Moose is frequently posting to Twitter, comments on exciting things that she encounters doing IR.

29
00:02:09,760 --> 00:02:14,160
And this week it was jump boxes that look like flaming toilets, I think was one of the highlights.

30
00:02:14,740 --> 00:02:27,940
She refers to herself as many things, including Florida woman, a DFIR violinist, and recently completed a cross-country hacker road trip with cats and snails on board.

31
00:02:27,940 --> 00:02:29,620
Isn't that right, Lip Moose?

32
00:02:30,840 --> 00:02:32,380
That's fairly accurate.

33
00:02:32,380 --> 00:02:34,640
I did remote DEF CON.

34
00:02:34,740 --> 00:02:36,280
We got to see a few goons.

35
00:02:36,280 --> 00:02:37,240
It was nice.

36
00:02:37,240 --> 00:02:42,760
So I go by Lip Moose on Twitter, also known as Moose.

37
00:02:42,760 --> 00:02:44,500
My name is also Heather.

38
00:02:44,540 --> 00:02:46,500
I'm currently working at CrowdStrike.

39
00:02:46,500 --> 00:02:51,560
I'll dox myself today, which is not a thing I usually do at DEF CON.

40
00:02:51,620 --> 00:02:54,420
But I'm very proud of where I work and what I do.

41
00:02:54,420 --> 00:02:58,880
I work with a lot of companies of all sizes.

42
00:02:58,880 --> 00:03:19,160
I come from a background for financial giants, as well as manufacturing giants, and have been doing this long enough to where I think I've been awake and can engage myself in the 60s if I add all of my cumulative IR experiences together without sleep.

43
00:03:19,160 --> 00:03:21,860
So I'm looking forward to retirement.

44
00:03:21,860 --> 00:03:25,100
I don't know when that will be, but I do love what I do.

45
00:03:25,100 --> 00:03:27,880
Outside of work, I herd cats and I play violin.

46
00:03:28,240 --> 00:03:33,720
And so I'd actually like to pivot and introduce somebody that I've worked with a little bit.

47
00:03:33,720 --> 00:03:37,660
1099, one of my favorite people in the world.

48
00:03:38,300 --> 00:03:42,640
Look, I'm sober right now, which is a problem.

49
00:03:42,640 --> 00:03:45,760
But, Brian, I'll go ahead and pass it over to you.

50
00:03:46,640 --> 00:03:48,860
Well, hello, all you cool cats and kittens.

51
00:03:48,860 --> 00:03:53,020
My name is Brian Moran, and I go by the incredibly clever Brian J.

52
00:03:53,020 --> 00:03:54,080
Moran on Twitter.

53
00:03:55,360 --> 00:03:57,820
I've worked primarily in the Air Force.

54
00:03:57,820 --> 00:04:10,760
That's where I started my career, worked for a three-letter agency, did that for a bit, got out of the military, bounced around a couple of private sector companies, and eventually, back in 2014, started working completely for myself.

55
00:04:10,760 --> 00:04:14,000
So I started my own company, and I am an IR consultant.

56
00:04:14,000 --> 00:04:17,620
That's what I do probably about 60% of the time.

57
00:04:17,620 --> 00:04:36,180
The other 20, 30% is probably primarily focused on training and development plans, and the other 10% of my time is primarily spent trying to keep the DFIR FIT going, where it's all about just trying to get a little bit more active, and hopefully we can all be on this little blue dot a little bit longer.

58
00:04:37,940 --> 00:04:38,620
Cool.

59
00:04:38,620 --> 00:04:45,400
Yeah, I certainly was going to mention Brian's Twitter seems to generally be filled with DIR FIT and comments on rum.

60
00:04:45,660 --> 00:04:47,180
You left the rum out.

61
00:04:47,880 --> 00:04:50,260
Well, I have some right here.

62
00:04:50,580 --> 00:04:52,540
Oh, funny you should mention that.

63
00:04:54,900 --> 00:04:56,900
I thought you were going to be better than me, Brian.

64
00:04:58,800 --> 00:05:01,420
Let's hear from Virus before we have our toast.

65
00:05:01,420 --> 00:05:15,340
Virus, so he says he's only been a blue teamer for about a year and a half with a background in red team, and he's currently doing what I call kind of red-blue and innovative network defense for a large financial organization.

66
00:05:15,340 --> 00:05:17,860
If you want to elaborate, welcome, Virus.

67
00:05:17,860 --> 00:05:21,160
Yeah, so I work at Stripe currently.

68
00:05:21,440 --> 00:05:25,300
I'm the threat detection team.

69
00:05:27,040 --> 00:05:34,360
I guess the word for it is adversary direct engagement and threat hunting.

70
00:05:34,360 --> 00:05:43,040
Background-wise, started in the dark gray end of the pool as a young kid, like my first DEF CON, I was 17.

71
00:05:44,640 --> 00:05:52,980
Fell into penetration testing and then red teaming, like full-spectrum threat stuff, and passed around the world doing that for a while.

72
00:05:53,420 --> 00:06:07,040
Kind of drifted back towards pen testing, and then, surprise, had a kid, and, you know, turns out that gallivanting around the world, breaking into buildings in random countries, and getting arrested is not a good way to be a dad, so had to pivot for a while.

73
00:06:07,760 --> 00:06:13,160
Did a stint doing mergers and acquisitions security at Salesforce and found out I'm not bureaucrat.

74
00:06:13,740 --> 00:06:16,640
Now I'm doing blue team, so, yeah.

75
00:06:18,700 --> 00:06:20,280
Cool, that's awesome.

76
00:06:20,280 --> 00:06:26,080
Really looking forward to sharing some of your perspectives that we heard in our planning meeting yesterday.

77
00:06:26,800 --> 00:06:32,680
So before we get going, we wanted to carry out the DEF CON tradition of first-time speaker drink.

78
00:06:35,780 --> 00:06:38,020
Everybody have their glass ready?

79
00:06:38,720 --> 00:06:39,620
Awesome.

80
00:06:39,620 --> 00:06:40,900
Cheers to IR.

81
00:06:49,530 --> 00:06:54,790
All right, so to kick it off, you know, we're in a unique situation here in 2020, right?

82
00:06:55,370 --> 00:06:59,150
With COVID forcing work from home for so many people.

83
00:06:59,370 --> 00:07:05,590
So I wanted to start with a question for full-time incident responders, Moose and Brian.

84
00:07:05,690 --> 00:07:09,670
What types of incidents are you seeing the most of right now?

85
00:07:09,710 --> 00:07:15,830
What are the trends in attack methods, persistence, and anything else you've observed lately in your work?

86
00:07:18,050 --> 00:07:20,250
Yes, I can go ahead and start.

87
00:07:21,710 --> 00:07:25,130
It hasn't changed too, too much.

88
00:07:25,130 --> 00:07:28,030
The volume has been a huge uptick.

89
00:07:28,070 --> 00:07:31,370
I'm still seeing a ton of ransomware attacks.

90
00:07:31,530 --> 00:07:43,150
A curious thing that I'm seeing more of now is actually, I would say, more intrusion via remote code execution has had an uptick recently.

91
00:07:43,150 --> 00:07:52,530
With a lot of the bots out there, vulnerability scanning, I would say that those are getting hit before people can catch just a little bit faster than I used to see.

92
00:07:53,490 --> 00:08:04,470
But a lot of the end game for what I'm seeing now is either encryption and then extortion or exfil and then extortion.

93
00:08:04,530 --> 00:08:10,290
And I would say that the volume has just gone up versus what it was like a year ago.

94
00:08:11,430 --> 00:08:14,130
Yeah, I would 100% agree.

95
00:08:14,230 --> 00:08:21,470
The exact same stuff that's happening now has been happening for the past probably two to three years has been the general trend.

96
00:08:21,470 --> 00:08:25,030
But the volume of it has just immensely increased.

97
00:08:25,030 --> 00:08:32,430
And probably part of that is the bad actors have nothing else to do except stay at home, just like we have nothing else to do.

98
00:08:32,430 --> 00:08:37,850
So the idle hands will play, I believe, is the phrase that's used there.

99
00:08:37,850 --> 00:08:49,970
So the one thing that I have seen more recently an uptick of than I have over the past year or so is actually O365 and not necessarily intrusions.

100
00:08:49,970 --> 00:08:59,710
It's users clicking on links they shouldn't click on, and then the attackers getting access to stuff that they shouldn't necessarily be able to get.

101
00:08:59,710 --> 00:09:02,750
So it's not necessarily a 365 intrusion.

102
00:09:02,750 --> 00:09:08,310
It's just phishing, which is kind of directed more towards with the overall goal of getting some O365 access.

103
00:09:12,300 --> 00:09:13,700
Yeah, that's interesting.

104
00:09:13,700 --> 00:09:25,760
I wanted to ask, a lot of companies have focused a lot of their security on their networks, and perhaps not as much on their endpoints and cloud services.

105
00:09:26,280 --> 00:09:41,680
And now that many of their workers are remote, they don't have the option to do monitoring on their network, and maybe aren't as well prepared to monitor from their endpoints and their cloud services.

106
00:09:42,060 --> 00:09:44,340
Would you agree that that's the case?

107
00:09:44,340 --> 00:09:48,280
And how is that impacting what you're seeing out there?

108
00:09:49,960 --> 00:09:52,700
So I would say it definitely does.

109
00:09:52,700 --> 00:10:06,020
But the caveat to that, and I already kind of doxxed where I work, is I'm getting calls because they're not necessarily using an EDR to begin with, or maybe there's not as much focus on the endpoint.

110
00:10:06,140 --> 00:10:14,680
And I think that what's neglected in cloud is that there's this perception of security that's not really there.

111
00:10:14,680 --> 00:10:18,260
You're just working on a server in somebody else's data farm.

112
00:10:18,260 --> 00:10:29,700
And so you still need to put the same protections on it, and monitor your VPC flow logs, and look at what VPC you're putting stuff in, or what segment, rather.

113
00:10:29,700 --> 00:10:34,220
And you would monitor it just like you would something on-prem in your environment.

114
00:10:34,240 --> 00:10:40,960
And I'm seeing that being so quick to set up that sometimes those steps are missed, and then I'll get a call.

115
00:10:42,600 --> 00:10:52,640
Yeah, I think as we talked about a little bit last night, one of the things is the data that you need to actually respond to a breach of some sort, it's always been there.

116
00:10:52,640 --> 00:11:01,520
It's just never really been used or even thought of being looked at, because before it was all, well, we're just going to block everything at the network layer because everything is controlled.

117
00:11:01,520 --> 00:11:04,600
But now that everything's spidered out, all the logs are still there.

118
00:11:05,240 --> 00:11:06,340
All of that's still there.

119
00:11:06,340 --> 00:11:09,360
It just never was bothered to actually be configured properly in the first place.

120
00:11:09,360 --> 00:11:11,560
So that's why we're seeing what we're seeing.

121
00:11:12,680 --> 00:11:24,380
So with the more distributed, I'm hearing more endpoints and more cloud, has that really changed the way that we're doing IR now?

122
00:11:28,630 --> 00:11:30,650
I would say yes and no.

123
00:11:30,830 --> 00:11:36,630
So we're still asking for logs that are representative of the same data.

124
00:11:36,630 --> 00:11:42,390
Instead of asking for firewall logs in this case, you're looking for NetFlow, which might be DPC flow.

125
00:11:42,710 --> 00:11:52,470
We're still asking to run scripts to an endpoint, which whether or not it's in a cloud or on-prem, it's going to be capturing the same artifacts.

126
00:11:52,470 --> 00:12:02,030
We're looking at the same things on Linux that we're looking at on an AWS Linux server that we would look at in a server in your environment that's physically there.

127
00:12:02,030 --> 00:12:18,430
So I would say that while things have changed in slight ways in how we capture the data, so converting an EBS snapshot versus a VMPK versus I'm going to run FTK to it, those little minor changes are there.

128
00:12:18,430 --> 00:12:22,650
But I think just getting creative about, I'm still caring about the same things.

129
00:12:22,650 --> 00:12:25,350
I'm still caring about how the thread actor got there.

130
00:12:25,590 --> 00:12:29,170
So your original access point, I'm going to look at all logs.

131
00:12:29,170 --> 00:12:33,730
I'm going to look at, has there been any exfil, file creation, file deletion.

132
00:12:33,730 --> 00:12:37,410
So the same questions we've been asking forever, we're still going to keep asking.

133
00:12:37,410 --> 00:12:41,850
It's just that creativity around, we're in a different environment now.

134
00:12:42,890 --> 00:12:48,350
Unfortunately, those logs are generally there for companies that rely on Office 365.

135
00:12:48,650 --> 00:12:53,150
A lot of times you just have to have the right licenses to go look at them in cloud app security and other places.

136
00:12:53,410 --> 00:13:02,750
So what happens when an organization hasn't really invested in logging on their endpoints or anything beyond the defaults that come with Windows?

137
00:13:02,750 --> 00:13:10,870
You have a situation where you have people getting phished or getting malware, and there's really not much to go on.

138
00:13:10,870 --> 00:13:12,790
What do you do in that case?

139
00:13:13,210 --> 00:13:24,970
Generally, you're not going to have the easy access to get a forensic image and conduct analysis on the device because it's somewhere far away from you, maybe on a slow link.

140
00:13:24,970 --> 00:13:26,430
How do you deal with that?

141
00:13:28,650 --> 00:13:36,670
Well, I think the old way of, well, we would just show up and collect data from somebody's computer in the event that something happened.

142
00:13:36,810 --> 00:13:41,050
Obviously, that is no longer going to be existing.

143
00:13:41,390 --> 00:13:51,130
So you have to get creative with essentially trying to get the same people together on a call like this and figure out what you actually have access to.

144
00:13:51,130 --> 00:13:59,890
Not necessarily what you have, because more than likely in the event that someone like myself or Moose gets called in, stuff has already happened that's really, really bad.

145
00:14:00,150 --> 00:14:03,390
We're pretty much the last people you want to see in the event of an incident.

146
00:14:03,550 --> 00:14:13,470
So you have to get creative with essentially figuring out what you have access to and then how far back that goes, if it goes back at all, and then try to build out from there.

147
00:14:13,470 --> 00:14:19,770
Because a lot of times when we show up somewhere, the first question is, well, okay, do you have NetFlow?

148
00:14:19,770 --> 00:14:20,530
Do you have logs?

149
00:14:20,530 --> 00:14:22,190
Do you have X, Y, and Z?

150
00:14:22,250 --> 00:14:26,470
And a lot of times, the initial part of an incident isn't even actually responding to something.

151
00:14:26,470 --> 00:14:36,510
It's figuring out what we actually have access to and then trying to get creative with ways to get access to that data, get it as quickly as possible, and then turn that into usable information that we can use as quickly as possible.

152
00:14:39,790 --> 00:14:41,570
So what are some things...

153
00:14:43,730 --> 00:14:44,470
Go ahead, Moose.

154
00:14:44,470 --> 00:14:45,030
Sorry.

155
00:14:45,210 --> 00:14:51,730
I was just going to say, I think one of the boons right now is that so many people have invested in cloud security, so it almost negates the problem.

156
00:14:52,650 --> 00:15:06,790
A lot of times, a threat actor's pivot point of getting into a lot of devices, we can think about, and I almost want to turn it over to Byers for this one, but if you think like an attacker, you have a better chance of getting the data you need.

157
00:15:06,810 --> 00:15:22,850
And I worked a case recently where, you know, I couldn't run the scripts I wanted to, but I looked at what they did, and I said, well, let's just replicate what the red team did, or what the threat actor did in this case, and let's red team it, and I got the data I needed.

158
00:15:22,950 --> 00:15:27,550
So that's... sometimes you just got to look at the problem a little bit.

159
00:15:28,830 --> 00:15:53,830
I think another curveball that I started to see is, you know, for companies that use Wwise terminals, you really can't take those thin clients home, and so we're seeing an increased use of other devices like Chromebooks, and so I wanted to see any advice out there if somebody that's listening is going to be doing any type of instant response involving Chromebooks used as,

160
00:15:54,590 --> 00:15:56,830
you know, thin clients.

161
00:15:57,130 --> 00:16:00,010
Is there any advice that you can give to those folks out there?

162
00:16:02,630 --> 00:16:04,590
Looks like we lost Moose for a minute.

163
00:16:05,090 --> 00:16:11,670
Well, so I know that there's been some research into essentially the data that you can collect from Chromebooks.

164
00:16:11,670 --> 00:16:18,650
I know Jessica Hyde from Magnet Forensics has done quite a bit on that, and I believe this past year she's given a few talks on that.

165
00:16:18,650 --> 00:16:20,390
So there is data you can get from Chromebooks.

166
00:16:20,390 --> 00:16:30,450
You have to get clever with it, but one of the things that's interesting is if you use Chromebooks, more than likely you're using some sort of Google instance, and Google has a ton of data about you.

167
00:16:30,450 --> 00:16:36,570
Whether you use Google or not, Google has a ton of data about you, and because you're able to get all of that data back from them.

168
00:16:36,570 --> 00:16:39,490
And admittedly, there's a lot of stuff to go through.

169
00:16:39,870 --> 00:16:41,830
But it's not necessarily...

170
00:16:41,830 --> 00:16:43,450
like Chromebooks are incredibly secure.

171
00:16:43,450 --> 00:16:45,090
I love Chromebooks.

172
00:16:45,090 --> 00:16:49,270
I recommend Chromebooks to pretty much everybody who gets click-happy with any kind of links.

173
00:16:49,270 --> 00:16:54,330
Just use a Chromebook for a while, and hopefully that's going to eliminate a big portion of your attack surface.

174
00:16:54,330 --> 00:16:58,350
It's not going to completely eliminate it, but it's going to take a big portion of that away.

175
00:16:58,590 --> 00:17:07,770
But essentially, at the end of the day, you know, we're still trying to look for the oddity outlier information of data access, you know, data exfil, stuff like that.

176
00:17:07,770 --> 00:17:11,610
And with the stuff that you can get from Google specifically, like all of that's there.

177
00:17:11,610 --> 00:17:16,150
It's just a matter of being able to get it, being able to process it, and being able to digest it.

178
00:17:17,250 --> 00:17:27,150
What are your thoughts, Virus, on doing IR with cloud and distributed endpoints without the hardened network of tradition?

179
00:17:29,570 --> 00:17:35,090
In some ways, I guess I haven't been around in the Blue Team ecosystem enough to know the difference.

180
00:17:36,110 --> 00:17:46,930
Like, the few roles that I've had that are hard in Blue Team, I've always had the power to at least have a say in kind of what our telemetry looks like.

181
00:17:46,930 --> 00:17:52,410
And I mean, coming from the red side, I've frankly never really bothered wanting network stuff.

182
00:17:52,410 --> 00:17:59,490
It's always, you know, anything that's a network artifact, I only care about it in the context of what the endpoint did in terms of interaction.

183
00:17:59,490 --> 00:18:06,030
And so it's just usually easier to filter on down and kind of pinhole what I want.

184
00:18:07,090 --> 00:18:17,510
I have definitely, within the past year, I've dealt with some vendor breaches, which are all public, so I can say that, but I guess I won't say exactly what they are.

185
00:18:17,510 --> 00:18:19,830
So, you know, I won't get fired immediately.

186
00:18:20,950 --> 00:18:23,570
And it's kind of interesting.

187
00:18:23,570 --> 00:18:38,530
One of the nice things about, I shouldn't say nice, but one of the interesting things about kind of being tangentially related to a breach that gets released public is suddenly you have like a legal stick to beat them with to actually get IOCs back from the breach,

188
00:18:38,530 --> 00:18:43,070
as opposed to just reading the news and having a Twitter opinion like the rest of the world.

189
00:18:44,270 --> 00:18:53,290
And from what I've seen, it definitely, like, the game for the vectors in terms of the game for getting in doesn't seem to have changed.

190
00:18:53,290 --> 00:18:55,430
It's usually not the server.

191
00:18:55,670 --> 00:18:58,650
It's usually it's way easier to get on a laptop.

192
00:18:58,650 --> 00:19:08,310
And then because no one knows how to network in the cloud, like everything is just grabbing the AWS token or the Azure token off disk and then going to town.

193
00:19:08,310 --> 00:19:18,110
And then usually from there, it's a, oh, by the way, either there's no logs or there's a ton of logs, but nobody's ever actually triaged them to find out which logs are useful and which ones aren't.

194
00:19:18,110 --> 00:19:19,770
So there's no logs.

195
00:19:19,870 --> 00:19:30,970
And then it's usually going back and being like, oh, well, after they took this token from your machine, then they directly logged in with this super weird user agent that no one's ever heard of and stole all your data and you did nothing.

196
00:19:32,490 --> 00:19:35,730
At least that's been the trend from what I've seen.

197
00:19:36,110 --> 00:19:59,430
The Chromebook thing, there actually is, I don't have a lot of specific details that I can share, but I do know that there has been some publicly released stuff on Google implementing a kind of AuditD type thing that is going to be very similar to like OS X's security center in terms of accessible data.

198
00:19:59,430 --> 00:20:05,810
So I think that's going to be a game changer with all of the EDR tools that are out there that are hooking into AuditD as kind of a funnel for data.

199
00:20:05,810 --> 00:20:07,270
I think that'll be really cool.

200
00:20:07,590 --> 00:20:20,830
And then also anybody who's looking to do DFIR on Chrome locked devices in general, I would actually route you to some research from about eight or nine years ago from Mike Osmond and Kyle Osborne.

201
00:20:20,830 --> 00:20:30,530
They did some offensive research on basically how everything in Chrome is a browser and the browser doesn't know the difference between a file system link and a remote link.

202
00:20:30,530 --> 00:20:40,050
And while Google has obviously tried to address the security concerns that they found with some of that research, you can actually use a lot of those vectors to gather debug information about the Chrome browser environment.

203
00:20:40,050 --> 00:20:43,970
And that ends up being almost equivalent to system logs on a Chrome locked device.

204
00:20:45,210 --> 00:20:51,830
And you started your comments there with, you know, first getting on the laptop and then pivoting out from there.

205
00:20:52,010 --> 00:20:54,930
What's the most common method for getting on the laptop ?

206
00:20:55,810 --> 00:20:56,770
It's the usual.

207
00:20:56,770 --> 00:21:00,490
It's either phishing or I've seen some supply chain stuff recently.

208
00:21:02,410 --> 00:21:06,810
I came out relatively recently that I know affected a bunch of shops.

209
00:21:06,950 --> 00:21:18,630
I've seen some slightly less talked about in the media because the Go ecosystem is so blurred in terms of the concept of standard lib versus some person's stuff on GitHub.

210
00:21:18,630 --> 00:21:23,450
But I have seen some bugs there that have caused some supply chain issues.

211
00:21:23,950 --> 00:21:34,910
There's little known fact, I have seen, well, it's a more known fact that OSX attacks are on the rise, but it's a lesser known fact that Perl is still on the OSX boxes.

212
00:21:34,910 --> 00:21:45,910
So, I have seen kind of some like, you know, oh, I haven't seen that attack since like Red Hat 5, but, you know, that Perl subsystem is still on OSX and way more people look at Python on OSX than Perl.

213
00:21:45,910 --> 00:21:47,190
So, there's a little more of that.

214
00:21:48,170 --> 00:21:48,890
That's great.

215
00:21:48,970 --> 00:21:55,650
I'm curious, Brian, your observations, you know, how they compare to viruses feedback, you know, and what you're seeing.

216
00:21:56,990 --> 00:22:02,730
Yeah, I think it's... so, I don't think the methods have changed.

217
00:22:02,730 --> 00:22:04,530
The methods haven't changed.

218
00:22:04,530 --> 00:22:08,430
And honestly, the methods don't really need to change because they still work.

219
00:22:08,430 --> 00:22:21,970
So, if they're still effective, there's no reason to burn some, you know, some zero day exploit or even go the route of looking for like RCE or anything like that, when if you can get somebody to click on a link and get the information you need, and that still works,

220
00:22:21,970 --> 00:22:23,530
like, that's what the attackers are going to do.

221
00:22:23,530 --> 00:22:28,050
Because, you know, again, at the end of the day, like, the attackers are human just like us.

222
00:22:28,050 --> 00:22:32,450
Like, they will do just as much efforts as needed to get them the goal that they need.

223
00:22:32,450 --> 00:22:35,330
And, you know, you have to be able to account for that.

224
00:22:36,350 --> 00:22:43,230
One of the tools I haven't heard yet so far for telemetry is, you know, cloud-based DNS.

225
00:22:43,370 --> 00:22:48,010
So, a couple providers where you can get that from a centralized source.

226
00:22:48,190 --> 00:22:53,070
Are we seeing more people, you know, take that on as we get to a more distributed environment?

227
00:22:53,170 --> 00:23:03,850
Or is that still an afterthought of like, oh, yeah, we can't get good DNS telemetry because everybody's at home using their home DNS?

228
00:23:05,370 --> 00:23:07,790
Has anybody got any experience with that?

229
00:23:08,410 --> 00:23:09,670
I do.

230
00:23:09,670 --> 00:23:14,170
I've had some that have it, but not very many.

231
00:23:14,170 --> 00:23:20,510
And with the caveat of saying that if they're calling me, something's gone terribly wrong.

232
00:23:20,510 --> 00:23:29,930
Or, or counter, we do do security assessments in environments that might be something to come back with because they've set up a cloud environment and they want advice on how to make it better.

233
00:23:29,930 --> 00:23:41,130
So, I will say that I have a little bit of a bias at answering this because even though I don't see it as much, it's usually because they're calling for help.

234
00:23:41,750 --> 00:23:46,070
Yeah, I mean, control is kind of a crapshoot.

235
00:23:46,070 --> 00:23:54,630
But in terms of telemetry, like, man, the combination of a low-level passive DNS service and OS Query seems amazing for DNS to me.

236
00:24:00,120 --> 00:24:04,000
Yeah, so I'm going to say pretty much the exact same thing that Moose did.

237
00:24:04,000 --> 00:24:06,000
Like, I would like to see it more.

238
00:24:06,000 --> 00:24:08,080
However, a lot of places don't see it.

239
00:24:08,080 --> 00:24:15,440
And the places that call us, more than likely, there have been several shortcomings that led to calling people like us in the first place.

240
00:24:15,440 --> 00:24:22,820
So, typically, we wouldn't see something like that because we're not the security architects or anything like that.

241
00:24:22,820 --> 00:24:25,900
Like, something horrible has happened, everything's on fire.

242
00:24:25,900 --> 00:24:28,540
I'll call them in and they're hopefully going to calm us down.

243
00:24:28,720 --> 00:24:40,980
So, before we pivot to another topic, if you were called in to give advice to a company today, and they wanted to spend some additional budget for security with people working from home, where would you advise them to focus?

244
00:24:45,100 --> 00:24:48,800
I mean, I can tell you where we have an entirely remote workforce right now.

245
00:24:48,800 --> 00:24:55,380
And there is some scatter in terms of operating the system layout.

246
00:24:55,380 --> 00:25:00,680
And pretty much 100% of our EDR effort at this point is done using OS Query.

247
00:25:00,680 --> 00:25:01,980
That's pretty public information.

248
00:25:01,980 --> 00:25:04,900
I don't really feel like I'm giving away secret sauce saying that.

249
00:25:04,900 --> 00:25:11,420
And at least from a telemetry perspective, even with specific regard to DNS, I can tell you, it's pretty amazing.

250
00:25:11,420 --> 00:25:18,160
Like, we have other issues, but DNS telemetry is certainly not one of them from my perspective.

251
00:25:20,340 --> 00:25:24,920
I think the one piece of advice I could give is don't ignore any front.

252
00:25:24,920 --> 00:25:31,300
I see a lot of people spending very heavily in one arm rather than maybe ignoring the other.

253
00:25:31,300 --> 00:25:36,660
So, they'll focus just on end point or they'll focus predominantly on network side.

254
00:25:36,660 --> 00:25:40,480
And I think that the balance is still very, very important.

255
00:25:40,680 --> 00:25:48,980
And I would say to borrow something that we all as a team talked about yesterday, too many people are trying to eat the elephant hole.

256
00:25:49,160 --> 00:25:50,440
So, don't do that.

257
00:25:50,440 --> 00:25:52,380
Don't keep your network flat either.

258
00:25:52,380 --> 00:25:57,660
So, my top advice to people is make a list of priorities in your environment.

259
00:25:57,660 --> 00:26:00,560
What would hurt the worst if that went public?

260
00:26:00,940 --> 00:26:03,100
And start segmenting there.

261
00:26:03,100 --> 00:26:04,260
Start segmenting.

262
00:26:04,260 --> 00:26:06,040
Know your group permissions.

263
00:26:06,180 --> 00:26:08,160
Run some of these Red Team tools.

264
00:26:08,160 --> 00:26:10,480
Run Blood Pound, Sharp Pound in your environment.

265
00:26:10,480 --> 00:26:13,780
Get a better picture of what it looks like and then make a decision .

266
00:26:13,780 --> 00:26:23,020
But make an educated decision, not just a flat blanket decision because not all businesses are the same and not all businesses have the same needs.

267
00:26:24,980 --> 00:26:35,920
I think before spending any money , the first thing that a company truly has to do is take a look at what they already have, the people they already have, and then try to build a solution from that.

268
00:26:35,920 --> 00:26:42,380
Just like Moose said, a lot of times when I go to places, they don't even have something basic like a network map.

269
00:26:42,380 --> 00:26:52,140
So, then I look for the attackers when essentially they dump IP.txt to some system and then I have an actual network map that I can go on because the attackers have left their forest, fortunately.

270
00:26:52,140 --> 00:26:57,160
So, that's literally the only insight that we have to what's actually on the network is what the attackers have done.

271
00:26:57,200 --> 00:27:03,020
So, you can't be just spending money while you have all of these gaping holes that just have never been addressed.

272
00:27:03,020 --> 00:27:12,760
You have to do a serious and honest and truthful evaluation of what you currently have already before you make a decision on what you're actually going to do to try to improve.

273
00:27:13,480 --> 00:27:16,600
And related to that, skills versus tools, right?

274
00:27:16,600 --> 00:27:29,660
Should you be investing in your staff and in their skills, training, sending them to conferences like DEF CON where they can learn from the community what others are doing and increase their capabilities instead of buying tools?

275
00:27:29,840 --> 00:27:31,320
Thoughts on that, anyone?

276
00:27:32,440 --> 00:27:34,420
I have strong feelings.

277
00:27:35,220 --> 00:27:39,300
So, I think it's both.

278
00:27:40,080 --> 00:27:48,980
So, you really need to invest in your people but don't overtax them so much that you're not giving them the tools to work with so that they're getting alert.

279
00:27:49,240 --> 00:27:56,480
You don't want to have them working with the bare nothing and then getting mad at them when they miss something.

280
00:27:56,480 --> 00:28:12,960
So, you know, take the team you have and really build them up but then also listen to them on their level of what they'd like to use and what they'd like to have and use that training of sending them to conferences and coming back and gathering that information to inform your decisions.

281
00:28:12,960 --> 00:28:22,460
And I think that it really needs to be that whole cycle of you're investing in their education and then going to conferences and networking and letting them come back to you with a solution.

282
00:28:22,580 --> 00:28:26,060
And that is going to sometimes be investing in tools for them.

283
00:28:27,080 --> 00:28:29,060
Yeah, I agree 100%.

284
00:28:29,060 --> 00:28:34,760
You know, you really want to listen to your team, you know, listen to their experience, right?

285
00:28:35,060 --> 00:28:47,980
You know, get them to get out there and participate in the community and learn what works and, you know, take their advice on those areas, you know, and figuring out where to invest in your team.

286
00:28:48,260 --> 00:28:54,100
So I wanted to talk a little bit about IR teams and folks who want to get into IR.

287
00:28:54,100 --> 00:29:04,380
So, you know, I think they're two related topics, but a lot of people have asked if we could give, you know, what's your best advice for people who are interested in getting into the incident response field?

288
00:29:07,680 --> 00:29:10,300
And that's for anyone who wants to go first.

289
00:29:10,300 --> 00:29:11,640
I'll go first.

290
00:29:11,640 --> 00:29:26,420
So my personal opinion on how to get into IR or really kind of any info sec, like specific sort of doctrine at all is just to simply be curious, like ask questions, try to research stuff on your own, figure things out.

291
00:29:26,420 --> 00:29:35,660
Like you may not be the best person at assembly or firmware architecture or IR or malware reversing or anything like that.

292
00:29:35,660 --> 00:29:44,140
But as you find questions and, you know, find things that you're curious about and want to research and learn more about, like you'll generally kind of find an area that you want to go down.

293
00:29:44,140 --> 00:29:53,520
And at the end of the day, like you have to kind of decide if you want it to be a typical job where you work eight to five every day and show up and you get paycheck and that's it.

294
00:29:53,520 --> 00:30:03,100
Or if you want it to be a career and you actually want to be good and want to actually, you know, be better at what you do and be more effective and be more efficient and network with people and all of that.

295
00:30:03,100 --> 00:30:12,700
And it's not really a lifestyle decision so much as it has to be an internal passion and desire that you actually want to do something.

296
00:30:18,120 --> 00:30:20,460
Anyone else want to comment on that one?

297
00:30:22,080 --> 00:30:30,420
I want to say that you're safe, but I will, I'll chime in and say everything that Brian said absolutely settled down on that.

298
00:30:30,420 --> 00:30:40,740
But just know that there's no wrong path and that to you can do anything in your spare time that you're passionate about and turn it into IR.

299
00:30:40,740 --> 00:30:47,760
The difference is what I typically see in good IR is you don't stop at the first answer.

300
00:30:47,980 --> 00:30:50,680
So, and you don't stop at the second answer either.

301
00:30:50,820 --> 00:30:59,520
It's this stubbornness and that drive of being stubborn to where, okay, make yourself a home lab, image your own devices, break them.

302
00:30:59,520 --> 00:31:05,120
Like see what you can do and see what you're seeing and use that to train yourself.

303
00:31:05,260 --> 00:31:12,800
And it really is something that it takes a lot of training and that there's not just you're there one day.

304
00:31:12,800 --> 00:31:19,640
So, I'll admit myself, I get imposter syndrome a lot, but that's because every day I have to Google.

305
00:31:19,640 --> 00:31:27,060
There will be something every day that I don't know the answer to or I haven't seen before and I am researching the hell out of it.

306
00:31:29,600 --> 00:31:40,100
I'm saying sometimes it feels like I'm banging my head against the wall, but that doesn't go away.

307
00:31:40,100 --> 00:31:45,340
And so, if you're okay with that and you have the personality that has that drive, you're going to do great.

308
00:31:45,920 --> 00:31:52,520
And being, like listening to this right now, it shows enough that you're willing to listen to the five of us ramble for an hour.

309
00:31:52,560 --> 00:31:57,720
You're probably in good company and you should probably just keep pursuing this.

310
00:31:59,920 --> 00:32:14,400
One of the, on that line, you know, talking about getting into IR, talk to the, you know, more along the lines of the type of work and particularly about the stress.

311
00:32:14,820 --> 00:32:19,320
You know, typically IRs, you're more like a fireman.

312
00:32:19,780 --> 00:32:24,380
You're dealing with sometimes some high stress situations.

313
00:32:24,740 --> 00:32:38,140
And so, any comments or suggestions for the listeners around, you know, kind of dealing with the excitement and the stress that can come along with being part of an IR engagement?

314
00:32:39,180 --> 00:32:49,140
Well, I think one of the things that you have to take into account is, so first of all, like from an IR perspective, like you have to try your best to be calm.

315
00:32:49,140 --> 00:32:57,100
Like you can't overreact like everybody else, like let everybody else overreact, let everybody else run around and scream and yell and all of that.

316
00:32:57,100 --> 00:32:58,720
Like you have to be the calming voice.

317
00:32:58,740 --> 00:33:03,500
However, that doesn't mean internally, you're not screaming and yelling too, because you absolutely are.

318
00:33:03,500 --> 00:33:06,980
You just have to portray yourself as having that calming presence.

319
00:33:07,260 --> 00:33:17,880
And you also have to essentially, not necessarily, not necessarily have the right answer, but you have to have a answer because the path to recovery always starts with one step forward.

320
00:33:17,880 --> 00:33:22,660
And it doesn't matter if that step is even down the wrong path initially, like you just have to go forward.

321
00:33:22,660 --> 00:33:29,780
Because the takeaway that you can always have, no matter what, is somebody out there has it much worse than you currently do.

322
00:33:29,780 --> 00:33:41,280
And you always have to remind yourself, like as bad as everything is, like there's some company out there that got owned and they are in, unbelievably, an even worse situation right now than you are.

323
00:33:43,400 --> 00:33:50,780
I think that everybody in IR is a little bit of an adrenaline junkie, and that you're kind of lying to yourself if you're not.

324
00:33:50,780 --> 00:33:55,700
Brian, didn't you go like space jumping or something at one of the cons that we've been to recently?

325
00:33:55,920 --> 00:34:02,100
Yeah, I jumped off the stratosphere in Vegas a couple of years ago, twice, because I wanted to.

326
00:34:04,540 --> 00:34:12,120
I was going to take the question and ask each of you individually, you know, how do you get away from it?

327
00:34:12,120 --> 00:34:13,700
How do you deal with the stress?

328
00:34:14,660 --> 00:34:18,700
So Brian goes jumping off the stratosphere in Las Vegas.

329
00:34:19,580 --> 00:34:21,120
How about you, Moose?

330
00:34:21,120 --> 00:34:22,340
How do you get away from this?

331
00:34:22,340 --> 00:34:23,480
What are your breaks?

332
00:34:25,760 --> 00:34:28,480
Well, it's twofold, right?

333
00:34:28,480 --> 00:34:34,200
Like, everything I see on a daily basis, it's somebody else's worst day.

334
00:34:34,200 --> 00:34:36,220
I don't work for their company.

335
00:34:36,220 --> 00:34:41,520
And I had to realize this about myself and every job I've had.

336
00:34:41,520 --> 00:34:43,160
So I've not always been IT.

337
00:34:43,160 --> 00:34:46,760
I used to be vet tech, I used to be medical, I was a lifeguard.

338
00:34:46,760 --> 00:34:53,680
All of these things have a similar, like, vibe in that it's really high stress, but it involves helping.

339
00:34:53,820 --> 00:34:59,880
So I think, to me, my release is in seeing that step forward and that progression.

340
00:34:59,880 --> 00:35:11,540
And even if it's not happening right away, being able to reassure the people that I'm working with that it is truly happening, at the end of this, their environment will be better than we left, than it started at.

341
00:35:11,760 --> 00:35:25,500
And then, if that doesn't do it, I have cats and a violin, and on the worst day, I'll just shut everything down, everything gets unplugged, and I open up the violin case, and I walk away.

342
00:35:25,500 --> 00:35:30,560
And I think that's really important, is that you don't have to eat, sleep, and breathe this.

343
00:35:30,560 --> 00:35:33,040
You really should walk away sometimes.

344
00:35:33,180 --> 00:35:35,180
And that's what's kept me alive.

345
00:35:38,380 --> 00:35:39,760
And how about you, Virus?

346
00:35:39,760 --> 00:35:47,540
I mean, it sounds like you certainly have some of the adrenaline junkie in your experiences, in your past, breaking into buildings, you know?

347
00:35:47,540 --> 00:35:50,100
So what do you do for breaks?

348
00:35:51,960 --> 00:35:52,760
Shenanigans.

349
00:35:55,000 --> 00:35:58,940
I mean, I guess the first thing is, like, don't get stressed.

350
00:35:58,940 --> 00:36:00,380
Like, that's a big part of it.

351
00:36:00,380 --> 00:36:09,980
I mean, I've made a lot of... I've definitely steered a fair amount of my career decisionary of, like, you know, when I finish an arc, I go, did I like that?

352
00:36:10,080 --> 00:36:12,980
Or was it just stress in the bad kind of way?

353
00:36:13,100 --> 00:36:16,620
And then I use those takeaways to just not do that anymore.

354
00:36:16,620 --> 00:36:19,140
You know, kind of quantify how much my time is worth.

355
00:36:19,140 --> 00:36:26,420
Because if I spend the whole time when I'm not at work, stressed out about work, then I'm essentially working for free.

356
00:36:26,420 --> 00:36:29,660
So if I factor that into my paycheck, I'm like, oh, this isn't that worth it.

357
00:36:29,660 --> 00:36:32,880
So that's definitely the first step, is just don't do stuff that stresses you out.

358
00:36:32,880 --> 00:36:34,680
You know, know what your zeal is.

359
00:36:35,480 --> 00:36:40,140
But on a practical level, like, I played music for, like, 25, 30 years, semi-professionally.

360
00:36:40,140 --> 00:36:41,020
So, you know, I do that.

361
00:36:41,020 --> 00:36:42,140
I kind of zen out.

362
00:36:42,600 --> 00:36:43,340
I cook.

363
00:36:43,340 --> 00:36:44,100
I dry-age meat.

364
00:36:44,100 --> 00:36:45,300
I make my own gin.

365
00:36:45,300 --> 00:36:46,500
You know, I like scotch.

366
00:36:46,500 --> 00:36:47,680
I do a lot of drugs.

367
00:36:49,240 --> 00:36:51,540
And then I play with my boy.

368
00:36:51,540 --> 00:36:55,780
You know, I'll stand up from my desk when I'm working on a hard problem and just say, hey, let's go for a rock.

369
00:36:55,780 --> 00:36:56,340
And he's great.

370
00:36:56,340 --> 00:36:57,420
So that's amazing for him.

371
00:36:57,420 --> 00:36:57,820
It's great.

372
00:36:57,820 --> 00:36:59,780
He just runs around.

373
00:37:01,500 --> 00:37:07,680
But yeah, it's, I mean, you know, I think a lot of it is just you got to be holistic about your approach.

374
00:37:07,680 --> 00:37:10,160
And if you love the chase, you got to love the chase.

375
00:37:10,160 --> 00:37:11,560
And you got to love your chase.

376
00:37:11,560 --> 00:37:15,660
You got to love the chase that you're in and know where it is and just not lie to yourself.

377
00:37:15,660 --> 00:37:17,480
You can't, you know, do it.

378
00:37:17,480 --> 00:37:22,360
And I mean, there's definitely an undercurrent if I'm being extremely frank and extremely personal about it.

379
00:37:22,360 --> 00:37:39,380
I do think people that, I think there's a fair amount of people on the blue side, specifically, who have a very, I don't want to say ethical, but they have a very empathetic attachment to the world, slightly larger, maybe than most red teamers do, where at some level,

380
00:37:39,380 --> 00:37:41,780
they're kind of in it because they want to, they want to fix something.

381
00:37:41,780 --> 00:37:43,180
They want to make something a little better.

382
00:37:43,800 --> 00:37:51,700
And I don't know, I mean, I wouldn't call myself a complete prick, but I'm definitely on the side of like, yeah, I like money.

383
00:37:51,700 --> 00:37:52,580
Yeah.

384
00:37:53,860 --> 00:37:57,540
Long as I moved the needle a little bit and I got paid, I'm not too worried.

385
00:37:58,000 --> 00:37:59,900
Maybe that's a whole other conversation.

386
00:38:00,200 --> 00:38:05,180
If someone knows you from the outside, you're one of the nicest people I know, so that's a lie.

387
00:38:08,100 --> 00:38:27,580
If we could get back on the topic of, you know, of the IR field and IR teams , we had a question in the BTV discord about, you know, what are your top recommendations, and maybe some don'ts, you know, for growing your SOC and your IR team?

388
00:38:27,580 --> 00:38:43,120
You know, if you're at a company and, you know, it's growing and, you know, you get budget to have some full-time folks doing security operations and, you know, skills and tools ready to do incident response, you know, where do you want to focus?

389
00:38:43,120 --> 00:38:45,620
You know, what skills do the folks need to have?

390
00:38:45,940 --> 00:38:47,820
What are some of your preferred tools?

391
00:38:47,820 --> 00:38:52,540
And I know it depends a lot, but just in general, you know, where would you focus?

392
00:38:52,540 --> 00:38:53,920
Brian, why don't you go first?

393
00:38:54,980 --> 00:39:08,640
Well, I think it goes back to... it very much does depend, but it also depends on what you currently have already and essentially what you have the ability... what you want to essentially try to strive for.

394
00:39:08,640 --> 00:39:21,040
Like, if you want to go a very, very, you know, cheap route as much as possible, you would use something like OS query or use something like Velociraptor and, you know, try to essentially keep it on the cheaper side.

395
00:39:21,040 --> 00:39:23,760
But, you know, at the end of the day, it's still going to be able to work.

396
00:39:23,880 --> 00:39:29,360
Of course, if you have unlimited budget, like, you just line up boxes, you know, like crazy, and then you have all the tools and everything.

397
00:39:29,360 --> 00:39:33,500
But, you know, to be completely honest, that's not feasible for anybody.

398
00:39:33,500 --> 00:39:39,720
Like, companies will not just blindly give you ridiculous amounts of money to spend on people and tools and resources.

399
00:39:39,720 --> 00:39:44,340
So, you have to try to make whatever you have work with what you can.

400
00:39:44,340 --> 00:39:45,860
And that's one of the things that I stress.

401
00:39:45,860 --> 00:39:49,300
It doesn't necessarily matter what the dollar amount is.

402
00:39:49,300 --> 00:39:52,580
It's trying to make every dollar count as much as possible.

403
00:39:52,580 --> 00:39:56,080
So, that way, at the end of the day, you end up with a truly better result.

404
00:39:56,080 --> 00:39:58,400
If you have a very high budget, great.

405
00:39:58,400 --> 00:39:59,860
Like, you can afford expensive tools.

406
00:39:59,860 --> 00:40:01,880
But do you really need those expensive tools?

407
00:40:01,900 --> 00:40:11,680
Do you really need an expensive person to come in maybe for, like, you know, three, six months or something like that and help train and make the team better to already use the stuff that they already have?

408
00:40:11,680 --> 00:40:21,580
You know, in that case, you could argue very much that bringing somebody in external for a little bit and helping them not really as a staff log, more of kind of like an overseeing mentorship almost.

409
00:40:21,580 --> 00:40:27,760
Like, that is a much better investment than just blindly buying, you know, a million dollars worth of random tools.

410
00:40:27,860 --> 00:40:30,220
So, it truly does depend.

411
00:40:30,220 --> 00:40:32,600
But, you know, it's like everything else.

412
00:40:32,600 --> 00:40:40,120
Like, you have to make a business decision about it and essentially try to maximize every dollar and get the best value for that as much as possible.

413
00:40:43,040 --> 00:40:48,300
You know, and we've used the word a few times in this panel, telemetry.

414
00:40:49,100 --> 00:41:04,040
You know, so, from my perspective, one of the first things that I would want to do is, you know, is set all that up, is set up, you know, a central logging system, whether it's SIEM, whether it's, you know, something much simpler.

415
00:41:04,220 --> 00:41:10,480
But, you know, for me, doing incident response, you know, those are the keys, right?

416
00:41:10,480 --> 00:41:13,040
I mean, I've heard it said, you know, logs are everything.

417
00:41:14,360 --> 00:41:30,440
And that that would be one of your first steps would be to make sure that you, you know, you're gathering enough information so that, you know, when an incident happens and just in general, you know, having logs has so much value for IT support, for everything that we do in security.

418
00:41:31,060 --> 00:41:35,040
My approach to this is really, it's like a three-step.

419
00:41:35,040 --> 00:41:37,600
It's like a three-layer moniker.

420
00:41:38,880 --> 00:41:51,940
So, I think the first thing that it's important to grasp is that a program, we talk about a program, whether it's an IR program or a security program, large or blue team program, a program is business process.

421
00:41:51,940 --> 00:41:53,060
That's what a program is.

422
00:41:53,060 --> 00:41:54,180
It's not blinky boxes.

423
00:41:54,180 --> 00:41:56,920
It's not even the talent in your bullpen.

424
00:41:56,920 --> 00:41:59,320
It's documented process.

425
00:41:59,320 --> 00:42:01,720
That is the definition of your program.

426
00:42:01,920 --> 00:42:05,720
So, the first rule is if you're going to build a program, build a program.

427
00:42:05,720 --> 00:42:13,180
That means encourage your people to, and this kind of leads into the second thing, which is tribal knowledge is the enemy, right?

428
00:42:13,180 --> 00:42:20,440
So, like the first job of everybody on the team is to take everything in their head and inject it into business process.

429
00:42:20,580 --> 00:42:21,540
That is your job.

430
00:42:21,540 --> 00:42:29,300
It doesn't matter if you are, you know, the self-proclaimed bottom rung of the team or if you're the epic gangster rock star at the top.

431
00:42:29,360 --> 00:42:34,600
Your job is to take whatever is in your head that applies to the program and to build the program.

432
00:42:34,600 --> 00:42:41,060
And the more that you encourage people to do that and the more that you reward them for doing that, it's like a self-incentivizing loop, right?

433
00:42:41,360 --> 00:42:47,720
That's how you balance burnout and all this other stuff because it's not focused on one person or one tool.

434
00:42:48,260 --> 00:42:54,820
And then, like I said, the second thing is, and I feel like this is way more common on red teams than it is on blue teams, and I kind of don't know why.

435
00:42:54,820 --> 00:43:02,580
It is extremely common on the red side to not use tools that are touted as being the latest and greatest thing just because you don't know them, right?

436
00:43:02,580 --> 00:43:08,660
I mean, as a red teamer, I feel like there's this moniker that is accepted more and I feel like it's true on both sides.

437
00:43:08,660 --> 00:43:10,460
So, I kind of don't understand why it's a lopsided .

438
00:43:10,460 --> 00:43:12,780
We're like, you know, it's the old ninja moniker, right?

439
00:43:12,780 --> 00:43:14,900
We're like, not every ninja uses every weapon, right?

440
00:43:14,900 --> 00:43:19,460
You have your weapon and it's got your epic moves in it and you know it like the back of your hand.

441
00:43:19,460 --> 00:43:21,940
It's almost an extension of yourself and that's the point.

442
00:43:22,000 --> 00:43:24,460
I don't really think that's different on blue team.

443
00:43:24,460 --> 00:43:36,820
I mean, case in point, the team I'm part of at Stripe that kind of got built about a year and a half ago, we were all very new to the company and was, you know, granted we were very fortunate to have leadership with a lot of experience and so they reached out and you know,

444
00:43:36,820 --> 00:43:42,900
there's a lot, there's an extremely high amount of experience and talent on my team that's a little bit askew for most.

445
00:43:42,900 --> 00:43:49,580
I'm not saying that to brag, I'm just saying, you know, a lot of teams don't have that in their tool bin.

446
00:43:49,580 --> 00:43:53,220
But the first thing we did was take what EDR we had and rip it out.

447
00:43:53,260 --> 00:43:59,540
We ripped out almost everything and then built everything off of bare bones telemetry because those were the systems we could use better.

448
00:43:59,540 --> 00:44:02,040
That would, that yielded better to our kung fu.

449
00:44:02,040 --> 00:44:07,980
And then from there, the third thing is build, like tool your kung fu.

450
00:44:07,980 --> 00:44:18,720
You know, take your brain dump, put it into your program and then hypothetically start from scratch and go what tools do we need to do this, what's written better?

451
00:44:19,420 --> 00:44:22,380
Frankly, every deviation from that is a waste of time and money.

452
00:44:22,900 --> 00:44:28,880
So you said that you ripped out your EDR and you built up bare bones telemetry are the things that are most useful to you.

453
00:44:28,880 --> 00:44:30,700
Can you elaborate on what those are?

454
00:44:31,200 --> 00:44:33,840
I mean, it's literally just stuff that's built into the OS.

455
00:44:33,840 --> 00:44:40,960
I mean, we use OS query at scale so that because we use the fleet manager concept in order to kind of achieve orchestration goals.

456
00:44:40,960 --> 00:44:44,160
But our detection system is entirely homegrown.

457
00:44:44,160 --> 00:44:46,980
Our response system is entirely homegrown.

458
00:44:46,980 --> 00:44:51,420
Our orchestration elements and the way that we do log tracking is entirely homegrown.

459
00:44:51,420 --> 00:44:53,080
Even our pace reporting.

460
00:44:53,080 --> 00:44:58,540
I mean, we're kind of sort of bubbling around the hive right now, but it's honestly, it's all Jupyter notebooks and Python.

461
00:44:58,540 --> 00:45:02,060
It's all just kind of manual tooling.

462
00:45:02,180 --> 00:45:13,340
And at the end of the day, if I take that and I put that in the ROI bin, we spent way less on human time writing some Python than we would ever spend on third-party utilities.

463
00:45:13,340 --> 00:45:17,540
And to be honest, most of the third-party utilities are trash.

464
00:45:17,540 --> 00:45:30,720
I mean, I won't pull any out just because I don't want anybody to kind of, you know, have to be under the boot because I said something, but like, man, there's just so much money spent on these tools that just don't even do what they say on the side of the box.

465
00:45:30,720 --> 00:45:33,040
I just, I don't understand why that flies.

466
00:45:33,040 --> 00:45:35,000
And then that's just, you know, I don't know.

467
00:45:35,000 --> 00:45:38,860
Say what you will about red team or blue team infra, at least the red team stuff does what it says.

468
00:45:38,860 --> 00:45:40,000
It just doesn't say a lot.

469
00:45:40,000 --> 00:45:41,840
Blue team stuff, man, this seems to be a problem.

470
00:45:41,840 --> 00:45:44,340
Cereal box, nutrient banks are just wrong.

471
00:45:48,420 --> 00:45:52,160
So, Rubix, you've built an IR team, right?

472
00:45:52,160 --> 00:45:55,300
I'm curious, you know, your thoughts on all this.

473
00:45:56,220 --> 00:46:04,220
Yeah, you know, it was, I always go back to the, you know, kind of build it using the fireman analogy.

474
00:46:04,320 --> 00:46:12,740
So IR for, you know, a, you know, we're in financial services, there's a whole lot of downtime.

475
00:46:12,800 --> 00:46:30,780
And so figuring out how to practice and be ready for the big event and giving them enough work of a real, you know, I guess, you know, smaller level incidents to be able to stay busy and relevant, but then also, you know, plenty of time to prepare for,

476
00:46:30,780 --> 00:46:32,920
you know, bigger stuff.

477
00:46:32,920 --> 00:46:46,960
And so, you know, lots and lots of practices, you know, tabletops, drills, and, you know, encouraging our red team to really give us some good scenarios.

478
00:46:46,960 --> 00:47:07,700
And so I think that if you are, you know, not balancing that, you know, if your guys are all, or folks are always spending time, you know, doing, you know, we talk about being really busy, that they might not be honing their skills enough.

479
00:47:07,700 --> 00:47:14,920
And so, you know, finding that balance between, you know, doing and training and practicing was very key.

480
00:47:19,800 --> 00:47:27,700
I think the one thing I have to add to that, and everybody else has given really good advice here.

481
00:47:28,200 --> 00:47:34,020
And this is a part that I'm really passionate about, because it's one of the reasons that we lead companies.

482
00:47:34,180 --> 00:47:37,780
Don't silo your people and listen to what they have to say.

483
00:47:37,780 --> 00:47:42,720
If you have somebody on your team, it doesn't matter what notch in the chain they are.

484
00:47:42,800 --> 00:47:55,400
If you're calling on them for some kind of instant response, whether it be a SOC person, somebody who's doing sys admin work, someone who's a network admin, you're trusting them with that role.

485
00:47:56,060 --> 00:48:00,200
Trust them if they say they have a passion in response as well.

486
00:48:00,200 --> 00:48:10,600
Let them play in other fields, because there is not a silo in incident response for our attackers, so there really shouldn't be a silo for our responders.

487
00:48:11,000 --> 00:48:18,140
And one of the reasons that I work where I work is because there are some days where I'm not incident response.

488
00:48:18,140 --> 00:48:20,540
I have the freedom to do red team stuff.

489
00:48:20,540 --> 00:48:24,840
I have the freedom to help build our tools if I want to, or scripts.

490
00:48:25,260 --> 00:48:33,820
Some of the most brilliant scripts I've seen to date were built by my teammates in response to the Citrix vulnerability, for instance.

491
00:48:34,260 --> 00:48:43,060
So, you know, knowing where your strengths are on your team and building those, and then listening to them and what they say they need.

492
00:48:43,060 --> 00:49:05,460
Because, you know, if you're the one building, that assumes that you're at a higher level position, and I think that's really key, is to... my cats are wrecking the apartment right now, so if you hear anything bad, that's what I keep looking over for,

493
00:49:05,460 --> 00:49:07,900
is anytime I'm on one of these, they wreck something.

494
00:49:07,900 --> 00:49:15,980
So anyways, but listening to those people that you've hired, and obviously you trusted them enough in the first place to hire them.

495
00:49:15,980 --> 00:49:26,560
They're smart people, and we're smarter not because we know something, but because we know who to go to when we need certain knowledge.

496
00:49:26,560 --> 00:49:38,080
And I think leaning on your teammates, no matter what level they are in your company, having that kind of group decision is still important.

497
00:49:38,720 --> 00:49:58,680
Yeah, I think that's really great advice, you know, that more companies should heed, to try to cross-train their folks and give folks time for training and for research, right, and have budget for tools and devices, right, and lab time.

498
00:49:58,680 --> 00:50:01,100
I think it's really important.

499
00:50:02,420 --> 00:50:08,760
So I wanted to pivot and talk about ransomware.

500
00:50:08,780 --> 00:50:17,760
So we had a passionate discussion about this yesterday, and I'd like to try to rehash some of that for our attendees.

501
00:50:18,140 --> 00:50:29,040
And to kick it off, earlier today, the Blue Team Village Twitter, we posted a poll, and we were looking for people to give us their opinions.

502
00:50:29,280 --> 00:50:34,680
The poll question is, your organization is the victim of a ransomware attack.

503
00:50:34,680 --> 00:50:36,660
Should you pay the ransom?

504
00:50:36,980 --> 00:50:43,280
And about 89% of the responders said no, and about 11% said yes.

505
00:50:44,080 --> 00:50:50,260
I think, you know, in summary of our discussion yesterday is, it's not that simple.

506
00:50:50,400 --> 00:51:00,580
But, you know, for the benefit of everyone who wasn't in our private discussion yesterday, you know, what goes into the decision of paying the ransom or not?

507
00:51:00,580 --> 00:51:04,820
And I think Moose started first yesterday, if you want to go first again today.

508
00:51:06,220 --> 00:51:07,100
Sure.

509
00:51:07,680 --> 00:51:14,860
This is the most, like, let me tell you right now, this question made my blood pressure, like, go up a little bit.

510
00:51:14,860 --> 00:51:18,780
Because for me, when somebody says, do I pay the ransom?

511
00:51:19,100 --> 00:51:25,920
On any call I have, or even if I've been in person, I look at them and say, well, what does your legal team say?

512
00:51:25,920 --> 00:51:32,800
And that's still kind of my answer, is that I don't think you should make that decision for your business in a vacuum.

513
00:51:32,920 --> 00:51:43,400
And I usually recommend that people talk to either their internal counsel or have external counsel involved in that decision making process.

514
00:51:44,020 --> 00:51:47,680
And not necessarily make a decision for themselves.

515
00:51:48,540 --> 00:51:58,020
Because these are, if you look at it this way, the way I like to frame it, because I'm not going to say yes or no, spoiler alert, I'm not going to say yes or no, because it really does depend.

516
00:51:58,280 --> 00:52:01,380
And that's not my decision as a responder to make.

517
00:52:01,380 --> 00:52:07,120
But I think that the most intelligent things I've seen done was calling on experts who do this every day.

518
00:52:07,120 --> 00:52:11,660
Because if you think about who hit you, you're not their first hit.

519
00:52:12,000 --> 00:52:17,400
You're not the first people, they've probably ransomed, they've hit other companies.

520
00:52:17,560 --> 00:52:23,520
These are professional criminals that are going after you almost all the time, if they're exporting you for something.

521
00:52:23,840 --> 00:52:26,360
So get a professional to represent you.

522
00:52:26,360 --> 00:52:27,740
That's kind of my opinion.

523
00:52:27,740 --> 00:52:30,440
And I will preface that with that as well.

524
00:52:32,340 --> 00:52:33,500
Okay.

525
00:52:35,280 --> 00:52:42,800
Brian, you kind of immediately had a, you know, from the heart response that you then elaborated on.

526
00:52:42,800 --> 00:52:45,220
Could you share that with all of us?

527
00:52:45,260 --> 00:52:52,180
So as Brian Moran, human being, my first response is always no.

528
00:52:52,180 --> 00:53:00,640
However, that is simply me as a human being, because I don't feel that it's right to pay criminals for doing a crime.

529
00:53:00,860 --> 00:53:08,940
However, we'll preface all of that with put on the consultant hat, the business process hat and all of that.

530
00:53:08,940 --> 00:53:17,700
And honestly, the answer is more than likely, it's usually cheaper to pay the ransom than it is to deal with the cost of everything else involved.

531
00:53:17,700 --> 00:53:26,560
Like, it should never, just like it should never be anybody on the InfoSec team ever.

532
00:53:26,560 --> 00:53:28,260
It should never, ever be their call.

533
00:53:28,260 --> 00:53:31,500
It should be legal's call because legal absolutely needs to be involved.

534
00:53:31,500 --> 00:53:34,740
Not just from the perspective of, is this okay with the company?

535
00:53:34,740 --> 00:53:42,200
Also from this perspective of, you know, you're potentially looking at paying somebody in another country, like, are there sanctions against that country?

536
00:53:42,200 --> 00:53:46,500
Like right there, you could violate even more laws just by paying the ransom.

537
00:53:46,580 --> 00:53:59,140
So now you're in double because all your debt is gone and now you're getting sanctions and fines and investigations levied on you because you are literally, you know, potentially financing something that you shouldn't be financing.

538
00:53:59,240 --> 00:54:01,840
So it's not our call to make at the end of the day.

539
00:54:01,840 --> 00:54:07,420
Like, you know, we can respond and say, here's X, Y, and Z, here's our thought process.

540
00:54:07,420 --> 00:54:17,120
But generally from the overall business perspective, it's usually much cheaper just to pay the ransom and be done with it than to deal with any of the public scrutiny, deal with any of that.

541
00:54:17,120 --> 00:54:19,120
But, you know, we're not lawyers.

542
00:54:19,120 --> 00:54:22,460
I don't think any of us are even going to pretend ever to be a lawyer.

543
00:54:22,460 --> 00:54:26,740
Like, even if we say at a Holiday Inn Express, we are definitely not lawyers by any stretch of the bean.

544
00:54:26,740 --> 00:54:39,440
So we can have our opinion and we can give you thoughtful, evaluated opinions, but like our actual thoughts at the end of the day truly don't matter because it 100% decides on legal and what the course forward is from them.

545
00:54:40,640 --> 00:54:42,040
Yeah, thank you.

546
00:54:42,860 --> 00:54:50,520
You know, I think a lot of folks have that reaction of, no, you know, I don't want to pay criminals, but there is so much to the decision to be made.

547
00:54:50,920 --> 00:54:56,400
And Virus, you came at this from a different angle than I've ever really thought about it.

548
00:54:56,400 --> 00:55:04,220
And that angle was about ransoms and kidnappings and kind of relating ransomware to that type of crime.

549
00:55:04,220 --> 00:55:06,900
Could you, could you rehash that for everyone?

550
00:55:06,960 --> 00:55:17,660
So I basically distill everything that I tried to kind of get across in our joint meeting as ransomware is a crisis.

551
00:55:17,660 --> 00:55:19,520
The breach that put together is an incident.

552
00:55:19,980 --> 00:55:29,920
So if you have a flat out answer on whether or not you should pay the ransom when it comes to ransomware, you're doing it wrong because that's not how crisis management works.

553
00:55:31,220 --> 00:55:51,620
And I don't understand why as even an industry InfoSec would try to solve crisis management when every major Western power, every branch of every military and military contractor that's worth their salt, every political, you know, wing contractor, I mean,

554
00:55:51,620 --> 00:56:04,060
crisis management is a well understood science that has been researched by every tactical engagement and business risk school in the world forever.

555
00:56:04,240 --> 00:56:11,180
And the fact that the thing that's being ransomed is a piece of electronic capital versus human capital does not change the game.

556
00:56:11,180 --> 00:56:15,480
I just don't understand why people would insist on coming up with a pat answer for that.

557
00:56:15,480 --> 00:56:16,880
I think it's stupid.

558
00:56:16,880 --> 00:56:29,220
And while I think that, you know, the response to a ransomware crisis, because it is a crisis, will likely involve legal, I don't necessarily think that legal is the end all be all shop on that.

559
00:56:29,220 --> 00:56:30,680
It probably is at most shops.

560
00:56:30,680 --> 00:56:31,340
But you know what?

561
00:56:31,340 --> 00:56:32,980
The world is bigger than the law.

562
00:56:33,780 --> 00:56:45,240
You know, I could tell you all day long about, and all of you could too, about every major insert fortune 500 company here, where they have a crisis management team that has nothing to do with computers.

563
00:56:45,240 --> 00:56:52,760
And I guarantee you, the first stop they call when the CEO gets kidnapped by, you know, random activists in South America on a business trip is not the lawyer.

564
00:56:52,760 --> 00:56:53,960
They're like the third.

565
00:56:54,040 --> 00:56:57,320
So I don't know why it's different because it's a computer and not them.

566
00:56:57,360 --> 00:57:03,460
And then after you handle the crisis, however you handle it, maybe it's paying, maybe it's not, maybe it's using shadow currency.

567
00:57:03,460 --> 00:57:04,220
I don't know.

568
00:57:04,220 --> 00:57:04,820
Right?

569
00:57:04,820 --> 00:57:08,860
Then you handle the incident, which is if you have ransomware, you were breached.

570
00:57:08,860 --> 00:57:09,940
Don't handle that.

571
00:57:09,940 --> 00:57:11,120
That's your incident.

572
00:57:11,120 --> 00:57:12,880
The ransomware, that's not an incident.

573
00:57:12,880 --> 00:57:14,320
That's a crisis.

574
00:57:15,500 --> 00:57:31,840
With the shift of a lot of ransomware actors, for example, Maze, to not only just destroy anymore, but also, you know, steal the data, threaten to, you know, do more stuff with it than just destroy it.

575
00:57:32,360 --> 00:57:36,860
Has that changed your way of dealing with ransomware?

576
00:57:40,370 --> 00:57:42,750
It has in my advice.

577
00:57:42,850 --> 00:57:56,870
So I'll go ahead and speak to that in that I have given a little bit of advice, you know, working with a legal team, of course, if it makes sense for the company and with their backing.

578
00:57:57,030 --> 00:57:58,750
So all of that included.

579
00:57:58,750 --> 00:58:01,110
So assume that to from the get-go.

580
00:58:01,110 --> 00:58:09,190
But, you know, a lot of these groups that do extortion, they're saying that they have something and usually they'll serve up what they have.

581
00:58:09,770 --> 00:58:22,790
If there is at all 24 hours that you can buy your IR team to investigate if that claim is true or not, negotiate and buy the team time.

582
00:58:22,790 --> 00:58:43,810
If you can figure out if what they say was exposed is true, and if there's any more to that, so if they've gotten more than they say they have, take that time and lean on your investigations team to see that extra piece and see if you can see that creation and that within your system.

583
00:58:43,830 --> 00:58:56,230
And that's a very hard thing to do in a short amount of time, especially because it assumes that you have full visibility at every endpoint on the network of your company.

584
00:58:56,950 --> 00:59:05,010
And to have that kind of visibility to begin with is incredibly difficult for your team, let alone the outside team.

585
00:59:05,250 --> 00:59:18,230
So I would say that the good things that come out can come out of that, not that I'm for negotiating with jurists, so to speak, that are withholding your data and extorting you for money.

586
00:59:19,230 --> 00:59:33,810
But, you know, sometimes I've seen outside counsel get a lower price so that if you are going to pay, but time is valuable too, and having that on your side is important.

587
00:59:37,410 --> 00:59:49,410
Yeah, I think one of the things that is hugely important, but also at the same time incredibly underrated, is the way that ransomware works.

588
00:59:49,410 --> 00:59:50,770
Ransomware is a business.

589
00:59:50,930 --> 00:59:54,810
Just like any other business, ransomware at the end of the day is just a business.

590
00:59:54,810 --> 01:00:07,070
And I don't recall seeing personally, and I'm sure it's happened, but I don't recall a case personally where the actors have claimed to have something and they truly did not, that they were bluffing.

591
01:00:07,290 --> 01:00:13,130
Because if you're running a successful business, you're not going to lie about what you have and everything.

592
01:00:13,130 --> 01:00:15,150
Well, unless you're Enron and stuff like that.

593
01:00:15,150 --> 01:00:20,470
But for the most part, you're not going to actually not tell the truth about certain things.

594
01:00:20,590 --> 01:00:29,210
So if they claim that they exfil data and you as a company have no way to prove that, like number one, you're already in way worse problems than having ransomware.

595
01:00:29,210 --> 01:00:32,550
Like you have so many other problems that you need to deal with.

596
01:00:32,670 --> 01:00:38,950
But if they claim that they have something and they more than likely do, and then you have to evaluate the cost of all that.

597
01:00:38,950 --> 01:00:40,270
Well, what if that data goes public?

598
01:00:40,270 --> 01:00:42,850
What if that data goes even more publicly widespread?

599
01:00:42,850 --> 01:00:46,070
What if that data is then sold to other places and everything like that?

600
01:00:46,070 --> 01:00:49,310
And you have to take all of that into account with the entire process.

601
01:00:49,310 --> 01:00:56,990
And we often try to look at it much as a pure like, essentially, is there a correct answer?

602
01:00:56,990 --> 01:00:58,230
Or is there not a correct answer?

603
01:00:58,230 --> 01:00:58,910
Is it a yes?

604
01:00:58,910 --> 01:00:59,670
Or is it a no?

605
01:00:59,670 --> 01:01:02,410
And it's never just a yes or no.

606
01:01:02,410 --> 01:01:06,490
There are so many factors that you have to take into account all of that through it.

607
01:01:06,490 --> 01:01:12,830
And we in the information securities field, we only see a very small portion of all of that.

608
01:01:12,830 --> 01:01:16,610
So you have to involve other people, you have to involve other people in the process.

609
01:01:16,610 --> 01:01:27,450
But just like it was said, if you have ransomware, I guarantee you have at least five other problems besides just how ransomware got there.

610
01:01:27,450 --> 01:01:30,590
You have a lot of problems that need to be addressed.

611
01:01:30,590 --> 01:01:33,710
Ransomware is the big public facing thing on all of that.

612
01:01:33,710 --> 01:01:36,890
But there are so many problems that need to be addressed internally.

613
01:01:36,930 --> 01:01:44,490
And then you as the practitioner have to take into account, all right, here's my little take on the ransomware, here's all that.

614
01:01:44,490 --> 01:01:47,770
And then essentially, that decision goes to somebody else.

615
01:01:47,770 --> 01:01:53,190
But ransomware, I've never seen anywhere where like, oh, well, we got infected with ransomware.

616
01:01:53,190 --> 01:01:54,770
And that's the only problem that they have.

617
01:01:54,770 --> 01:01:57,410
There are many, many other gaping holes that they absolutely have.

618
01:01:57,410 --> 01:01:59,190
I can guarantee that.

619
01:02:00,110 --> 01:02:08,830
And on that note, unless somebody else wanted to say something else on ransomware virus, were you about to speak up?

620
01:02:08,870 --> 01:02:11,770
I was just going to answer Rubik's question.

621
01:02:11,770 --> 01:02:13,310
Yeah, go for it.

622
01:02:13,310 --> 01:02:19,870
If I understand the question correctly, it was in a nutshell does introducing extortion into the ransomware topic change the game?

623
01:02:20,210 --> 01:02:29,670
So my answer to that would be no, at least not for me, because I've already given my two cents on how I think that the orchestration of the conversation on ransomware is wrong.

624
01:02:30,890 --> 01:02:34,590
In terms of have I seen it change the game?

625
01:02:35,290 --> 01:02:36,750
I would say yes.

626
01:02:36,750 --> 01:02:42,730
And I would say the way that I think it is changing the game is that counterintelligence is a thing.

627
01:02:42,890 --> 01:02:43,890
Counterterrorism is a thing.

628
01:02:43,890 --> 01:02:45,930
Black on black kill squads are a thing.

629
01:02:45,970 --> 01:02:48,290
And they have always been a thing in blue team.

630
01:02:48,290 --> 01:02:50,570
They just haven't been very talked about.

631
01:02:50,950 --> 01:02:58,830
Because until words like hacking backs that are being introduced into the info set conversation, those were mostly gray areas to a lot of professionals.

632
01:02:58,850 --> 01:03:08,510
My experience is that the reintroduction, because I have seen it before, especially dealing with like adult fields, it's way more common than what I've seen in corporate space.

633
01:03:08,510 --> 01:03:10,770
And now I'm seeing it a lot more in the corporate space.

634
01:03:11,750 --> 01:03:16,110
I think those areas are getting a lot less gray.

635
01:03:16,110 --> 01:03:21,810
And they're showing up on the radar of a lot of risk teams, because they're starting to realize that that's how you fight this.

636
01:03:22,330 --> 01:03:26,990
But again, is my prescriptive advice that there should be more of that?

637
01:03:26,990 --> 01:03:30,510
No, that doesn't answer the question.

638
01:03:32,550 --> 01:03:33,130
Awesome.

639
01:03:33,130 --> 01:03:33,710
Thank you.

640
01:03:33,710 --> 01:03:35,730
Any other comments on ransomware?

641
01:03:37,510 --> 01:03:56,030
I will say that the other thing that I've seen is ransomware used to be kind of a singular program that executes and they've got this programmatic way of doing destruction, is that now when you hear of ransomware, it's a full-on incident.

642
01:03:56,030 --> 01:04:01,150
They have a number of backdoors, they have a number of accounts, right?

643
01:04:01,150 --> 01:04:10,550
You can't just go and contain it and say, we found ransomware on five machines, we've re-imaged those five machines, we're good.

644
01:04:10,710 --> 01:04:19,050
Now they're going to have spent some time in your environment, stolen accounts, have other ways of getting back in.

645
01:04:19,050 --> 01:04:26,390
And so you really have to do a full incident response, find out all the things that the attacker got.

646
01:04:26,390 --> 01:04:30,870
It's no longer a simple case like we used to deal with.

647
01:04:32,930 --> 01:04:47,450
The only other thing that I would add, this is the hill I die on, because I'm one of our, say, Linux enthusiasts, where I work, is most people associate ransomware with Windows.

648
01:04:48,010 --> 01:04:53,710
And while that's the case, that doesn't mean you should ignore your Linux environment and never assume.

649
01:04:53,710 --> 01:05:13,530
So make sure that you're building that up and you're looking at it, and don't ever assume that it's just, you know, if I have access to your environment and I'm a bad guy, if you give me an easy pivot point, why shouldn't I do good?

650
01:05:13,990 --> 01:05:17,510
So kind of have that in the back of your mind.

651
01:05:17,550 --> 01:05:22,230
And don't, like, go tunnel vision only on your Windows systems.

652
01:05:22,590 --> 01:05:24,890
And don't make it easier.

653
01:05:27,440 --> 01:05:29,440
Sorry, Virus, I didn't mean to.

654
01:05:30,800 --> 01:05:34,940
I just never heard anyone say that ransomware is a Windows thing.

655
01:05:34,940 --> 01:05:40,260
I'm like, there's been ransomware on mobile phone boot roms since, like, 2001.

656
01:05:40,260 --> 01:05:41,980
Who are these people?

657
01:05:41,980 --> 01:05:45,240
I hear it.

658
01:05:45,240 --> 01:05:45,940
I do.

659
01:05:45,940 --> 01:05:46,620
I hear it.

660
01:05:46,620 --> 01:05:53,200
I hear that this usually only hits Windows and look at the Windows environment and all that.

661
01:05:53,200 --> 01:05:55,860
And sometimes that's absolutely true.

662
01:05:55,860 --> 01:06:00,340
But you should be scanning for lateral movement to everything.

663
01:06:00,340 --> 01:06:01,140
Don't assume anything.

664
01:06:01,140 --> 01:06:01,820
What about Max?

665
01:06:01,820 --> 01:06:03,660
I thought Max were immune from viruses.

666
01:06:07,540 --> 01:06:08,080
Mainframe.

667
01:06:08,080 --> 01:06:09,740
Move everything to the mainframe.

668
01:06:09,740 --> 01:06:12,060
There's no mainframe viruses.

669
01:06:12,180 --> 01:06:12,840
Yeah.

670
01:06:13,060 --> 01:06:17,040
So we've already gone over time a little bit, but I think we have about 10 minutes left.

671
01:06:17,060 --> 01:06:26,640
And so I wanted to kind of reward the folks who have stuck around through all of this very, very serious conversation on incident response and try to end on a lighter note.

672
01:06:26,980 --> 01:06:40,040
And so I was going to ask each of you if you could share one good story about, like, one of the craziest things that you've seen, whether it was on a response or, you know, in some of your own actions, Varys.

673
01:06:40,040 --> 01:06:43,240
And I will remind you that this is being recorded.

674
01:06:46,040 --> 01:06:47,900
So who wants to go first?

675
01:06:51,640 --> 01:06:53,360
Anybody got one queued up?

676
01:06:54,120 --> 01:06:57,240
I have one kind of queued up a little bit.

677
01:06:57,240 --> 01:07:00,500
So this is actually a combination of two.

678
01:07:00,500 --> 01:07:04,440
So one is the worst thing that I've ever seen in an environment.

679
01:07:04,540 --> 01:07:14,400
The worst thing that I've ever seen in an environment was there's a firewall company, who is a very, very popular, very, very known firewall company.

680
01:07:14,940 --> 01:07:21,600
And for whatever reason, they somehow implemented all of these firewall rules that were okay.

681
01:07:21,600 --> 01:07:22,260
They weren't great.

682
01:07:22,260 --> 01:07:23,360
They were just okay.

683
01:07:23,360 --> 01:07:26,660
And then somebody put in a triple anti-firewall rule.

684
01:07:26,660 --> 01:07:29,020
Not a double, an actual triple any.

685
01:07:29,020 --> 01:07:30,400
So it was any, any, any.

686
01:07:30,640 --> 01:07:38,680
Come to find out from speaking with someone who will rename nameless, but is on this panel, that company actually allows you to have as many as five anys.

687
01:07:38,680 --> 01:07:47,580
So not only is there a problem with five anys, like even the option for you to be able to put that many anys in something, like, that doesn't make any sense.

688
01:07:47,580 --> 01:07:49,680
Like, what are they possibly thinking?

689
01:07:49,680 --> 01:07:55,000
Like, we're just going to make sure no matter what, that you can actually find some way through our firewall.

690
01:07:55,440 --> 01:08:00,500
So the hybrid of that is it was with the same client.

691
01:08:00,860 --> 01:08:09,260
It was kind of a cool story, because we had a chance to talk about it, I believe, last year in New Orleans, because the actual indictment came down.

692
01:08:09,360 --> 01:08:15,260
So they were a part of a breach that was essentially targeting the aerospace industry.

693
01:08:15,400 --> 01:08:17,740
And the attackers did all kinds of stuff.

694
01:08:17,740 --> 01:08:30,420
So we were able to actually go through essentially, like, their Gen 1 through Gen 5 of their malware, including, like, the last ditch absolute effort where it was incredibly sophisticated, because it was worth burning something that was amazing on it.

695
01:08:30,420 --> 01:08:33,540
And when I found out, like, that was just incredible.

696
01:08:33,540 --> 01:08:34,120
It was amazing.

697
01:08:34,120 --> 01:08:37,000
I actually did a little dance, because like, all right, now we found this.

698
01:08:37,000 --> 01:08:39,680
Now we have to find out how we're actually going to get rid of it.

699
01:08:39,740 --> 01:08:47,240
But the way that we're able to track back to exactly where it was is, again, because attackers are human beings, and they make mistakes.

700
01:08:47,240 --> 01:08:53,280
So for the most part, they bounce their IP through other countries, and everything was just fine.

701
01:08:53,280 --> 01:09:05,240
Except we had a total of 11 instances over the course of, I believe, it was a three-month period where they forgot, or they just made the connection before it actually made all the hops.

702
01:09:05,240 --> 01:09:17,580
And we had 11 times where we were actually able to pin down pretty much to the exact building in a certain company that rhymes with Rhina of exactly where the attacker was, exactly what they were doing, and exactly what they were after.

703
01:09:17,600 --> 01:09:25,340
And that was amazing, because we literally had gigabytes of logs of all this access in, and in, and in, and in.

704
01:09:25,340 --> 01:09:29,560
And then we happened to find, like, oh, well, here's this web shell that they had put in.

705
01:09:29,560 --> 01:09:32,160
The only person to access it was this person.

706
01:09:32,160 --> 01:09:33,360
We know that for sure.

707
01:09:33,360 --> 01:09:37,360
And 11 times, they just made a mistake, and we were able to pin down where they were.

708
01:09:37,360 --> 01:09:43,860
So it literally takes just one time of messing up, and like, okay, now we can actually build an investigation.

709
01:09:43,860 --> 01:09:46,580
And we turned all that over to law enforcement.

710
01:09:46,580 --> 01:09:53,760
And unfortunately, it took them about five years to actually go through the process, because they had so much stuff to investigate, primarily for our case.

711
01:09:53,760 --> 01:10:02,780
But it was also kind of disheartening to see, like, flash reports get put out that is essentially the summary of our report that we had written, and just has an agency logo at the top of it.

712
01:10:02,780 --> 01:10:04,660
Like, it's like, that's my stuff.

713
01:10:04,660 --> 01:10:06,640
Like, don't do that.

714
01:10:11,780 --> 01:10:12,580
All right.

715
01:10:12,580 --> 01:10:14,040
So who can go next?

716
01:10:15,520 --> 01:10:16,220
Oh, man.

717
01:10:16,220 --> 01:10:25,020
I guess I should follow, just because, Brian, at the time, I had told you, I saw five enemies on a firewall, and I was like, what in the hell?

718
01:10:25,600 --> 01:10:29,940
And it was like a horror for me, because I was just like, it was at the top, too.

719
01:10:30,040 --> 01:10:36,000
So if you think of how firewalls work, if you've ever done any kind of architecture on them, it's top-down.

720
01:10:36,580 --> 01:10:43,300
And it was five, and it's any source, any destination, any application, any user.

721
01:10:44,540 --> 01:10:46,960
And I don't know which one I left out.

722
01:10:49,060 --> 01:10:50,660
Location and service.

723
01:10:50,660 --> 01:10:54,040
There are actually six that can be set, and they set one as deny.

724
01:10:54,040 --> 01:10:58,140
And I didn't even know why they set one as deny, because I was just like, it basically just works.

725
01:10:58,140 --> 01:11:00,740
That's the answer I got, by the way, was it just works.

726
01:11:01,940 --> 01:11:05,340
But my worst story is actually recent.

727
01:11:05,780 --> 01:11:07,380
I have a lot of empathy.

728
01:11:07,380 --> 01:11:28,660
I see a lot of stuff in ransomware, but one of the coolest things that I've worked a couple of was not too long ago, there was a salt stack vulnerability that came out that allowed for, basically, the long story short is it allowed you to get root to anything that was exposed that was a salt master.

729
01:11:28,660 --> 01:11:36,020
So a salt is used, salt stack is used to manage and administer a Linux environment.

730
01:11:36,760 --> 01:11:38,480
And it's a really cool thing.

731
01:11:38,480 --> 01:11:42,100
I actually really like it for administration purposes.

732
01:11:42,620 --> 01:11:48,160
But there was a vulnerability, and if it wasn't patched, you could get root into anything that was internet exposed.

733
01:11:48,260 --> 01:11:51,220
And I just happened to see it in a couple of cases.

734
01:11:51,320 --> 01:12:00,820
I thought going into this, man, if I had root on something automatically that was internet exposed, what could I do?

735
01:12:00,820 --> 01:12:06,620
And I spent a long time looking at this environment, thinking I'm going to find something cool.

736
01:12:06,660 --> 01:12:13,900
We got in and they used it to spam mining bots everywhere using the minion service.

737
01:12:13,920 --> 01:12:16,400
And that was literally it.

738
01:12:16,400 --> 01:12:23,960
And so I want to tell that boring horror story because I live too for the cool, like, when am I going to find an Oday?

739
01:12:23,960 --> 01:12:24,740
And I've seen them.

740
01:12:24,740 --> 01:12:25,680
Don't get me wrong.

741
01:12:25,680 --> 01:12:30,900
I've seen some really cool stuff from APTs and some really cool tactics.

742
01:12:30,900 --> 01:12:39,560
I've seen people absolutely stomp out servers to where I have to go into unallocated space and get really creative about carving things out.

743
01:12:39,560 --> 01:12:50,940
But this one was one where I was going in going, I'm going to see like something absolutely crazy because you automatically had root access and you could do all of these things.

744
01:12:51,280 --> 01:12:52,460
And that was not the case.

745
01:12:52,460 --> 01:13:01,400
And I've seen so much of that over the course of doing IR where I'm just like, you know, you have this level and you worked at this level.

746
01:13:01,540 --> 01:13:11,000
And I think that's something to keep in mind just when you're doing these things is, you know, I was super happy to go back to the client and say, I have great news.

747
01:13:11,340 --> 01:13:13,800
All they did is run up your cloud build.

748
01:13:14,360 --> 01:13:22,680
But at the same time, like never assume anything because I was thinking like I'm going to boil the ocean and find something and I did and I didn't.

749
01:13:24,800 --> 01:13:40,920
In 2005, I was on a plane coming back from a job and a co-worker of mine is sitting next to me on the plane and we're talking about war stories and he tells me a war story from the week before, which is why he was late to the job that we were on.

750
01:13:41,000 --> 01:13:42,360
And I go, what did you do?

751
01:13:42,460 --> 01:13:48,500
And he goes, oh, I was doing IR on an old Windows XP network that was locked down by this government thing because it was a defense contractor.

752
01:13:48,720 --> 01:13:51,220
I'm like, oh, well, how'd the bug get in?

753
01:13:51,220 --> 01:13:56,620
It's like old Java bug, super like 265 day, right?

754
01:13:56,620 --> 01:13:58,920
Like old Java on Windows XP.

755
01:13:59,040 --> 01:14:00,120
What was the vector?

756
01:14:00,400 --> 01:14:01,200
Facebook.

757
01:14:01,380 --> 01:14:01,760
Yeah.

758
01:14:01,760 --> 01:14:05,380
Ops were on there, you know, running Facebook and click something got infected.

759
01:14:05,500 --> 01:14:06,400
Oh, that's interesting.

760
01:14:06,400 --> 01:14:07,960
Why did it take you a week to clean up?

761
01:14:08,000 --> 01:14:11,720
Well, didn't have a lot of ambient room on the operating system to install tools.

762
01:14:11,720 --> 01:14:12,440
Why?

763
01:14:12,440 --> 01:14:15,300
Well, it was a drone control station for a Predator 3.

764
01:14:20,000 --> 01:14:30,600
Yeah, I had a similar story to Moose about, you know, tracking down a, what we realized was a O -Day for a printer.

765
01:14:31,160 --> 01:14:48,020
And, you know, we thought for sure that this was a very advanced threat actor burning an O-Day for this situation and found out it was just to run a ware server off of our printers because they have so much storage.

766
01:14:48,020 --> 01:14:52,860
And so that, you know, again, yeah, really excited.

767
01:14:52,860 --> 01:14:53,160
All right.

768
01:14:53,160 --> 01:14:53,300
Yeah.

769
01:14:53,300 --> 01:14:57,060
This is going to be like going to make me famous, right?

770
01:14:57,060 --> 01:14:58,780
No, they're just running ware.

771
01:14:59,040 --> 01:15:05,720
So, but they somehow managed to get an O-Day and, you know, that was what they spent it on.

772
01:15:08,680 --> 01:15:09,340
Cool.

773
01:15:09,340 --> 01:15:23,600
Well, I certainly don't have any stories as exciting as those that the rest of you have shared in my somewhat boring career in InfoSec, not getting to go around and do incident response all over the place.

774
01:15:23,600 --> 01:15:38,880
But, you know, I just want to take the opportunity to thank all of you for accepting our invitations and coming here and sharing your experience and, you know, helping all the attendees, you know, who are here at the Blue Team Village to learn from you.

775
01:15:38,880 --> 01:15:40,560
I've learned a lot from you.

776
01:15:40,660 --> 01:15:54,460
I think this is, you know, this is such great, valuable information and getting, you know, a variety of people's perspectives, you know, to help us all, you know, learn new things and different ways to approach problems.

777
01:15:54,460 --> 01:15:55,320
It's awesome.

778
01:15:55,320 --> 01:15:57,680
I want to thank you so much for participating.

779
01:15:59,000 --> 01:16:07,920
And for the attendees who are here in the BTV Discord, we're going to move over to the voice talks chat.

780
01:16:08,280 --> 01:16:14,200
Anyone who's available, panelists who are available, pop over there and take some questions like hallway con.

781
01:16:16,240 --> 01:16:18,340
So I guess that's a wrap.

782
01:16:18,340 --> 01:16:19,400
Thanks, everyone.

783
01:16:21,320 --> 01:16:22,100
Thank you.

784
01:16:22,100 --> 01:16:22,520
Transcribed by https://otter.ai