start	end	text
1400	7020	Can you guys hear me very well? Is there any kind of echo or background noise?
7020	8500	Or is that just fine?
8820	11040	Just give me a heart if it is okay.
12520	14840	Okay, cool. Thank you.
18140	20540	Once again, hello everyone.
20740	22500	My name is Abhijit.
22540	26580	And I am also known by the pseudonym ABX.
26580	32580	I belong to Defcon Group Trivandrum, aka DC0471.
32960	36000	I am very glad to be here today.
36460	39020	It is a pleasure to be here.
39020	43440	And I really appreciate the keynote of Jason.
43440	45080	That was really wonderful.
45080	48420	That was a really impressive keynote.
48900	55760	And along with me, I have a couple of team members from Defcon Group Trivandrum today.
55760	68720	We have my Defcon Trivandrum teammates, Aditya, Srihari, Taufik, Alex, Praveen, Vishnu, and Plucky, along with Alex.
68720	71360	And we are all happy to be here.
71360	76120	Once again, it is a privilege to be here in this village.
76440	78060	Moving on to the next slide.
83220	85100	Next slide, please.
98460	100340	Give me a second, guys. Give me a second.
100340	104340	Let me drop the mic here.
112080	113280	One second.
136030	138610	Sorry, guys. I am pretty new to this platform.
138610	139650	Give me a second.
151530	153690	Could you please help me with this mic?
153690	157350	I just need to drop this mic and speak in loudspeaker.
157350	158730	Could anyone help me, please?
159150	159850	TX?
159850	165770	You have to hold your left mouse button for a while and you can just throw the mic away.
166130	168030	What? Left what? Left shift key?
168070	169590	The mouse button, right?
169790	171910	Yeah, the left mouse button.
172410	173530	That's how you do it.
173530	174190	Okay.
189190	189970	Cool.
191170	193630	Okay, sorry again for the trouble, guys.
194270	196710	I am really new to this platform.
196990	199870	Okay, once again, going back to the slide.
199870	204210	We manage the Defcon Group Trivandrum, which is in India.
204390	210970	Our location is Trivandrum, which is a very small city in India.
211550	218130	So, we have started our Defcon Group in January 2018.
218590	227670	We have organized a couple of hacker meetups and conferences during the past events with multiple tracks and CTFs.
227670	232770	We have more than 15 organizing team members, which are hardcore team members.
232770	237570	This is like a brotherhood for me and everyone in my group.
238850	245930	We are also hosting a hacking podcast in Malayalam language, which is our native language.
245930	249130	You could view that URL in there.
249210	253730	It is kind of interviewing local hackers and cybersecurity professionals.
253730	257410	We also connect regularly.
279370	281630	Move to the next slide, please.
285180	289580	Here are some of the photos of some of our events.
289580	295480	We had the opportunity to have a good set of speakers in our previous meetups.
297720	302460	I think that is it about our Defcon Group Trivandrum.
302460	306400	I think we can go to the technical presentation now.
306880	308460	Please move to the next slide.
316800	323320	As you can see, the title of my talk would be building an internal Red Team for your organization.
323320	329220	It is like building a practical Red Team within your organization.
333050	334630	Next slide, please.
334630	341890	As I have mentioned, my name is Abhijit.
342630	348570	And I'm also known by the pseudonym ABX.
348750	353990	I'm leading OpenSea security operations in a global financial technology company.
354310	359550	I'm also the former deputy manager for cybersecurity in Nissan Motors.
359930	364050	Prior to that, I used to work for EY as a senior security analyst.
364050	369210	I have nearly 10 years of experience in the security domain.
369290	374950	I'm also the founder of a community called teamvillage.org.
374950	378870	And no, it is not associated with Defcon Villages.
379130	384230	Like I mentioned earlier, I'm also the leader of the Defcon Trivandrum community.
384230	389590	Recently, I started running a blog called tacticaladversary.io,
389590	394030	which is a blog dedicated to adversarial simulation and Red Teaming tactics.
394170	399270	It is still a work in progress. I'm still working on it, you know, just to get things started.
400190	402030	Moving to the next slide.
404780	407740	Let's make some things clear first.
407740	413900	I don't really want to, you know, do an intro about vulnerability assessment, pen test or Red Teaming.
413900	420820	But I just want to make some statements before we go further into the slides.
421320	423340	Moving on to the next slide.
429230	433830	This is just a statement. I think you can see the slide. Yeah, yeah.
433830	438450	This is just a statement. Vulnerability assessment, it is not Red Teaming.
439890	446270	Like, you know, also vulnerability assessment, it is not penetration testing as well.
446270	449890	So we all know, like, what is vulnerability assessment.
449930	460030	It is about targeting a system, an application or a network just to identify the list of vulnerabilities.
460030	463530	Like, you know, what are the known weaknesses in that system?
463530	473130	List them down along with the remediation plan and hand it over to the appropriate teams so that they can get it fixed.
473130	474970	So that is called vulnerability assessment.
474970	478950	It is not Red Teaming. I will go to the next slide.
480250	484510	Again, penetration testing, it is also not Red Teaming.
485830	493370	But pen testing, on the other hand, compared to VA, it is more focused towards the goal.
497250	499650	Maybe... could you please go to the next slide?
499690	501310	Oh, OK. This is fine. This is fine.
501310	506190	OK. Maybe we are targeting an application or infrastructure.
506190	511250	Our only goal would be compromising that system and get into it.
511670	516790	The pen testing report also reflects the same, rather than listing all vulnerabilities.
517630	519550	We are facing a problem now, right?
519550	525510	You know, nowadays we cannot differentiate between vulnerability assessment and pen testing reports.
525510	536130	A pen testing report may list all vulnerabilities in the target system instead of the exportation and how the attacker got into the system.
537770	543630	For my day job, I used to see external pen testing reports with SSL issues only.
543630	545810	Just imagine that. Just think about it.
545810	555350	I used to see penetration testing reports from external vendors which are having SSL issues in a pen testing report.
555350	556830	That is really weird.
557950	559950	It is kind of confusing now, you know.
559950	562950	If anyone here is also feeling the same, just let me know.
562950	567090	Like, you know, the confusion between the vulnerability assessment and pen testing.
567090	570210	We are seeing it in our day-to-day life, you know.
570210	575870	These vendors, these professionals, they are giving us the VA and pen testing reports, you know.
576250	578610	It is kind of very confusing.
579410	590460	We are not blind here, but I am getting muted sometimes.
590460	591460	I don't know why.
593860	599820	Okay, as the last statement, I also want to mention that pen testing is not routine.
600260	603660	I'll come to this point later, later in the presentation.
604600	607980	Can we go to the next slide?
616120	617180	Okay.
617180	623580	So, like, you know, most of us know the meaning of RETeam or what is RETeam, right?
624020	628000	We have a cool definition from RETeams.net here.
628540	637280	Historically, RETeam, the term RETeam, it originates from the military terms which would be imitating the role of adversaries.
637420	641320	They will try to mimic the attacks against the military base.
641660	648880	That is the explanation about RETeaming.
648920	650640	Could you please go to the next slide?
650640	654720	We have a much simpler explanation in here.
654780	659600	This is a much simpler and easy to use explanation.
661770	665280	This is also from RETeams.net.
665930	674190	A RETeam is a group of highly skilled people that continuously challenge the plans, defensive measures, and security concepts.
674190	676650	That is pretty clear, right?
676650	680110	This is actually called adversarial attack simulation.
680110	682370	That is what we are doing nowadays.
682630	685190	I will come to the next slide.
688730	690520	Is it the next slide yet?
691250	692610	Yes, it is.
694070	697010	Let me talk about a confusion here.
702270	710330	I have seen these comments with the sales people and usually the security services executives.
710330	712470	I am not mocking anyone here.
712470	717810	It is also very sad that many people are seeing RETeams as penetration testers.
717810	720970	They will be saying, like, you know, I am a part of internal RETeam.
721050	723630	But I will ask, like, what are you doing then?
723630	725750	I am doing penetration testing.
725750	728190	I am doing web application penetration testing.
728190	731890	I am doing application security.
731890	734010	But I am a part of internal RETeam.
734010	736510	But it is kind of confusing.
736510	741770	It is also very sad that, you know, these people are seeing RETeams as penetration testers.
742330	748930	To explain the actual job, along with the RETeam professional, I mean, along with the RETeam professional,
748930	754690	many security folks are nowadays using the term adversarial attack simulation as well.
759910	764190	I have recently seen a couple of similar job titles in LinkedIn.
764190	772710	Instead of mentioning a RETeam professional, they are listing their profile as adversarial attack simulation professional.
772710	777870	Or, you know, like operator as adversarial attack simulation.
777870	778630	Something like that.
778630	783190	Just to be more clear, other than, you know, confusing, using confusing terms.
784890	786570	Next slide, please.
793490	795910	So, everyone, how is this picture?
795910	797070	Do you like this picture?
798530	802790	Could you guys please give me hearts or claps if you like this picture?
803430	806570	I am not getting hearts from everyone, I think.
807850	809270	Yeah, now I do.
809270	813330	Actually, you know, I really wanted to show off this picture.
813330	817930	You know, the perfect symphony between the attackers and the defenders.
818690	826090	It was created based on the native Kerala martial art, which is called Kalaripayattu.
826090	830510	That is the traditional martial art form of our native place.
830710	833730	So, based on that, we created this picture.
834450	843150	You know, it was designed for a CTF competition at a conference called COCON, which is one of the biggest cyber security conference in India.
843310	846430	So, I really wanted to show you guys this picture.
846910	849510	I think you guys really like it, right?
849510	855870	You know, the actual symphony between RETeams and Blue Teams, based on our native martial art form.
856090	859090	That was kind of a show off. Thank you.
859810	862370	Moving on to the next slide.
866850	875050	So, most of the things mentioned here, that is from my own experience, are the awesome contributors of the security community.
875510	883910	Most of the companies, they already have their own application security and internal pen testing teams.
883910	891810	So, what if they want to move a more matured attack simulation activities?
891810	903250	You know, they are doing fine with AppSec and internal pen test, but they also want to move into a more matured attack simulation team.
903250	914570	So, I really think this talk will be helpful for such people who want to build an offensive internal team for adversarial attack simulation.
914670	919870	We are targeting that kind of audience here. I mean, the target audience.
924280	926080	Next slide, please.
932790	936470	Okay, I think you can see this picture.
936470	942770	So, we have created this diagram for one of our assignments.
943150	949250	Internal Red Team Operations Framework. That is still a work in progress. We are still working on this.
950150	957730	We have split it into five different phases. Internal Red Team Operations Framework into five different phases.
957990	965190	Each framework will be having its own models and its own concepts.
965190	974810	So, based on that, we can start from the scratch and get into more mature level Red Teams, Internal Red Teams.
974950	978610	We can go into each of these phases individually.
980570	982330	Next slide, please.
987970	989170	Okay.
990330	995990	So, this is the very first phase of IRTO, which is Internal Red Team Operations.
995990	1002350	It's like building from the scratch. We need to get our budget approved.
1002370	1006250	We really need to defend the practical goals and objectives.
1008210	1017950	It's like you should ask yourself, why are we creating this team? What is the need of an Internal Red Team in my organization?
1017950	1021050	Now, there should be a hard question.
1032120	1037290	Each organization has its own different set of crown jewels.
1037590	1040850	It is their sensitive data or assets.
1054120	1057880	The crown jewels of our organization.
1057880	1061200	Not only crown jewels, also people.
1061200	1070900	For example, it is always about the critical assets or critical people within an organization.
1070900	1083060	For example, if there is a company which is doing manufacturing, for them, it is their formula architects and all the stuff.
1083060	1085380	They have to keep it very safe.
1085380	1094560	So, considering that, each organization has its own valuable assets, its own data set, its own data centers.
1094560	1099080	So, we need to identify the crown jewels of our organization.
1099080	1106500	We need to create rules of engagement and we need to get assistance from the management and legal department.
1106640	1113900	And more importantly, before moving forward, we need to understand the security posture of our organization.
1113900	1121760	What are the security countermeasures or what are the security implementations which are there for an organization.
1121760	1127680	So, that is very essential to understand before we move forward.
1128080	1134200	And, like I mentioned, identify the crown jewels and people.
1134200	1137960	There is one more thing. People are always important.
1137960	1149040	For example, you know that there are many high-level executives out there, high-level management people are out there.
1149080	1154080	They are always vulnerable to phishing attacks. I will tell you why.
1154140	1160320	Usually, being technical people, we don't have the urge to open our email all the time.
1160320	1170100	But, being business consultants or being business executives, they always have the kind of an issue to open and respond to their emails.
1170500	1179720	So, they will always fall for a targeted phishing campaign. That is kind of the key thing here.
1179860	1186340	So, along with the sensitive data, we also need to identify what are the key people to my organization.
1186340	1192960	What if someone has compromised their personal account? What will happen to the organization?
1193080	1207660	So, this can be a challenge for people who are looking to build their team.
1208300	1210380	Moving on to the next slide.
1218200	1220160	Next slide is here, right?
1220160	1234380	Okay. How many of you know about this A-Team?
1234980	1238200	Three? Four? Okay.
1238200	1245320	So, recently in 2010 or 2012, there was a movie acted by Bradley Cooper.
1245820	1249440	Okay. So, the A-Team.
1249440	1251520	The team and skill set.
1256450	1259610	This is how, for example, just consider the A-Team.
1259610	1262010	This is how a team should be.
1262150	1265190	Like, the team must be diverse.
1267350	1270450	This is not an one-man job.
1270850	1276050	They'll have to work together as a team or work solo sometimes.
1276050	1281230	Also, they'll have to work under an excessive amount of pressure.
1281770	1285070	They should be able to handle that pressure.
1285070	1287210	It is really important.
1287410	1291090	For example, we know that Colonel Hannibal, right?
1291250	1294490	He's also the leader of A-Team.
1294490	1297170	And sometimes, he's a solo player.
1300910	1306950	And the A-Team, they're strong individually and stronger as a team.
1306950	1309630	That is an important thing to have.
1309630	1311550	You need to handle things personally.
1311550	1313990	And you need to handle things alone.
1313990	1316490	And you need to handle things as a team.
1316490	1319590	That should be a skill set.
1322070	1325410	So, the team should also contain non-technical people.
1325410	1327090	We talked about technical people, right?
1327090	1338370	We talked that in order to build a red team, we need highly technical people in different areas of attack simulation and offensive security operations.
1338370	1343450	But along with that, the team should also contain non-technical people.
1344410	1351230	So, how many of you here have ever created a phishing campaign against any kind of organization?
1354410	1356110	Give me some hearts.
1356110	1358970	How many of you have hosted a phishing campaign?
1359370	1362330	Yeah, I am seeing a couple of hearts in there.
1362330	1364010	So, let me ask you a question.
1364010	1378250	So, usually, the technical guys in your team or very people-managed and friendly guys, who are usually writing the phishing emails?
1378250	1384470	The technical guy or more friendly HR-like persons?
1384690	1387290	Who is creating the phishing emails for you?
1388210	1389110	Guys, you can...
1389110	1391230	If it is you, then you can give me a heart.
1391310	1393990	Otherwise, you can just give me a palm or something.
1396890	1398870	I am not seeing anything.
1403620	1406080	Okay, I can see a couple of guys.
1406080	1411700	They are saying that they do write their own phishing campaign emails.
1411700	1413320	So, I will tell you something.
1413600	1421540	Just imagine, a hardcore technical guy is writing a phishing email to someone like a business executive.
1421820	1427040	For example, if I am writing a phishing email, that will be more technical.
1427040	1432460	There will be these technical jaggons and there will be a lot of technical ways.
1432460	1434020	We don't want that, right?
1434020	1445820	So, if there is a non-technical guy or a business guy or a human resources person in our team, we can ask them to write the phishing email for us.
1446800	1448000	The meaning...
1448000	1452780	They can connect with people compared to the technical guys.
1452880	1455540	They are more friendly guys.
1455540	1460440	They are more into human resources and they can connect with other people pretty easily.
1460440	1462860	They speak a different language.
1462860	1467780	So, it is always better to have non-technical people in our offensive team.
1467780	1469200	It always helps.
1470440	1472360	Could you please go to the next slide?
1481640	1483320	Yeah, we have the next slide.
1484080	1490660	So, this is the phase 2 of iHeartLaw, like internal team operations.
1494660	1496320	So, a couple of points here.
1496340	1498520	A couple of steps here.
1499100	1500500	So, external infrastructure.
1500500	1504360	It is always essential to mimic an adversary's actions.
1504360	1507360	So, we need to build an external Red Team infrastructure.
1507880	1514400	For the beginning, start with open source C tools, implants, frameworks, and other tools.
1514460	1518560	We can modify it based on your requirements.
1519300	1521320	Also, be friends.
1523380	1525300	Okay, the third point.
1525300	1528420	Identifying the business-specific risk.
1528420	1536700	So, being in an internal Red Team is all about your organization and your organization's security posture,
1536700	1540020	and deployed defense mechanisms, etc.
1540020	1547180	So, it is a key point to identify the business-specific risk.
1547180	1552040	It can vary based on the businesses and based on organizations.
1552760	1555460	And the fourth point.
1556000	1559720	Always be friends with the organization's Blue Team.
1559720	1563440	If you have a Blue Team in your company, be friends with them.
1563440	1567660	Just try to understand what they are doing in their daily lives.
1567660	1573460	What are the tools and techniques which they are using for detecting the attackers.
1573460	1585360	It is always good to be in a good relationship with your company's cyber defense system or cyber defense team.
1586400	1593600	All of your organizational activities are there to make the Blue Team much stronger.
1593600	1599340	So, it is very essential to have a good relationship with your cyber defense team.
1601080	1602360	Okay.
1602700	1606060	Also, don't take it personally.
1606120	1610680	I just asked you to be friends with your organization's Blue Team.
1610680	1614640	Once I tried to be friends with an organization's Blue Team,
1615460	1619680	and in the end, she became my girlfriend.
1619680	1621280	That's a long story.
1621280	1623700	So, always don't try so hard.
1623700	1628240	Just formally be friends with the Blue Team of your organization.
1628240	1630260	Don't take it personally.
1630480	1632480	Just a personal advice.
1637580	1638560	Okay.
1638560	1640420	Moving on to the next slide.
1641920	1643420	Phase 3.
1646200	1648800	Could you please go to the Phase 3 slide?
1648800	1650080	Okay, Phase 3.
1652220	1657140	Actually, this is where we begin to work in our plan.
1657140	1660620	You can see, this is Phase 3 where we start working.
1660620	1663840	So, we can use improved tools, techniques, and procedures.
1664800	1668400	And we know about the current security mechanisms, right?
1668400	1673460	We talked about current security mechanisms in Phase 1 and Phase 2.
1673980	1678500	For example, the need of using improved TTPs.
1678700	1684920	For example, what if your organization is not allowing PowerShell or any other scripts?
1685520	1688840	That is where we need to improve our TTPs, right?
1688840	1692840	Initially, we identified that the current organization,
1692840	1696860	they do not allow PowerShell scripts or any other scripts, Wscripts, Cscripts, anything.
1696860	1698420	They are not allowing anything.
1698660	1706220	So, in that case, we need to make some changes in our techniques and improvise.
1706320	1709940	We should find the next feasible option.
1710660	1721630	For example, in this case, we can try running unmanaged PowerShell.
1721650	1729790	Maybe the different systems, they are not considering unmanaged PowerShell executables as malicious.
1729890	1734950	So, sometimes we can bypass the different mechanisms in there.
1741940	1748740	From Phase 1 and 2, we had identified the Crown Jewels and Pupil.
1748900	1751540	And the vulnerable path needs to be fixed.
1751540	1759620	The vulnerable path which can lead the Crown Jewels into a breach.
1760780	1765100	Also, the next point, evaluation of incident response process.
1765100	1767100	This is also important.
1767100	1771760	What is your organization's process once it's been compromised?
1771860	1776180	How much time did it take to detect the incident and respond to it?
1776180	1778860	That is also important, very much important.
1780100	1788800	And using the output of the previous phases, we could really improvise and make a new RTO process documentation.
1788940	1795940	There is a final point, we can learn from the previous phases.
1795940	1801080	And what have we learned from the previous phases, we can improvise from that.
1801080	1807660	And we can create a new operations manual or new operations process to move further.
1807660	1810860	So, that is the end of Phase 3.
1813040	1818940	Moving on to the next slide, Phase 4, IRTO Phase 4.
1820420	1823400	We have the Phase 4 here.
1825320	1831960	So, it's like, for example, collaborative and continuous Pupil team exercises.
1831960	1841760	So, whatever tasks are being done by the red team, the end goal should be empowering the blue team, right?
1842240	1848960	So, it's always better to organize a collaborative and continuous Pupil team exercises.
1848960	1853260	Just join forces with the red teams and blue teams.
1853700	1857280	Also, bring in more tooling capabilities.
1857280	1865740	Many interesting platforms and tools are there, you know, we should empower the red teams and blue teams.
1866400	1874360	Also, you can perform a targeted campaign, targeted and very specific campaigns against the crown jewels and key people.
1874360	1876600	For example, business executives.
1888210	1893070	You guys can still see my screen, right?
1893090	1898850	Could you please give me some hearts if you can see the screens, I mean the slides?
1901270	1903830	Okay, okay, okay. Awesome, awesome, awesome.
1904670	1909710	Moving on to the next point, overt physical security assessment.
1909710	1917190	We know that, you know, physical security assessment, they are a very big part of red teaming activities.
1917190	1923830	So, we can, in phase three, phase four, we can start overt physical security assessment.
1923830	1933210	We can identify the most important data centers, manufacturing plants, processing centers or anything based on your company's business.
1933210	1939390	You know, it may differ, there may be, you know, different set of goals based on your company's portfolio.
1940790	1946690	So, regarding the overt security assessment, you could just go to the premises,
1946690	1955330	walk around the premises with the person in charge and perform your review in front of the, you know, in front of the reviewer as well.
1955390	1961190	So, that is like, you are not breaking into anything. This is just overt physical security assessment.
1961250	1964870	You are just going to the client side and you are just walking around.
1964870	1969930	You are just trying to find as many as physical vulnerabilities in there and report them.
1969930	1971650	It is as simple as that.
1974050	1980970	So, you can, you know, as an example, you can refer the work of Devin Olam, you know, in YouTube.
1980970	1987130	He is a legend. He is the very best guy out there regarding physical, you know, security assessments.
1987130	1988590	He is really awesome.
1992240	1996100	Also, continuous awareness program for employees and key people.
1996100	2001800	Like, you know, after, for example, you have done a couple of phishing campaigns, fear phishing campaigns,
2001800	2005740	you know, you did some bad ESP drop and everything.
2006100	2011980	But from that, we need to share, we need to create a set of training series
2011980	2018960	and we need to perform continuous awareness and training programs for employees and the top manager
2018960	2025080	so that they can protect themselves from the future attacks of real adversaries.
2025080	2026880	That is really important.
2029100	2035120	Also, an operational tip, you know, when you go for a physical security assessment,
2035120	2043500	do not show up with military apparel or a tactical bag along with a laptop which is full of hacking stickers.
2043840	2048680	If you are going like this to the client side, you know, that raises a lot of eyebrows
2048680	2052320	and that is going to be really funny. People will be looking at you all the time.
2052320	2058000	Who is this guy, you know, wearing this tactical backpack and a laptop full of stickers?
2058280	2061680	So that's kind of very, you know, attractive thing, right?
2061680	2066440	So do not do that, even if you are doing a covert assessment or an overt assessment.
2066440	2067780	It's pretty important.
2070920	2077960	Going to the next slide, phase five, which is time to five.
2078660	2083800	Okay, so this is the final phase of IRTO framework.
2085020	2093620	By the time we reach phase five, we'll be having a kind of a matured team operations capabilities.
2095060	2099020	It is the time to grow some wings and fly away, right?
2099020	2106000	Not from the organization, but, you know, like capabilities wise, just, you know, fly away.
2106920	2111220	This is the phase where we have a matured team operations capabilities.
2111940	2120800	The main important thing would be by this time, you should have a significant improvement of organizational security posture.
2120800	2124440	Because we have passed four different phases, right?
2124440	2128740	We did many things, you know, from the phase one.
2128740	2138240	So by the time we reach phase five, it is very important to have significant improvement of organizational security posture.
2138440	2145880	So that is the clear proof of having a powerful and practical internal working.
2146240	2150180	It is important for both systems and the key people.
2150980	2157320	So you can also start, you know, covert physical security assessment, you know, instead of overt.
2157320	2164040	You could just go to client sites without telling them you are an internal employee, you could do assessment.
2164240	2166060	That will be very much fun.
2166060	2180140	So also, by the time we reach phase five, we will have highly skilled operators and we will be having custom tools to create custom security patterns.
2181540	2186160	Custom scripts and, you know, custom attack patterns.
2186160	2190620	That is very important. That is very interesting capability to have.
2191460	2197820	So also, continuous advisory simulation to keep the defendants on their toes.
2197820	2203640	So by the time we reach phase five, we attend many things, right?
2203640	2210320	And one of the things would be, one of the main thing would be having continuous advisory simulation.
2210520	2215640	Just to make sure that everything is going very well with the organization.
2217320	2222080	Finally, continuous routine operations with a very different process.
2222180	2228620	As an end result, we also will be having a very different process to carry this task forward.
2228620	2232600	You know, just repeat the process, make this as a cycle.
2232920	2240000	You know, continuous routine operation will be like, you know, the actual results of, you know, reaching phase five.
2240000	2241700	That is really important.
2241700	2254860	So we can assume that by the time we reach the phase five, you know, there will be a lot of significant changes within our internal security posture.
2254860	2257900	That is pretty important to have such a huge change.
2259880	2262880	And moving on to the next slide.
2273280	2279820	So the five phases which I have shown you, that is really customizable.
2279820	2285920	Like, you know, you can change that to your own needs and you can add your own points.
2285920	2294200	Even if you think that some of the points are misaligned in different phases, you can just modify the steps and you can make it your own.
2294200	2295500	That is pretty simple.
2295920	2306720	And coming back to the strategic and tactical plans, you can see, you know, there is a strategy plan, which is a total sum of a couple of tactical plans, right?
2306720	2317100	So the strategy plans, they are focusing on long-term objectives, where the tactical plans focus on short-term engagements.
2317100	2324400	So you can derive a couple of tactical plans and change them together, you know, just to reach the highest goal.
2324400	2330160	For example, you are planning, you are creating a strategy plan for one year.
2330300	2333700	So you can split that into three.
2333700	2340280	So each tactical plan is having four months to attain a certain role, a certain goal.
2340280	2348680	For example, earlier we mentioned, we need to identify the critical assets, key people and crown jewels, right?
2348680	2357840	So for the tactical plan on, you can take that as an objective and you can start identifying the critical assets and people.
2357840	2364760	Then you can try to, you know, perform adversarial simulation against those assets and people.
2364760	2369440	Just to identify, you know, are they vulnerable to phishing campaigns? What are the results?
2369440	2375900	And we got a couple of credentials from these people. What are the privileges for these credentials?
2376020	2384120	So by the end of the tactical plan one, you will have a clear set of reports, you know, for your very first objective.
2384120	2392300	So like that, we can, you know, change a couple of tactical plans to have a very long-term objective.
2392600	2398900	You know, that is the end goal of creating this IRTO platform.
2398900	2402440	You can create your own plans and both tactical and strategy.
2402440	2406380	Our end goal should be, you know, attaining the long-term objective.
2410110	2414070	Okay, cool. Could you go to the next slide, please?
2420800	2434460	Okay, this is the final slide. If you guys have any questions related to, you know, the team like faces and maturity models, you know, please feel free to ask me.
2436450	2442290	If you have any questions, you could just send some hearts and we can start talking.
2445210	2446410	Anyone?
2448690	2453350	Oh, okay.
2454510	2461390	Okay, so all those who have questions, please give some heart reacts so that I can unmute you all.
2464460	2466600	Actually, I can't hear you.
2466600	2469360	Yeah, I can see and strike. Just a second.
2481880	2485760	Could you please come near me? I can't hear you.
2490970	2491990	Can you hear me?
2493210	2495170	Yeah, tell me.
2496170	2503010	So, do you model your adversarial campaigns off of APTs?
2504710	2506990	Could you please come again?
2507330	2512530	Do you model your adversarial campaigns off of APTs?
2513830	2516250	Yeah, APT emulation, right?
2516250	2517330	Yes.
2517330	2522610	Yeah, we can, because I think I stated in one of my previous slides.
2523370	2526090	That is in phase two, I think.
2526430	2527070	Okay.
2527070	2529190	This adversarial emulation.
2529730	2538890	So, I mean, as a beginning in phase two, you can start doing emulation using, you know, Atomic Red Team or Caldera.
2538890	2541770	Also, you can use Mitre framework.
2541870	2545190	You know, there are a couple of APTs listed in there.
2545190	2553490	You can, you know, check those APTs and start collecting their commands and you can execute them in your, you know, test environment.
2553650	2559550	So, the end result would be, you can understand the detection capabilities of your Blue Team.
2559550	2560950	That is really cool.
2560950	2568010	Mitre is doing a wonderful job, you know, collecting all these emulation and, you know, simulation plans.
2568830	2570390	Okay, cool. Thank you.
2570730	2572170	Yeah, thank you.
2581040	2584320	So, you could always reach me on...
2591920	2594260	Is anyone asking any questions?
2595460	2598940	Could you please raise your hands or, like, you know, give me some hearts?
2599100	2600540	I'll come near you.
2605680	2609140	Could you throw some hearts? I'll come to you.
2614270	2615190	Okay.
2615330	2619650	So, if there are no questions, you can always reach me on Discord.
2620010	2622110	It is abh1474.
2622110	2627930	Also, you can reach me on my Twitter account, which is abhijitbr.
2629030	2629510	And...
2630350	2632810	Could you guys please move to the next slide?
2639270	2640910	Next slide, please. Okay.
2641330	2647270	And, yeah, thank you, everyone. Thank you for being here. Thank you to attend my talk.
2647330	2653270	Thanks a lot, everyone, for, you know, being in the virtual village hosted by DEF CON groups.
2653350	2654510	Thanks a lot.
2654510	2666570	Also, I would like to, you know, thank Jason Eastridge and DEF CON groups to give me this opportunity to stand here and take this presentation.
2666850	2673010	Also, I would like to thank TX and his fabulous DEF CON group, Delphi.
2673190	2676030	Also, DEF CON group Trivandrum, Mumbai.
2676350	2678190	Thank you. Thank you, everyone.
2686340	2688920	Okay, so...
2688920	2689640	Okay.