1
00:00:01,400 --> 00:00:04,180
Can you guys hear me very well?

2
00:00:04,180 --> 00:00:07,020
Is there any kind of echo or background noise?

3
00:00:07,020 --> 00:00:08,500
Or is that just fine?

4
00:00:08,820 --> 00:00:11,040
Just give me a heart if it is okay.

5
00:00:12,520 --> 00:00:13,580
Okay, cool.

6
00:00:13,580 --> 00:00:14,840
Thank you.

7
00:00:18,140 --> 00:00:20,540
Once again, hello everyone.

8
00:00:20,740 --> 00:00:22,500
My name is Abhijit.

9
00:00:22,540 --> 00:00:26,580
And I am also known by the pseudonym ABX.

10
00:00:26,580 --> 00:00:32,580
I belong to Defcon Group Trivandrum, aka DC0471.

11
00:00:32,960 --> 00:00:36,000
I am very glad to be here today.

12
00:00:36,460 --> 00:00:39,020
It is a pleasure to be here.

13
00:00:39,020 --> 00:00:43,440
And I really appreciate the keynote of Jason.

14
00:00:43,440 --> 00:00:45,080
That was really wonderful.

15
00:00:45,080 --> 00:00:48,420
That was a really impressive keynote.

16
00:00:48,900 --> 00:00:55,760
And along with me, I have a couple of team members from Defcon Group Trivandrum today.

17
00:00:55,760 --> 00:01:08,720
We have my Defcon Trivandrum teammates, Aditya, Srihari, Taufik, Alex, Praveen, Vishnu, and Plucky, along with Alex.

18
00:01:08,720 --> 00:01:11,360
And we are all happy to be here.

19
00:01:11,360 --> 00:01:16,120
Once again, it is a privilege to be here in this village.

20
00:01:16,440 --> 00:01:18,060
Moving on to the next slide.

21
00:01:23,220 --> 00:01:25,100
Next slide, please.

22
00:01:38,460 --> 00:01:39,580
Give me a second, guys.

23
00:01:39,580 --> 00:01:40,340
Give me a second.

24
00:01:40,340 --> 00:01:44,340
Let me drop the mic here.

25
00:01:52,080 --> 00:01:53,280
One second.

26
00:02:16,030 --> 00:02:16,830
Sorry, guys.

27
00:02:16,830 --> 00:02:18,610
I am pretty new to this platform.

28
00:02:18,610 --> 00:02:19,650
Give me a second.

29
00:02:31,530 --> 00:02:33,690
Could you please help me with this mic?

30
00:02:33,690 --> 00:02:37,350
I just need to drop this mic and speak in loudspeaker.

31
00:02:37,350 --> 00:02:38,730
Could anyone help me, please?

32
00:02:39,150 --> 00:02:39,850
TX?

33
00:02:39,850 --> 00:02:45,770
You have to hold your left mouse button for a while and you can just throw the mic away.

34
00:02:46,130 --> 00:02:46,530
What?

35
00:02:46,530 --> 00:02:47,030
Left what?

36
00:02:47,030 --> 00:02:48,030
Left shift key?

37
00:02:48,070 --> 00:02:49,590
The mouse button, right?

38
00:02:49,790 --> 00:02:51,910
Yeah, the left mouse button.

39
00:02:52,410 --> 00:02:53,530
That's how you do it.

40
00:02:53,530 --> 00:02:54,190
Okay.

41
00:03:09,190 --> 00:03:09,970
Cool.

42
00:03:11,170 --> 00:03:13,630
Okay, sorry again for the trouble, guys.

43
00:03:14,270 --> 00:03:16,710
I am really new to this platform.

44
00:03:16,990 --> 00:03:19,870
Okay, once again, going back to the slide.

45
00:03:19,870 --> 00:03:24,210
We manage the Defcon Group Trivandrum, which is in India.

46
00:03:24,390 --> 00:03:30,970
Our location is Trivandrum, which is a very small city in India.

47
00:03:31,550 --> 00:03:38,130
So, we have started our Defcon Group in January 2018.

48
00:03:38,590 --> 00:03:47,670
We have organized a couple of hacker meetups and conferences during the past events with multiple tracks and CTFs.

49
00:03:47,670 --> 00:03:52,770
We have more than 15 organizing team members, which are hardcore team members.

50
00:03:52,770 --> 00:03:57,570
This is like a brotherhood for me and everyone in my group.

51
00:03:58,850 --> 00:04:05,930
We are also hosting a hacking podcast in Malayalam language, which is our native language.

52
00:04:05,930 --> 00:04:09,130
You could view that URL in there.

53
00:04:09,210 --> 00:04:13,730
It is kind of interviewing local hackers and cybersecurity professionals.

54
00:04:13,730 --> 00:04:17,410
We also connect regularly.

55
00:04:39,370 --> 00:04:41,630
Move to the next slide, please.

56
00:04:45,180 --> 00:04:49,580
Here are some of the photos of some of our events.

57
00:04:49,580 --> 00:04:55,480
We had the opportunity to have a good set of speakers in our previous meetups.

58
00:04:57,720 --> 00:05:02,460
I think that is it about our Defcon Group Trivandrum.

59
00:05:02,460 --> 00:05:06,400
I think we can go to the technical presentation now.

60
00:05:06,880 --> 00:05:08,460
Please move to the next slide.

61
00:05:16,800 --> 00:05:23,320
As you can see, the title of my talk would be building an internal Red Team for your organization.

62
00:05:23,320 --> 00:05:29,220
It is like building a practical Red Team within your organization.

63
00:05:33,050 --> 00:05:34,630
Next slide, please.

64
00:05:34,630 --> 00:05:41,890
As I have mentioned, my name is Abhijit.

65
00:05:42,630 --> 00:05:48,570
And I'm also known by the pseudonym ABX.

66
00:05:48,750 --> 00:05:53,990
I'm leading OpenSea security operations in a global financial technology company.

67
00:05:54,310 --> 00:05:59,550
I'm also the former deputy manager for cybersecurity in Nissan Motors.

68
00:05:59,930 --> 00:06:04,050
Prior to that, I used to work for EY as a senior security analyst.

69
00:06:04,050 --> 00:06:09,210
I have nearly 10 years of experience in the security domain.

70
00:06:09,290 --> 00:06:14,950
I'm also the founder of a community called teamvillage.org.

71
00:06:14,950 --> 00:06:18,870
And no, it is not associated with Defcon Villages.

72
00:06:19,130 --> 00:06:24,230
Like I mentioned earlier, I'm also the leader of the Defcon Trivandrum community.

73
00:06:24,230 --> 00:06:34,030
Recently, I started running a blog called tacticaladversary.io, which is a blog dedicated to adversarial simulation and Red Teaming tactics.

74
00:06:34,170 --> 00:06:35,810
It is still a work in progress.

75
00:06:35,810 --> 00:06:39,270
I'm still working on it, you know, just to get things started.

76
00:06:40,190 --> 00:06:42,030
Moving to the next slide.

77
00:06:44,780 --> 00:06:47,740
Let's make some things clear first.

78
00:06:47,740 --> 00:06:53,900
I don't really want to, you know, do an intro about vulnerability assessment, pen test or Red Teaming.

79
00:06:53,900 --> 00:07:00,820
But I just want to make some statements before we go further into the slides.

80
00:07:01,320 --> 00:07:03,340
Moving on to the next slide.

81
00:07:09,230 --> 00:07:11,390
This is just a statement.

82
00:07:11,570 --> 00:07:13,130
I think you can see the slide.

83
00:07:13,130 --> 00:07:13,830
Yeah, yeah.

84
00:07:13,830 --> 00:07:15,510
This is just a statement.

85
00:07:15,590 --> 00:07:18,450
Vulnerability assessment, it is not Red Teaming.

86
00:07:19,890 --> 00:07:26,270
Like, you know, also vulnerability assessment, it is not penetration testing as well.

87
00:07:26,270 --> 00:07:29,890
So we all know, like, what is vulnerability assessment.

88
00:07:29,930 --> 00:07:40,030
It is about targeting a system, an application or a network just to identify the list of vulnerabilities.

89
00:07:40,030 --> 00:07:43,530
Like, you know, what are the known weaknesses in that system?

90
00:07:43,530 --> 00:07:53,130
List them down along with the remediation plan and hand it over to the appropriate teams so that they can get it fixed.

91
00:07:53,130 --> 00:07:54,970
So that is called vulnerability assessment.

92
00:07:54,970 --> 00:07:56,610
It is not Red Teaming.

93
00:07:56,870 --> 00:07:58,950
I will go to the next slide.

94
00:08:00,250 --> 00:08:04,510
Again, penetration testing, it is also not Red Teaming.

95
00:08:05,830 --> 00:08:13,370
But pen testing, on the other hand, compared to VA, it is more focused towards the goal.

96
00:08:17,250 --> 00:08:19,650
Maybe... could you please go to the next slide?

97
00:08:19,690 --> 00:08:20,150
Oh, OK.

98
00:08:20,150 --> 00:08:20,770
This is fine.

99
00:08:20,770 --> 00:08:21,310
This is fine.

100
00:08:21,310 --> 00:08:22,370
OK.

101
00:08:22,970 --> 00:08:26,190
Maybe we are targeting an application or infrastructure.

102
00:08:26,190 --> 00:08:31,250
Our only goal would be compromising that system and get into it.

103
00:08:31,670 --> 00:08:36,790
The pen testing report also reflects the same, rather than listing all vulnerabilities.

104
00:08:37,630 --> 00:08:39,550
We are facing a problem now, right?

105
00:08:39,550 --> 00:08:45,510
You know, nowadays we cannot differentiate between vulnerability assessment and pen testing reports.

106
00:08:45,510 --> 00:08:56,130
A pen testing report may list all vulnerabilities in the target system instead of the exportation and how the attacker got into the system.

107
00:08:57,770 --> 00:09:03,630
For my day job, I used to see external pen testing reports with SSL issues only.

108
00:09:03,630 --> 00:09:04,650
Just imagine that.

109
00:09:04,650 --> 00:09:05,810
Just think about it.

110
00:09:05,810 --> 00:09:15,350
I used to see penetration testing reports from external vendors which are having SSL issues in a pen testing report.

111
00:09:15,350 --> 00:09:16,830
That is really weird.

112
00:09:17,950 --> 00:09:19,950
It is kind of confusing now, you know.

113
00:09:19,950 --> 00:09:22,950
If anyone here is also feeling the same, just let me know.

114
00:09:22,950 --> 00:09:27,090
Like, you know, the confusion between the vulnerability assessment and pen testing.

115
00:09:27,090 --> 00:09:30,210
We are seeing it in our day-to-day life, you know.

116
00:09:30,210 --> 00:09:35,870
These vendors, these professionals, they are giving us the VA and pen testing reports, you know.

117
00:09:36,250 --> 00:09:38,610
It is kind of very confusing.

118
00:09:39,410 --> 00:09:41,670
We are not blind here, but

119
00:09:47,840 --> 00:09:50,460
I am getting muted sometimes.

120
00:09:50,460 --> 00:09:51,460
I don't know why.

121
00:09:53,860 --> 00:09:59,820
Okay, as the last statement, I also want to mention that pen testing is not routine.

122
00:10:00,260 --> 00:10:03,660
I'll come to this point later, later in the presentation.

123
00:10:04,600 --> 00:10:07,980
Can we go to the next slide?

124
00:10:16,120 --> 00:10:17,180
Okay.

125
00:10:17,180 --> 00:10:23,580
So, like, you know, most of us know the meaning of RETeam or what is RETeam, right?

126
00:10:24,020 --> 00:10:28,000
We have a cool definition from RETeams.net here.

127
00:10:28,540 --> 00:10:37,280
Historically, RETeam, the term RETeam, it originates from the military terms which would be imitating the role of adversaries.

128
00:10:37,420 --> 00:10:41,320
They will try to mimic the attacks against the military base.

129
00:10:41,660 --> 00:10:42,020
That

130
00:10:45,500 --> 00:10:48,880
is the explanation about RETeaming.

131
00:10:48,920 --> 00:10:50,640
Could you please go to the next slide?

132
00:10:50,640 --> 00:10:54,720
We have a much simpler explanation in here.

133
00:10:54,780 --> 00:10:59,600
This is a much simpler and easy to use explanation.

134
00:11:01,770 --> 00:11:05,280
This is also from RETeams.net.

135
00:11:05,930 --> 00:11:14,190
A RETeam is a group of highly skilled people that continuously challenge the plans, defensive measures, and security concepts.

136
00:11:14,190 --> 00:11:16,650
That is pretty clear, right?

137
00:11:16,650 --> 00:11:20,110
This is actually called adversarial attack simulation.

138
00:11:20,110 --> 00:11:22,370
That is what we are doing nowadays.

139
00:11:22,630 --> 00:11:25,190
I will come to the next slide.

140
00:11:28,730 --> 00:11:30,520
Is it the next slide yet?

141
00:11:31,250 --> 00:11:32,610
Yes, it is.

142
00:11:34,070 --> 00:11:37,010
Let me talk about a confusion here.

143
00:11:42,270 --> 00:11:50,330
I have seen these comments with the sales people and usually the security services executives.

144
00:11:50,330 --> 00:11:52,470
I am not mocking anyone here.

145
00:11:52,470 --> 00:11:57,810
It is also very sad that many people are seeing RETeams as penetration testers.

146
00:11:57,810 --> 00:12:00,970
They will be saying, like, you know, I am a part of internal RETeam.

147
00:12:01,050 --> 00:12:03,630
But I will ask, like, what are you doing then?

148
00:12:03,630 --> 00:12:05,750
I am doing penetration testing.

149
00:12:05,750 --> 00:12:08,190
I am doing web application penetration testing.

150
00:12:08,190 --> 00:12:11,890
I am doing application security.

151
00:12:11,890 --> 00:12:14,010
But I am a part of internal RETeam.

152
00:12:14,010 --> 00:12:16,510
But it is kind of confusing.

153
00:12:16,510 --> 00:12:21,770
It is also very sad that, you know, these people are seeing RETeams as penetration testers.

154
00:12:22,330 --> 00:12:34,690
To explain the actual job, along with the RETeam professional, I mean, along with the RETeam professional, many security folks are nowadays using the term adversarial attack simulation as well.

155
00:12:39,910 --> 00:12:44,190
I have recently seen a couple of similar job titles in LinkedIn.

156
00:12:44,190 --> 00:12:52,710
Instead of mentioning a RETeam professional, they are listing their profile as adversarial attack simulation professional.

157
00:12:52,710 --> 00:12:57,870
Or , you know, like operator as adversarial attack simulation.

158
00:12:57,870 --> 00:12:58,630
Something like that.

159
00:12:58,630 --> 00:13:03,190
Just to be more clear, other than, you know, confusing, using confusing terms.

160
00:13:04,890 --> 00:13:06,570
Next slide, please.

161
00:13:13,490 --> 00:13:15,910
So, everyone, how is this picture?

162
00:13:15,910 --> 00:13:17,070
Do you like this picture?

163
00:13:18,530 --> 00:13:22,790
Could you guys please give me hearts or claps if you like this picture?

164
00:13:23,430 --> 00:13:26,570
I am not getting hearts from everyone, I think.

165
00:13:27,850 --> 00:13:29,270
Yeah, now I do.

166
00:13:29,270 --> 00:13:33,330
Actually, you know, I really wanted to show off this picture.

167
00:13:33,330 --> 00:13:37,930
You know, the perfect symphony between the attackers and the defenders.

168
00:13:38,690 --> 00:13:46,090
It was created based on the native Kerala martial art, which is called Kalaripayattu.

169
00:13:46,090 --> 00:13:50,510
That is the traditional martial art form of our native place.

170
00:13:50,710 --> 00:13:53,730
So, based on that, we created this picture.

171
00:13:54,450 --> 00:14:03,150
You know, it was designed for a CTF competition at a conference called COCON, which is one of the biggest cyber security conference in India.

172
00:14:03,310 --> 00:14:06,430
So, I really wanted to show you guys this picture.

173
00:14:06,910 --> 00:14:09,510
I think you guys really like it, right?

174
00:14:09,510 --> 00:14:15,870
You know, the actual symphony between RETeams and Blue Teams, based on our native martial art form.

175
00:14:16,090 --> 00:14:18,150
That was kind of a show off.

176
00:14:18,150 --> 00:14:19,090
Thank you.

177
00:14:19,810 --> 00:14:22,370
Moving on to the next slide.

178
00:14:26,850 --> 00:14:35,050
So, most of the things mentioned here, that is from my own experience, are the awesome contributors of the security community.

179
00:14:35,510 --> 00:14:43,910
Most of the companies, they already have their own application security and internal pen testing teams.

180
00:14:43,910 --> 00:14:51,810
So, what if they want to move a more matured attack simulation activities?

181
00:14:51,810 --> 00:15:03,250
You know, they are doing fine with AppSec and internal pen test, but they also want to move into a more matured attack simulation team.

182
00:15:03,250 --> 00:15:14,570
So, I really think this talk will be helpful for such people who want to build an offensive internal team for adversarial attack simulation.

183
00:15:14,670 --> 00:15:17,910
We are targeting that kind of audience here.

184
00:15:17,910 --> 00:15:19,870
I mean, the target audience.

185
00:15:24,280 --> 00:15:26,080
Next slide, please.

186
00:15:32,790 --> 00:15:36,470
Okay, I think you can see this picture.

187
00:15:36,470 --> 00:15:42,770
So, we have created this diagram for one of our assignments.

188
00:15:43,150 --> 00:15:45,590
Internal Red Team Operations Framework.

189
00:15:45,590 --> 00:15:47,450
That is still a work in progress.

190
00:15:47,450 --> 00:15:49,250
We are still working on this.

191
00:15:50,150 --> 00:15:53,810
We have split it into five different phases.

192
00:15:53,870 --> 00:15:57,730
Internal Red Team Operations Framework into five different phases.

193
00:15:57,990 --> 00:16:05,190
Each framework will be having its own models and its own concepts.

194
00:16:05,190 --> 00:16:14,810
So, based on that, we can start from the scratch and get into more mature level Red Teams, Internal Red Teams.

195
00:16:14,950 --> 00:16:18,610
We can go into each of these phases individually.

196
00:16:20,570 --> 00:16:22,330
Next slide, please.

197
00:16:27,970 --> 00:16:29,170
Okay.

198
00:16:30,330 --> 00:16:35,990
So, this is the very first phase of IRTO, which is Internal Red Team Operations.

199
00:16:35,990 --> 00:16:38,910
It's like building from the scratch.

200
00:16:39,290 --> 00:16:42,350
We need to get our budget approved.

201
00:16:42,370 --> 00:16:46,250
We really need to defend the practical goals and objectives.

202
00:16:48,210 --> 00:16:52,690
It's like you should ask yourself, why are we creating this team?

203
00:16:52,690 --> 00:16:57,950
What is the need of an Internal Red Team in my organization?

204
00:16:57,950 --> 00:17:01,050
Now , there should be a hard question.

205
00:17:12,120 --> 00:17:17,290
Each organization has its own different set of crown jewels.

206
00:17:17,590 --> 00:17:20,850
It is their sensitive data or assets.

207
00:17:34,120 --> 00:17:37,880
The crown jewels of our organization.

208
00:17:37,880 --> 00:17:41,200
Not only crown jewels, also people.

209
00:17:41,200 --> 00:17:50,900
For example, it is always about the critical assets or critical people within an organization.

210
00:17:50,900 --> 00:18:03,060
For example, if there is a company which is doing manufacturing, for them, it is their formula architects and all the stuff.

211
00:18:03,060 --> 00:18:05,380
They have to keep it very safe.

212
00:18:05,380 --> 00:18:14,560
So, considering that, each organization has its own valuable assets, its own data set, its own data centers.

213
00:18:14,560 --> 00:18:19,080
So, we need to identify the crown jewels of our organization.

214
00:18:19,080 --> 00:18:26,500
We need to create rules of engagement and we need to get assistance from the management and legal department.

215
00:18:26,640 --> 00:18:33,900
And more importantly, before moving forward, we need to understand the security posture of our organization.

216
00:18:33,900 --> 00:18:41,760
What are the security countermeasures or what are the security implementations which are there for an organization.

217
00:18:41,760 --> 00:18:47,680
So, that is very essential to understand before we move forward.

218
00:18:48,080 --> 00:18:54,200
And, like I mentioned, identify the crown jewels and people.

219
00:18:54,200 --> 00:18:55,660
There is one more thing.

220
00:18:55,660 --> 00:18:57,960
People are always important.

221
00:18:57,960 --> 00:19:09,040
For example, you know that there are many high-level executives out there, high-level management people are out there.

222
00:19:09,080 --> 00:19:12,500
They are always vulnerable to phishing attacks.

223
00:19:12,500 --> 00:19:14,080
I will tell you why.

224
00:19:14,140 --> 00:19:20,320
Usually, being technical people, we don't have the urge to open our email all the time.

225
00:19:20,320 --> 00:19:30,100
But, being business consultants or being business executives, they always have the kind of an issue to open and respond to their emails.

226
00:19:30,500 --> 00:19:34,620
So, they will always fall for a targeted phishing campaign.

227
00:19:34,620 --> 00:19:39,720
That is kind of the key thing here.

228
00:19:39,860 --> 00:19:46,340
So, along with the sensitive data, we also need to identify what are the key people to my organization.

229
00:19:46,340 --> 00:19:50,740
What if someone has compromised their personal account?

230
00:19:50,740 --> 00:19:52,960
What will happen to the organization?

231
00:19:53,080 --> 00:19:53,900
So , this can be

232
00:20:02,380 --> 00:20:07,660
a challenge for people who are looking to build their team.

233
00:20:08,300 --> 00:20:10,380
Moving on to the next slide.

234
00:20:18,200 --> 00:20:20,160
Next slide is here, right?

235
00:20:20,160 --> 00:20:21,060
Okay.

236
00:20:21,600 --> 00:20:22,720
How many of you know

237
00:20:26,680 --> 00:20:34,380
about this A-Team?

238
00:20:34,980 --> 00:20:35,840
Three?

239
00:20:36,640 --> 00:20:37,480
Four?

240
00:20:37,480 --> 00:20:38,200
Okay.

241
00:20:38,200 --> 00:20:45,320
So, recently in 2010 or 2012, there was a movie acted by Bradley Cooper.

242
00:20:45,820 --> 00:20:46,740
Okay.

243
00:20:47,260 --> 00:20:49,440
So, the A-Team.

244
00:20:49,440 --> 00:20:51,520
The team and skill set.

245
00:20:56,450 --> 00:20:59,610
This is how, for example, just consider the A-Team.

246
00:20:59,610 --> 00:21:02,010
This is how a team should be.

247
00:21:02,150 --> 00:21:05,190
Like, the team must be diverse.

248
00:21:07,350 --> 00:21:10,450
This is not an one-man job.

249
00:21:10,850 --> 00:21:16,050
They'll have to work together as a team or work solo sometimes.

250
00:21:16,050 --> 00:21:21,230
Also, they'll have to work under an excessive amount of pressure.

251
00:21:21,770 --> 00:21:25,070
They should be able to handle that pressure.

252
00:21:25,070 --> 00:21:27,210
It is really important.

253
00:21:27,410 --> 00:21:31,090
For example, we know that Colonel Hannibal, right?

254
00:21:31,250 --> 00:21:34,490
He's also the leader of A-Team.

255
00:21:34,490 --> 00:21:37,170
And sometimes, he's a solo player.

256
00:21:40,910 --> 00:21:46,950
And the A-Team, they're strong individually and stronger as a team.

257
00:21:46,950 --> 00:21:49,630
That is an important thing to have.

258
00:21:49,630 --> 00:21:51,550
You need to handle things personally.

259
00:21:51,550 --> 00:21:53,990
And you need to handle things alone.

260
00:21:53,990 --> 00:21:56,490
And you need to handle things as a team.

261
00:21:56,490 --> 00:21:59,590
That should be a skill set.

262
00:22:02,070 --> 00:22:05,410
So, the team should also contain non-technical people.

263
00:22:05,410 --> 00:22:07,090
We talked about technical people, right?

264
00:22:07,090 --> 00:22:18,370
We talked that in order to build a red team, we need highly technical people in different areas of attack simulation and offensive security operations.

265
00:22:18,370 --> 00:22:23,450
But along with that, the team should also contain non-technical people.

266
00:22:24,410 --> 00:22:31,230
So, how many of you here have ever created a phishing campaign against any kind of organization?

267
00:22:34,410 --> 00:22:36,110
Give me some hearts.

268
00:22:36,110 --> 00:22:38,970
How many of you have hosted a phishing campaign?

269
00:22:39,370 --> 00:22:42,330
Yeah, I am seeing a couple of hearts in there.

270
00:22:42,330 --> 00:22:44,010
So, let me ask you a question.

271
00:22:44,010 --> 00:22:58,250
So, usually, the technical guys in your team or very people-managed and friendly guys, who are usually writing the phishing emails?

272
00:22:58,250 --> 00:23:04,470
The technical guy or more friendly HR-like persons?

273
00:23:04,690 --> 00:23:07,290
Who is creating the phishing emails for you?

274
00:23:08,210 --> 00:23:09,110
Guys, you can...

275
00:23:09,110 --> 00:23:11,230
If it is you, then you can give me a heart.

276
00:23:11,310 --> 00:23:13,990
Otherwise, you can just give me a palm or something.

277
00:23:16,890 --> 00:23:18,870
I am not seeing anything.

278
00:23:23,620 --> 00:23:26,080
Okay, I can see a couple of guys.

279
00:23:26,080 --> 00:23:31,700
They are saying that they do write their own phishing campaign emails.

280
00:23:31,700 --> 00:23:33,320
So, I will tell you something.

281
00:23:33,600 --> 00:23:41,540
Just imagine, a hardcore technical guy is writing a phishing email to someone like a business executive.

282
00:23:41,820 --> 00:23:47,040
For example, if I am writing a phishing email, that will be more technical.

283
00:23:47,040 --> 00:23:52,460
There will be these technical jaggons and there will be a lot of technical ways.

284
00:23:52,460 --> 00:23:54,020
We don't want that, right?

285
00:23:54,020 --> 00:24:05,820
So, if there is a non-technical guy or a business guy or a human resources person in our team, we can ask them to write the phishing email for us.

286
00:24:06,800 --> 00:24:08,000
The meaning...

287
00:24:08,000 --> 00:24:12,780
They can connect with people compared to the technical guys.

288
00:24:12,880 --> 00:24:15,540
They are more friendly guys.

289
00:24:15,540 --> 00:24:20,440
They are more into human resources and they can connect with other people pretty easily.

290
00:24:20,440 --> 00:24:22,860
They speak a different language.

291
00:24:22,860 --> 00:24:27,780
So, it is always better to have non-technical people in our offensive team.

292
00:24:27,780 --> 00:24:29,200
It always helps.

293
00:24:30,440 --> 00:24:32,360
Could you please go to the next slide?

294
00:24:41,640 --> 00:24:43,320
Yeah, we have the next slide.

295
00:24:44,080 --> 00:24:50,660
So, this is the phase 2 of iHeartLaw, like internal team operations.

296
00:24:54,660 --> 00:24:56,320
So, a couple of points here.

297
00:24:56,340 --> 00:24:58,520
A couple of steps here.

298
00:24:59,100 --> 00:25:00,500
So, external infrastructure.

299
00:25:00,500 --> 00:25:04,360
It is always essential to mimic an adversary's actions.

300
00:25:04,360 --> 00:25:07,360
So, we need to build an external Red Team infrastructure.

301
00:25:07,880 --> 00:25:14,400
For the beginning, start with open source C tools, implants, frameworks, and other tools.

302
00:25:14,460 --> 00:25:18,560
We can modify it based on your requirements.

303
00:25:19,300 --> 00:25:21,320
Also, be friends.

304
00:25:23,380 --> 00:25:25,300
Okay, the third point.

305
00:25:25,300 --> 00:25:28,420
Identifying the business-specific risk.

306
00:25:28,420 --> 00:25:40,020
So, being in an internal Red Team is all about your organization and your organization's security posture, and deployed defense mechanisms, etc.

307
00:25:40,020 --> 00:25:47,180
So, it is a key point to identify the business-specific risk.

308
00:25:47,180 --> 00:25:52,040
It can vary based on the businesses and based on organizations.

309
00:25:52,760 --> 00:25:55,460
And the fourth point.

310
00:25:56,000 --> 00:25:59,720
Always be friends with the organization's Blue Team.

311
00:25:59,720 --> 00:26:03,440
If you have a Blue Team in your company, be friends with them.

312
00:26:03,440 --> 00:26:07,660
Just try to understand what they are doing in their daily lives.

313
00:26:07,660 --> 00:26:13,460
What are the tools and techniques which they are using for detecting the attackers.

314
00:26:13,460 --> 00:26:25,360
It is always good to be in a good relationship with your company's cyber defense system or cyber defense team.

315
00:26:26,400 --> 00:26:33,600
All of your organizational activities are there to make the Blue Team much stronger.

316
00:26:33,600 --> 00:26:39,340
So, it is very essential to have a good relationship with your cyber defense team.

317
00:26:41,080 --> 00:26:42,360
Okay.

318
00:26:42,700 --> 00:26:46,060
Also, don't take it personally.

319
00:26:46,120 --> 00:26:50,680
I just asked you to be friends with your organization's Blue Team.

320
00:26:50,680 --> 00:26:59,680
Once I tried to be friends with an organization's Blue Team, and in the end, she became my girlfriend.

321
00:26:59,680 --> 00:27:01,280
That's a long story.

322
00:27:01,280 --> 00:27:03,700
So, always don't try so hard.

323
00:27:03,700 --> 00:27:08,240
Just formally be friends with the Blue Team of your organization.

324
00:27:08,240 --> 00:27:10,260
Don't take it personally.

325
00:27:10,480 --> 00:27:12,480
Just a personal advice.

326
00:27:17,580 --> 00:27:18,560
Okay.

327
00:27:18,560 --> 00:27:20,420
Moving on to the next slide.

328
00:27:21,920 --> 00:27:23,420
Phase 3.

329
00:27:26,200 --> 00:27:28,800
Could you please go to the Phase 3 slide?

330
00:27:28,800 --> 00:27:30,080
Okay, Phase 3.

331
00:27:32,220 --> 00:27:37,140
Actually, this is where we begin to work in our plan.

332
00:27:37,140 --> 00:27:40,620
You can see, this is Phase 3 where we start working.

333
00:27:40,620 --> 00:27:43,840
So, we can use improved tools, techniques, and procedures.

334
00:27:44,800 --> 00:27:48,400
And we know about the current security mechanisms, right?

335
00:27:48,400 --> 00:27:53,460
We talked about current security mechanisms in Phase 1 and Phase 2.

336
00:27:53,980 --> 00:27:58,500
For example, the need of using improved TTPs.

337
00:27:58,700 --> 00:28:04,920
For example, what if your organization is not allowing PowerShell or any other scripts?

338
00:28:05,520 --> 00:28:08,840
That is where we need to improve our TTPs, right?

339
00:28:08,840 --> 00:28:16,860
Initially, we identified that the current organization, they do not allow PowerShell scripts or any other scripts, Wscripts, Cscripts, anything.

340
00:28:16,860 --> 00:28:18,420
They are not allowing anything.

341
00:28:18,660 --> 00:28:26,220
So, in that case, we need to make some changes in our techniques and improvise.

342
00:28:26,320 --> 00:28:29,940
We should find the next feasible option.

343
00:28:30,660 --> 00:28:41,630
For example, in this case, we can try running unmanaged PowerShell.

344
00:28:41,650 --> 00:28:49,790
Maybe the different systems, they are not considering unmanaged PowerShell executables as malicious.

345
00:28:49,890 --> 00:28:54,950
So, sometimes we can bypass the different mechanisms in there.

346
00:29:01,940 --> 00:29:08,740
From Phase 1 and 2, we had identified the Crown Jewels and Pupil.

347
00:29:08,900 --> 00:29:11,540
And the vulnerable path needs to be fixed.

348
00:29:11,540 --> 00:29:19,620
The vulnerable path which can lead the Crown Jewels into a breach.

349
00:29:20,780 --> 00:29:25,100
Also, the next point, evaluation of incident response process.

350
00:29:25,100 --> 00:29:27,100
This is also important.

351
00:29:27,100 --> 00:29:31,760
What is your organization's process once it's been compromised?

352
00:29:31,860 --> 00:29:36,180
How much time did it take to detect the incident and respond to it?

353
00:29:36,180 --> 00:29:38,860
That is also important, very much important.

354
00:29:40,100 --> 00:29:48,800
And using the output of the previous phases, we could really improvise and make a new RTO process documentation.

355
00:29:48,940 --> 00:29:55,940
There is a final point, we can learn from the previous phases.

356
00:29:55,940 --> 00:30:01,080
And what have we learned from the previous phases, we can improvise from that.

357
00:30:01,080 --> 00:30:07,660
And we can create a new operations manual or new operations process to move further.

358
00:30:07,660 --> 00:30:10,860
So, that is the end of Phase 3.

359
00:30:13,040 --> 00:30:18,940
Moving on to the next slide, Phase 4, IRTO Phase 4.

360
00:30:20,420 --> 00:30:23,400
We have the Phase 4 here.

361
00:30:25,320 --> 00:30:31,960
So, it's like, for example, collaborative and continuous Pupil team exercises.

362
00:30:31,960 --> 00:30:41,760
So, whatever tasks are being done by the red team, the end goal should be empowering the blue team, right?

363
00:30:42,240 --> 00:30:48,960
So, it's always better to organize a collaborative and continuous Pupil team exercises.

364
00:30:48,960 --> 00:30:53,260
Just join forces with the red teams and blue teams.

365
00:30:53,700 --> 00:30:57,280
Also, bring in more tooling capabilities.

366
00:30:57,280 --> 00:31:05,740
Many interesting platforms and tools are there, you know, we should empower the red teams and blue teams.

367
00:31:06,400 --> 00:31:14,360
Also, you can perform a targeted campaign, targeted and very specific campaigns against the crown jewels and key people.

368
00:31:14,360 --> 00:31:16,600
For example, business executives.

369
00:31:28,210 --> 00:31:33,070
You guys can still see my screen, right?

370
00:31:33,090 --> 00:31:38,850
Could you please give me some hearts if you can see the screens, I mean the slides?

371
00:31:41,270 --> 00:31:42,370
Okay, okay, okay.

372
00:31:42,370 --> 00:31:43,830
Awesome, awesome, awesome.

373
00:31:44,670 --> 00:31:49,710
Moving on to the next point, overt physical security assessment.

374
00:31:49,710 --> 00:31:57,190
We know that, you know, physical security assessment, they are a very big part of red teaming activities.

375
00:31:57,190 --> 00:32:03,830
So, we can, in phase three, phase four, we can start overt physical security assessment.

376
00:32:03,830 --> 00:32:13,210
We can identify the most important data centers, manufacturing plants, processing centers or anything based on your company's business.

377
00:32:13,210 --> 00:32:19,390
You know, it may differ, there may be, you know, different set of goals based on your company's portfolio.

378
00:32:20,790 --> 00:32:35,330
So, regarding the overt security assessment, you could just go to the premises, walk around the premises with the person in charge and perform your review in front of the, you know, in front of the reviewer as well.

379
00:32:35,390 --> 00:32:38,230
So, that is like, you are not breaking into anything.

380
00:32:38,230 --> 00:32:41,190
This is just overt physical security assessment.

381
00:32:41,250 --> 00:32:44,870
You are just going to the client side and you are just walking around.

382
00:32:44,870 --> 00:32:49,930
You are just trying to find as many as physical vulnerabilities in there and report them.

383
00:32:49,930 --> 00:32:51,650
It is as simple as that.

384
00:32:54,050 --> 00:33:00,970
So, you can, you know, as an example, you can refer the work of Devin Olam, you know, in YouTube.

385
00:33:00,970 --> 00:33:02,130
He is a legend.

386
00:33:02,130 --> 00:33:07,130
He is the very best guy out there regarding physical, you know, security assessments.

387
00:33:07,130 --> 00:33:08,590
He is really awesome.

388
00:33:12,240 --> 00:33:16,100
Also, continuous awareness program for employees and key people.

389
00:33:16,100 --> 00:33:25,740
Like, you know, after, for example, you have done a couple of phishing campaigns, fear phishing campaigns, you know, you did some bad ESP drop and everything.

390
00:33:26,100 --> 00:33:45,080
But from that, we need to share, we need to create a set of training series and we need to perform continuous awareness and training programs for employees and the top manager so that they can protect themselves from the future attacks of real adversaries.

391
00:33:45,080 --> 00:33:46,880
That is really important.

392
00:33:49,100 --> 00:34:03,500
Also, an operational tip, you know, when you go for a physical security assessment, do not show up with military apparel or a tactical bag along with a laptop which is full of hacking stickers.

393
00:34:03,840 --> 00:34:10,420
If you are going like this to the client side, you know, that raises a lot of eyebrows and that is going to be really funny.

394
00:34:10,420 --> 00:34:12,320
People will be looking at you all the time.

395
00:34:12,320 --> 00:34:18,000
Who is this guy, you know, wearing this tactical backpack and a laptop full of stickers?

396
00:34:18,280 --> 00:34:21,680
So that's kind of very, you know, attractive thing, right?

397
00:34:21,680 --> 00:34:26,440
So do not do that, even if you are doing a covert assessment or an overt assessment.

398
00:34:26,440 --> 00:34:27,780
It's pretty important.

399
00:34:30,920 --> 00:34:37,960
Going to the next slide, phase five, which is time to five.

400
00:34:38,660 --> 00:34:43,800
Okay, so this is the final phase of IRTO framework.

401
00:34:45,020 --> 00:34:53,620
By the time we reach phase five, we'll be having a kind of a matured team operations capabilities.

402
00:34:55,060 --> 00:34:59,020
It is the time to grow some wings and fly away, right?

403
00:34:59,020 --> 00:35:06,000
Not from the organization, but, you know, like capabilities wise, just, you know, fly away.

404
00:35:06,920 --> 00:35:11,220
This is the phase where we have a matured team operations capabilities.

405
00:35:11,940 --> 00:35:20,800
The main important thing would be by this time, you should have a significant improvement of organizational security posture.

406
00:35:20,800 --> 00:35:24,440
Because we have passed four different phases, right?

407
00:35:24,440 --> 00:35:28,740
We did many things, you know, from the phase one.

408
00:35:28,740 --> 00:35:38,240
So by the time we reach phase five, it is very important to have significant improvement of organizational security posture.

409
00:35:38,440 --> 00:35:45,880
So that is the clear proof of having a powerful and practical internal working.

410
00:35:46,240 --> 00:35:50,180
It is important for both systems and the key people.

411
00:35:50,980 --> 00:35:57,320
So you can also start, you know, covert physical security assessment, you know, instead of overt.

412
00:35:57,320 --> 00:36:04,040
You could just go to client sites without telling them you are an internal employee, you could do assessment.

413
00:36:04,240 --> 00:36:06,060
That will be very much fun.

414
00:36:06,060 --> 00:36:20,140
So also, by the time we reach phase five, we will have highly skilled operators and we will be having custom tools to create custom security patterns.

415
00:36:21,540 --> 00:36:26,160
Custom scripts and, you know, custom attack patterns.

416
00:36:26,160 --> 00:36:27,240
That is very important.

417
00:36:27,240 --> 00:36:30,620
That is very interesting capability to have.

418
00:36:31,460 --> 00:36:37,820
So also, continuous advisory simulation to keep the defendants on their toes.

419
00:36:37,820 --> 00:36:43,640
So by the time we reach phase five, we attend many things, right?

420
00:36:43,640 --> 00:36:50,320
And one of the things would be, one of the main thing would be having continuous advisory simulation.

421
00:36:50,520 --> 00:36:55,640
Just to make sure that everything is going very well with the organization.

422
00:36:57,320 --> 00:37:02,080
Finally, continuous routine operations with a very different process.

423
00:37:02,180 --> 00:37:08,620
As an end result, we also will be having a very different process to carry this task forward.

424
00:37:08,620 --> 00:37:12,600
You know, just repeat the process, make this as a cycle.

425
00:37:12,920 --> 00:37:20,000
You know, continuous routine operation will be like, you know, the actual results of, you know, reaching phase five.

426
00:37:20,000 --> 00:37:21,700
That is really important.

427
00:37:21,700 --> 00:37:34,860
So we can assume that by the time we reach the phase five, you know, there will be a lot of significant changes within our internal security posture.

428
00:37:34,860 --> 00:37:37,900
That is pretty important to have such a huge change.

429
00:37:39,880 --> 00:37:42,880
And moving on to the next slide.

430
00:37:53,280 --> 00:37:59,820
So the five phases which I have shown you, that is really customizable.

431
00:37:59,820 --> 00:38:05,920
Like, you know, you can change that to your own needs and you can add your own points.

432
00:38:05,920 --> 00:38:14,200
Even if you think that some of the points are misaligned in different phases, you can just modify the steps and you can make it your own.

433
00:38:14,200 --> 00:38:15,500
That is pretty simple.

434
00:38:15,920 --> 00:38:26,720
And coming back to the strategic and tactical plans, you can see, you know, there is a strategy plan, which is a total sum of a couple of tactical plans, right?

435
00:38:26,720 --> 00:38:37,100
So the strategy plans, they are focusing on long-term objectives, where the tactical plans focus on short-term engagements.

436
00:38:37,100 --> 00:38:44,400
So you can derive a couple of tactical plans and change them together, you know, just to reach the highest goal.

437
00:38:44,400 --> 00:38:50,160
For example, you are planning, you are creating a strategy plan for one year.

438
00:38:50,300 --> 00:38:53,700
So you can split that into three.

439
00:38:53,700 --> 00:39:00,280
So each tactical plan is having four months to attain a certain role, a certain goal.

440
00:39:00,280 --> 00:39:08,680
For example, earlier we mentioned, we need to identify the critical assets, key people and crown jewels, right?

441
00:39:08,680 --> 00:39:17,840
So for the tactical plan on, you can take that as an objective and you can start identifying the critical assets and people.

442
00:39:17,840 --> 00:39:24,760
Then you can try to, you know, perform adversarial simulation against those assets and people.

443
00:39:24,760 --> 00:39:28,400
Just to identify, you know, are they vulnerable to phishing campaigns?

444
00:39:28,440 --> 00:39:29,440
What are the results?

445
00:39:29,440 --> 00:39:33,360
And we got a couple of credentials from these people.

446
00:39:33,360 --> 00:39:35,900
What are the privileges for these credentials?

447
00:39:36,020 --> 00:39:44,120
So by the end of the tactical plan one, you will have a clear set of reports, you know, for your very first objective.

448
00:39:44,120 --> 00:39:52,300
So like that, we can, you know, change a couple of tactical plans to have a very long-term objective.

449
00:39:52,600 --> 00:39:58,900
You know, that is the end goal of creating this IRTO platform.

450
00:39:58,900 --> 00:40:02,440
You can create your own plans and both tactical and strategy.

451
00:40:02,440 --> 00:40:06,380
Our end goal should be, you know, attaining the long-term objective.

452
00:40:10,110 --> 00:40:11,310
Okay, cool.

453
00:40:11,830 --> 00:40:14,070
Could you go to the next slide, please?

454
00:40:20,800 --> 00:40:23,640
Okay, this is the final slide.

455
00:40:23,640 --> 00:40:34,460
If you guys have any questions related to, you know, the team like faces and maturity models, you know, please feel free to ask me.

456
00:40:36,450 --> 00:40:42,290
If you have any questions, you could just send some hearts and we can start talking.

457
00:40:45,210 --> 00:40:46,410
Anyone?

458
00:40:48,690 --> 00:40:53,350
Oh, okay.

459
00:40:54,510 --> 00:41:01,390
Okay, so all those who have questions, please give some heart reacts so that I can unmute you all.

460
00:41:04,460 --> 00:41:06,600
Actually, I can't hear you.

461
00:41:06,600 --> 00:41:08,560
Yeah, I can see and strike.

462
00:41:08,560 --> 00:41:09,360
Just a second.

463
00:41:21,880 --> 00:41:23,920
Could you please come near me?

464
00:41:23,920 --> 00:41:25,760
I can't hear you.

465
00:41:30,970 --> 00:41:31,990
Can you hear me?

466
00:41:33,210 --> 00:41:35,170
Yeah, tell me.

467
00:41:36,170 --> 00:41:43,010
So, do you model your adversarial campaigns off of APTs?

468
00:41:44,710 --> 00:41:46,990
Could you please come again?

469
00:41:47,330 --> 00:41:52,530
Do you model your adversarial campaigns off of APTs?

470
00:41:53,830 --> 00:41:56,250
Yeah, APT emulation, right?

471
00:41:56,250 --> 00:41:57,330
Yes.

472
00:41:57,330 --> 00:42:02,610
Yeah, we can, because I think I stated in one of my previous slides.

473
00:42:03,370 --> 00:42:06,090
That is in phase two, I think.

474
00:42:06,430 --> 00:42:07,070
Okay.

475
00:42:07,070 --> 00:42:09,190
This adversarial emulation.

476
00:42:09,730 --> 00:42:18,890
So, I mean, as a beginning in phase two, you can start doing emulation using, you know, Atomic Red Team or Caldera.

477
00:42:18,890 --> 00:42:21,770
Also, you can use Mitre framework.

478
00:42:21,870 --> 00:42:25,190
You know, there are a couple of APTs listed in there.

479
00:42:25,190 --> 00:42:33,490
You can, you know, check those APTs and start collecting their commands and you can execute them in your, you know, test environment.

480
00:42:33,650 --> 00:42:39,550
So, the end result would be, you can understand the detection capabilities of your Blue Team.

481
00:42:39,550 --> 00:42:40,950
That is really cool.

482
00:42:40,950 --> 00:42:48,010
Mitre is doing a wonderful job, you know, collecting all these emulation and, you know, simulation plans.

483
00:42:48,830 --> 00:42:49,790
Okay, cool.

484
00:42:49,790 --> 00:42:50,390
Thank you.

485
00:42:50,730 --> 00:42:52,170
Yeah, thank you.

486
00:43:01,040 --> 00:43:04,320
So, you could always reach me on...

487
00:43:11,920 --> 00:43:14,260
Is anyone asking any questions?

488
00:43:15,460 --> 00:43:18,940
Could you please raise your hands or, like, you know, give me some hearts?

489
00:43:19,100 --> 00:43:20,540
I'll come near you.

490
00:43:25,680 --> 00:43:27,060
Could you throw some hearts?

491
00:43:27,060 --> 00:43:29,140
I'll come to you.

492
00:43:34,270 --> 00:43:35,190
Okay.

493
00:43:35,330 --> 00:43:39,650
So, if there are no questions, you can always reach me on Discord.

494
00:43:40,010 --> 00:43:42,110
It is abh1474.

495
00:43:42,110 --> 00:43:47,930
Also, you can reach me on my Twitter account, which is abhijitbr.

496
00:43:49,030 --> 00:43:49,510
And...

497
00:43:50,350 --> 00:43:52,810
Could you guys please move to the next slide?

498
00:43:59,270 --> 00:44:00,270
Next slide, please.

499
00:44:00,270 --> 00:44:00,910
Okay.

500
00:44:01,330 --> 00:44:03,330
And, yeah, thank you, everyone.

501
00:44:03,330 --> 00:44:04,650
Thank you for being here.

502
00:44:04,650 --> 00:44:07,270
Thank you to attend my talk.

503
00:44:07,330 --> 00:44:13,270
Thanks a lot, everyone, for, you know, being in the virtual village hosted by DEF CON groups.

504
00:44:13,350 --> 00:44:14,510
Thanks a lot.

505
00:44:14,510 --> 00:44:26,570
Also, I would like to, you know, thank Jason Eastridge and DEF CON groups to give me this opportunity to stand here and take this presentation.

506
00:44:26,850 --> 00:44:33,010
Also, I would like to thank TX and his fabulous DEF CON group, Delphi.

507
00:44:33,190 --> 00:44:36,030
Also, DEF CON group Trivandrum, Mumbai.

508
00:44:36,350 --> 00:44:37,110
Thank you.

509
00:44:37,110 --> 00:44:38,190
Thank you, everyone.

510
00:44:46,340 --> 00:44:48,920
Okay, so...

511
00:44:48,920 --> 00:44:49,640
Okay.