WEBVTT 00:01.400 --> 00:04.180 Can you guys hear me very well? 00:04.180 --> 00:07.020 Is there any kind of echo or background noise? 00:07.020 --> 00:08.500 Or is that just fine? 00:08.820 --> 00:11.040 Just give me a heart if it is okay. 00:12.520 --> 00:13.580 Okay, cool. 00:13.580 --> 00:14.840 Thank you. 00:18.140 --> 00:20.540 Once again, hello everyone. 00:20.740 --> 00:22.500 My name is Abhijit. 00:22.540 --> 00:26.580 And I am also known by the pseudonym ABX. 00:26.580 --> 00:32.580 I belong to Defcon Group Trivandrum, aka DC0471. 00:32.960 --> 00:36.000 I am very glad to be here today. 00:36.460 --> 00:39.020 It is a pleasure to be here. 00:39.020 --> 00:43.440 And I really appreciate the keynote of Jason. 00:43.440 --> 00:45.080 That was really wonderful. 00:45.080 --> 00:48.420 That was a really impressive keynote. 00:48.900 --> 00:55.760 And along with me, I have a couple of team members from Defcon Group Trivandrum today. 00:55.760 --> 01:08.720 We have my Defcon Trivandrum teammates, Aditya, Srihari, Taufik, Alex, Praveen, Vishnu, and Plucky, along with Alex. 01:08.720 --> 01:11.360 And we are all happy to be here. 01:11.360 --> 01:16.120 Once again, it is a privilege to be here in this village. 01:16.440 --> 01:18.060 Moving on to the next slide. 01:23.220 --> 01:25.100 Next slide, please. 01:38.460 --> 01:39.580 Give me a second, guys. 01:39.580 --> 01:40.340 Give me a second. 01:40.340 --> 01:44.340 Let me drop the mic here. 01:52.080 --> 01:53.280 One second. 02:16.030 --> 02:16.830 Sorry, guys. 02:16.830 --> 02:18.610 I am pretty new to this platform. 02:18.610 --> 02:19.650 Give me a second. 02:31.530 --> 02:33.690 Could you please help me with this mic? 02:33.690 --> 02:37.350 I just need to drop this mic and speak in loudspeaker. 02:37.350 --> 02:38.730 Could anyone help me, please? 02:39.150 --> 02:39.850 TX? 02:39.850 --> 02:45.770 You have to hold your left mouse button for a while and you can just throw the mic away. 02:46.130 --> 02:46.530 What? 02:46.530 --> 02:47.030 Left what? 02:47.030 --> 02:48.030 Left shift key? 02:48.070 --> 02:49.590 The mouse button, right? 02:49.790 --> 02:51.910 Yeah, the left mouse button. 02:52.410 --> 02:53.530 That's how you do it. 02:53.530 --> 02:54.190 Okay. 03:09.190 --> 03:09.970 Cool. 03:11.170 --> 03:13.630 Okay, sorry again for the trouble, guys. 03:14.270 --> 03:16.710 I am really new to this platform. 03:16.990 --> 03:19.870 Okay, once again, going back to the slide. 03:19.870 --> 03:24.210 We manage the Defcon Group Trivandrum, which is in India. 03:24.390 --> 03:30.970 Our location is Trivandrum, which is a very small city in India. 03:31.550 --> 03:38.130 So, we have started our Defcon Group in January 2018. 03:38.590 --> 03:47.670 We have organized a couple of hacker meetups and conferences during the past events with multiple tracks and CTFs. 03:47.670 --> 03:52.770 We have more than 15 organizing team members, which are hardcore team members. 03:52.770 --> 03:57.570 This is like a brotherhood for me and everyone in my group. 03:58.850 --> 04:05.930 We are also hosting a hacking podcast in Malayalam language, which is our native language. 04:05.930 --> 04:09.130 You could view that URL in there. 04:09.210 --> 04:13.730 It is kind of interviewing local hackers and cybersecurity professionals. 04:13.730 --> 04:17.410 We also connect regularly. 04:39.370 --> 04:41.630 Move to the next slide, please. 04:45.180 --> 04:49.580 Here are some of the photos of some of our events. 04:49.580 --> 04:55.480 We had the opportunity to have a good set of speakers in our previous meetups. 04:57.720 --> 05:02.460 I think that is it about our Defcon Group Trivandrum. 05:02.460 --> 05:06.400 I think we can go to the technical presentation now. 05:06.880 --> 05:08.460 Please move to the next slide. 05:16.800 --> 05:23.320 As you can see, the title of my talk would be building an internal Red Team for your organization. 05:23.320 --> 05:29.220 It is like building a practical Red Team within your organization. 05:33.050 --> 05:34.630 Next slide, please. 05:34.630 --> 05:41.890 As I have mentioned, my name is Abhijit. 05:42.630 --> 05:48.570 And I'm also known by the pseudonym ABX. 05:48.750 --> 05:53.990 I'm leading OpenSea security operations in a global financial technology company. 05:54.310 --> 05:59.550 I'm also the former deputy manager for cybersecurity in Nissan Motors. 05:59.930 --> 06:04.050 Prior to that, I used to work for EY as a senior security analyst. 06:04.050 --> 06:09.210 I have nearly 10 years of experience in the security domain. 06:09.290 --> 06:14.950 I'm also the founder of a community called teamvillage.org. 06:14.950 --> 06:18.870 And no, it is not associated with Defcon Villages. 06:19.130 --> 06:24.230 Like I mentioned earlier, I'm also the leader of the Defcon Trivandrum community. 06:24.230 --> 06:34.030 Recently, I started running a blog called tacticaladversary.io, which is a blog dedicated to adversarial simulation and Red Teaming tactics. 06:34.170 --> 06:35.810 It is still a work in progress. 06:35.810 --> 06:39.270 I'm still working on it, you know, just to get things started. 06:40.190 --> 06:42.030 Moving to the next slide. 06:44.780 --> 06:47.740 Let's make some things clear first. 06:47.740 --> 06:53.900 I don't really want to, you know, do an intro about vulnerability assessment, pen test or Red Teaming. 06:53.900 --> 07:00.820 But I just want to make some statements before we go further into the slides. 07:01.320 --> 07:03.340 Moving on to the next slide. 07:09.230 --> 07:11.390 This is just a statement. 07:11.570 --> 07:13.130 I think you can see the slide. 07:13.130 --> 07:13.830 Yeah, yeah. 07:13.830 --> 07:15.510 This is just a statement. 07:15.590 --> 07:18.450 Vulnerability assessment, it is not Red Teaming. 07:19.890 --> 07:26.270 Like, you know, also vulnerability assessment, it is not penetration testing as well. 07:26.270 --> 07:29.890 So we all know, like, what is vulnerability assessment. 07:29.930 --> 07:40.030 It is about targeting a system, an application or a network just to identify the list of vulnerabilities. 07:40.030 --> 07:43.530 Like, you know, what are the known weaknesses in that system? 07:43.530 --> 07:53.130 List them down along with the remediation plan and hand it over to the appropriate teams so that they can get it fixed. 07:53.130 --> 07:54.970 So that is called vulnerability assessment. 07:54.970 --> 07:56.610 It is not Red Teaming. 07:56.870 --> 07:58.950 I will go to the next slide. 08:00.250 --> 08:04.510 Again, penetration testing, it is also not Red Teaming. 08:05.830 --> 08:13.370 But pen testing, on the other hand, compared to VA, it is more focused towards the goal. 08:17.250 --> 08:19.650 Maybe... could you please go to the next slide? 08:19.690 --> 08:20.150 Oh, OK. 08:20.150 --> 08:20.770 This is fine. 08:20.770 --> 08:21.310 This is fine. 08:21.310 --> 08:22.370 OK. 08:22.970 --> 08:26.190 Maybe we are targeting an application or infrastructure. 08:26.190 --> 08:31.250 Our only goal would be compromising that system and get into it. 08:31.670 --> 08:36.790 The pen testing report also reflects the same, rather than listing all vulnerabilities. 08:37.630 --> 08:39.550 We are facing a problem now, right? 08:39.550 --> 08:45.510 You know, nowadays we cannot differentiate between vulnerability assessment and pen testing reports. 08:45.510 --> 08:56.130 A pen testing report may list all vulnerabilities in the target system instead of the exportation and how the attacker got into the system. 08:57.770 --> 09:03.630 For my day job, I used to see external pen testing reports with SSL issues only. 09:03.630 --> 09:04.650 Just imagine that. 09:04.650 --> 09:05.810 Just think about it. 09:05.810 --> 09:15.350 I used to see penetration testing reports from external vendors which are having SSL issues in a pen testing report. 09:15.350 --> 09:16.830 That is really weird. 09:17.950 --> 09:19.950 It is kind of confusing now, you know. 09:19.950 --> 09:22.950 If anyone here is also feeling the same, just let me know. 09:22.950 --> 09:27.090 Like, you know, the confusion between the vulnerability assessment and pen testing. 09:27.090 --> 09:30.210 We are seeing it in our day-to-day life, you know. 09:30.210 --> 09:35.870 These vendors, these professionals, they are giving us the VA and pen testing reports, you know. 09:36.250 --> 09:38.610 It is kind of very confusing. 09:39.410 --> 09:41.670 We are not blind here, but 09:47.840 --> 09:50.460 I am getting muted sometimes. 09:50.460 --> 09:51.460 I don't know why. 09:53.860 --> 09:59.820 Okay, as the last statement, I also want to mention that pen testing is not routine. 10:00.260 --> 10:03.660 I'll come to this point later, later in the presentation. 10:04.600 --> 10:07.980 Can we go to the next slide? 10:16.120 --> 10:17.180 Okay. 10:17.180 --> 10:23.580 So, like, you know, most of us know the meaning of RETeam or what is RETeam, right? 10:24.020 --> 10:28.000 We have a cool definition from RETeams.net here. 10:28.540 --> 10:37.280 Historically, RETeam, the term RETeam, it originates from the military terms which would be imitating the role of adversaries. 10:37.420 --> 10:41.320 They will try to mimic the attacks against the military base. 10:41.660 --> 10:42.020 That 10:45.500 --> 10:48.880 is the explanation about RETeaming. 10:48.920 --> 10:50.640 Could you please go to the next slide? 10:50.640 --> 10:54.720 We have a much simpler explanation in here. 10:54.780 --> 10:59.600 This is a much simpler and easy to use explanation. 11:01.770 --> 11:05.280 This is also from RETeams.net. 11:05.930 --> 11:14.190 A RETeam is a group of highly skilled people that continuously challenge the plans, defensive measures, and security concepts. 11:14.190 --> 11:16.650 That is pretty clear, right? 11:16.650 --> 11:20.110 This is actually called adversarial attack simulation. 11:20.110 --> 11:22.370 That is what we are doing nowadays. 11:22.630 --> 11:25.190 I will come to the next slide. 11:28.730 --> 11:30.520 Is it the next slide yet? 11:31.250 --> 11:32.610 Yes, it is. 11:34.070 --> 11:37.010 Let me talk about a confusion here. 11:42.270 --> 11:50.330 I have seen these comments with the sales people and usually the security services executives. 11:50.330 --> 11:52.470 I am not mocking anyone here. 11:52.470 --> 11:57.810 It is also very sad that many people are seeing RETeams as penetration testers. 11:57.810 --> 12:00.970 They will be saying, like, you know, I am a part of internal RETeam. 12:01.050 --> 12:03.630 But I will ask, like, what are you doing then? 12:03.630 --> 12:05.750 I am doing penetration testing. 12:05.750 --> 12:08.190 I am doing web application penetration testing. 12:08.190 --> 12:11.890 I am doing application security. 12:11.890 --> 12:14.010 But I am a part of internal RETeam. 12:14.010 --> 12:16.510 But it is kind of confusing. 12:16.510 --> 12:21.770 It is also very sad that, you know, these people are seeing RETeams as penetration testers. 12:22.330 --> 12:34.690 To explain the actual job, along with the RETeam professional, I mean, along with the RETeam professional, many security folks are nowadays using the term adversarial attack simulation as well. 12:39.910 --> 12:44.190 I have recently seen a couple of similar job titles in LinkedIn. 12:44.190 --> 12:52.710 Instead of mentioning a RETeam professional, they are listing their profile as adversarial attack simulation professional. 12:52.710 --> 12:57.870 Or , you know, like operator as adversarial attack simulation. 12:57.870 --> 12:58.630 Something like that. 12:58.630 --> 13:03.190 Just to be more clear, other than, you know, confusing, using confusing terms. 13:04.890 --> 13:06.570 Next slide, please. 13:13.490 --> 13:15.910 So, everyone, how is this picture? 13:15.910 --> 13:17.070 Do you like this picture? 13:18.530 --> 13:22.790 Could you guys please give me hearts or claps if you like this picture? 13:23.430 --> 13:26.570 I am not getting hearts from everyone, I think. 13:27.850 --> 13:29.270 Yeah, now I do. 13:29.270 --> 13:33.330 Actually, you know, I really wanted to show off this picture. 13:33.330 --> 13:37.930 You know, the perfect symphony between the attackers and the defenders. 13:38.690 --> 13:46.090 It was created based on the native Kerala martial art, which is called Kalaripayattu. 13:46.090 --> 13:50.510 That is the traditional martial art form of our native place. 13:50.710 --> 13:53.730 So, based on that, we created this picture. 13:54.450 --> 14:03.150 You know, it was designed for a CTF competition at a conference called COCON, which is one of the biggest cyber security conference in India. 14:03.310 --> 14:06.430 So, I really wanted to show you guys this picture. 14:06.910 --> 14:09.510 I think you guys really like it, right? 14:09.510 --> 14:15.870 You know, the actual symphony between RETeams and Blue Teams, based on our native martial art form. 14:16.090 --> 14:18.150 That was kind of a show off. 14:18.150 --> 14:19.090 Thank you. 14:19.810 --> 14:22.370 Moving on to the next slide. 14:26.850 --> 14:35.050 So, most of the things mentioned here, that is from my own experience, are the awesome contributors of the security community. 14:35.510 --> 14:43.910 Most of the companies, they already have their own application security and internal pen testing teams. 14:43.910 --> 14:51.810 So, what if they want to move a more matured attack simulation activities? 14:51.810 --> 15:03.250 You know, they are doing fine with AppSec and internal pen test, but they also want to move into a more matured attack simulation team. 15:03.250 --> 15:14.570 So, I really think this talk will be helpful for such people who want to build an offensive internal team for adversarial attack simulation. 15:14.670 --> 15:17.910 We are targeting that kind of audience here. 15:17.910 --> 15:19.870 I mean, the target audience. 15:24.280 --> 15:26.080 Next slide, please. 15:32.790 --> 15:36.470 Okay, I think you can see this picture. 15:36.470 --> 15:42.770 So, we have created this diagram for one of our assignments. 15:43.150 --> 15:45.590 Internal Red Team Operations Framework. 15:45.590 --> 15:47.450 That is still a work in progress. 15:47.450 --> 15:49.250 We are still working on this. 15:50.150 --> 15:53.810 We have split it into five different phases. 15:53.870 --> 15:57.730 Internal Red Team Operations Framework into five different phases. 15:57.990 --> 16:05.190 Each framework will be having its own models and its own concepts. 16:05.190 --> 16:14.810 So, based on that, we can start from the scratch and get into more mature level Red Teams, Internal Red Teams. 16:14.950 --> 16:18.610 We can go into each of these phases individually. 16:20.570 --> 16:22.330 Next slide, please. 16:27.970 --> 16:29.170 Okay. 16:30.330 --> 16:35.990 So, this is the very first phase of IRTO, which is Internal Red Team Operations. 16:35.990 --> 16:38.910 It's like building from the scratch. 16:39.290 --> 16:42.350 We need to get our budget approved. 16:42.370 --> 16:46.250 We really need to defend the practical goals and objectives. 16:48.210 --> 16:52.690 It's like you should ask yourself, why are we creating this team? 16:52.690 --> 16:57.950 What is the need of an Internal Red Team in my organization? 16:57.950 --> 17:01.050 Now , there should be a hard question. 17:12.120 --> 17:17.290 Each organization has its own different set of crown jewels. 17:17.590 --> 17:20.850 It is their sensitive data or assets. 17:34.120 --> 17:37.880 The crown jewels of our organization. 17:37.880 --> 17:41.200 Not only crown jewels, also people. 17:41.200 --> 17:50.900 For example, it is always about the critical assets or critical people within an organization. 17:50.900 --> 18:03.060 For example, if there is a company which is doing manufacturing, for them, it is their formula architects and all the stuff. 18:03.060 --> 18:05.380 They have to keep it very safe. 18:05.380 --> 18:14.560 So, considering that, each organization has its own valuable assets, its own data set, its own data centers. 18:14.560 --> 18:19.080 So, we need to identify the crown jewels of our organization. 18:19.080 --> 18:26.500 We need to create rules of engagement and we need to get assistance from the management and legal department. 18:26.640 --> 18:33.900 And more importantly, before moving forward, we need to understand the security posture of our organization. 18:33.900 --> 18:41.760 What are the security countermeasures or what are the security implementations which are there for an organization. 18:41.760 --> 18:47.680 So, that is very essential to understand before we move forward. 18:48.080 --> 18:54.200 And, like I mentioned, identify the crown jewels and people. 18:54.200 --> 18:55.660 There is one more thing. 18:55.660 --> 18:57.960 People are always important. 18:57.960 --> 19:09.040 For example, you know that there are many high-level executives out there, high-level management people are out there. 19:09.080 --> 19:12.500 They are always vulnerable to phishing attacks. 19:12.500 --> 19:14.080 I will tell you why. 19:14.140 --> 19:20.320 Usually, being technical people, we don't have the urge to open our email all the time. 19:20.320 --> 19:30.100 But, being business consultants or being business executives, they always have the kind of an issue to open and respond to their emails. 19:30.500 --> 19:34.620 So, they will always fall for a targeted phishing campaign. 19:34.620 --> 19:39.720 That is kind of the key thing here. 19:39.860 --> 19:46.340 So, along with the sensitive data, we also need to identify what are the key people to my organization. 19:46.340 --> 19:50.740 What if someone has compromised their personal account? 19:50.740 --> 19:52.960 What will happen to the organization? 19:53.080 --> 19:53.900 So , this can be 20:02.380 --> 20:07.660 a challenge for people who are looking to build their team. 20:08.300 --> 20:10.380 Moving on to the next slide. 20:18.200 --> 20:20.160 Next slide is here, right? 20:20.160 --> 20:21.060 Okay. 20:21.600 --> 20:22.720 How many of you know 20:26.680 --> 20:34.380 about this A-Team? 20:34.980 --> 20:35.840 Three? 20:36.640 --> 20:37.480 Four? 20:37.480 --> 20:38.200 Okay. 20:38.200 --> 20:45.320 So, recently in 2010 or 2012, there was a movie acted by Bradley Cooper. 20:45.820 --> 20:46.740 Okay. 20:47.260 --> 20:49.440 So, the A-Team. 20:49.440 --> 20:51.520 The team and skill set. 20:56.450 --> 20:59.610 This is how, for example, just consider the A-Team. 20:59.610 --> 21:02.010 This is how a team should be. 21:02.150 --> 21:05.190 Like, the team must be diverse. 21:07.350 --> 21:10.450 This is not an one-man job. 21:10.850 --> 21:16.050 They'll have to work together as a team or work solo sometimes. 21:16.050 --> 21:21.230 Also, they'll have to work under an excessive amount of pressure. 21:21.770 --> 21:25.070 They should be able to handle that pressure. 21:25.070 --> 21:27.210 It is really important. 21:27.410 --> 21:31.090 For example, we know that Colonel Hannibal, right? 21:31.250 --> 21:34.490 He's also the leader of A-Team. 21:34.490 --> 21:37.170 And sometimes, he's a solo player. 21:40.910 --> 21:46.950 And the A-Team, they're strong individually and stronger as a team. 21:46.950 --> 21:49.630 That is an important thing to have. 21:49.630 --> 21:51.550 You need to handle things personally. 21:51.550 --> 21:53.990 And you need to handle things alone. 21:53.990 --> 21:56.490 And you need to handle things as a team. 21:56.490 --> 21:59.590 That should be a skill set. 22:02.070 --> 22:05.410 So, the team should also contain non-technical people. 22:05.410 --> 22:07.090 We talked about technical people, right? 22:07.090 --> 22:18.370 We talked that in order to build a red team, we need highly technical people in different areas of attack simulation and offensive security operations. 22:18.370 --> 22:23.450 But along with that, the team should also contain non-technical people. 22:24.410 --> 22:31.230 So, how many of you here have ever created a phishing campaign against any kind of organization? 22:34.410 --> 22:36.110 Give me some hearts. 22:36.110 --> 22:38.970 How many of you have hosted a phishing campaign? 22:39.370 --> 22:42.330 Yeah, I am seeing a couple of hearts in there. 22:42.330 --> 22:44.010 So, let me ask you a question. 22:44.010 --> 22:58.250 So, usually, the technical guys in your team or very people-managed and friendly guys, who are usually writing the phishing emails? 22:58.250 --> 23:04.470 The technical guy or more friendly HR-like persons? 23:04.690 --> 23:07.290 Who is creating the phishing emails for you? 23:08.210 --> 23:09.110 Guys, you can... 23:09.110 --> 23:11.230 If it is you, then you can give me a heart. 23:11.310 --> 23:13.990 Otherwise, you can just give me a palm or something. 23:16.890 --> 23:18.870 I am not seeing anything. 23:23.620 --> 23:26.080 Okay, I can see a couple of guys. 23:26.080 --> 23:31.700 They are saying that they do write their own phishing campaign emails. 23:31.700 --> 23:33.320 So, I will tell you something. 23:33.600 --> 23:41.540 Just imagine, a hardcore technical guy is writing a phishing email to someone like a business executive. 23:41.820 --> 23:47.040 For example, if I am writing a phishing email, that will be more technical. 23:47.040 --> 23:52.460 There will be these technical jaggons and there will be a lot of technical ways. 23:52.460 --> 23:54.020 We don't want that, right? 23:54.020 --> 24:05.820 So, if there is a non-technical guy or a business guy or a human resources person in our team, we can ask them to write the phishing email for us. 24:06.800 --> 24:08.000 The meaning... 24:08.000 --> 24:12.780 They can connect with people compared to the technical guys. 24:12.880 --> 24:15.540 They are more friendly guys. 24:15.540 --> 24:20.440 They are more into human resources and they can connect with other people pretty easily. 24:20.440 --> 24:22.860 They speak a different language. 24:22.860 --> 24:27.780 So, it is always better to have non-technical people in our offensive team. 24:27.780 --> 24:29.200 It always helps. 24:30.440 --> 24:32.360 Could you please go to the next slide? 24:41.640 --> 24:43.320 Yeah, we have the next slide. 24:44.080 --> 24:50.660 So, this is the phase 2 of iHeartLaw, like internal team operations. 24:54.660 --> 24:56.320 So, a couple of points here. 24:56.340 --> 24:58.520 A couple of steps here. 24:59.100 --> 25:00.500 So, external infrastructure. 25:00.500 --> 25:04.360 It is always essential to mimic an adversary's actions. 25:04.360 --> 25:07.360 So, we need to build an external Red Team infrastructure. 25:07.880 --> 25:14.400 For the beginning, start with open source C tools, implants, frameworks, and other tools. 25:14.460 --> 25:18.560 We can modify it based on your requirements. 25:19.300 --> 25:21.320 Also, be friends. 25:23.380 --> 25:25.300 Okay, the third point. 25:25.300 --> 25:28.420 Identifying the business-specific risk. 25:28.420 --> 25:40.020 So, being in an internal Red Team is all about your organization and your organization's security posture, and deployed defense mechanisms, etc. 25:40.020 --> 25:47.180 So, it is a key point to identify the business-specific risk. 25:47.180 --> 25:52.040 It can vary based on the businesses and based on organizations. 25:52.760 --> 25:55.460 And the fourth point. 25:56.000 --> 25:59.720 Always be friends with the organization's Blue Team. 25:59.720 --> 26:03.440 If you have a Blue Team in your company, be friends with them. 26:03.440 --> 26:07.660 Just try to understand what they are doing in their daily lives. 26:07.660 --> 26:13.460 What are the tools and techniques which they are using for detecting the attackers. 26:13.460 --> 26:25.360 It is always good to be in a good relationship with your company's cyber defense system or cyber defense team. 26:26.400 --> 26:33.600 All of your organizational activities are there to make the Blue Team much stronger. 26:33.600 --> 26:39.340 So, it is very essential to have a good relationship with your cyber defense team. 26:41.080 --> 26:42.360 Okay. 26:42.700 --> 26:46.060 Also, don't take it personally. 26:46.120 --> 26:50.680 I just asked you to be friends with your organization's Blue Team. 26:50.680 --> 26:59.680 Once I tried to be friends with an organization's Blue Team, and in the end, she became my girlfriend. 26:59.680 --> 27:01.280 That's a long story. 27:01.280 --> 27:03.700 So, always don't try so hard. 27:03.700 --> 27:08.240 Just formally be friends with the Blue Team of your organization. 27:08.240 --> 27:10.260 Don't take it personally. 27:10.480 --> 27:12.480 Just a personal advice. 27:17.580 --> 27:18.560 Okay. 27:18.560 --> 27:20.420 Moving on to the next slide. 27:21.920 --> 27:23.420 Phase 3. 27:26.200 --> 27:28.800 Could you please go to the Phase 3 slide? 27:28.800 --> 27:30.080 Okay, Phase 3. 27:32.220 --> 27:37.140 Actually, this is where we begin to work in our plan. 27:37.140 --> 27:40.620 You can see, this is Phase 3 where we start working. 27:40.620 --> 27:43.840 So, we can use improved tools, techniques, and procedures. 27:44.800 --> 27:48.400 And we know about the current security mechanisms, right? 27:48.400 --> 27:53.460 We talked about current security mechanisms in Phase 1 and Phase 2. 27:53.980 --> 27:58.500 For example, the need of using improved TTPs. 27:58.700 --> 28:04.920 For example, what if your organization is not allowing PowerShell or any other scripts? 28:05.520 --> 28:08.840 That is where we need to improve our TTPs, right? 28:08.840 --> 28:16.860 Initially, we identified that the current organization, they do not allow PowerShell scripts or any other scripts, Wscripts, Cscripts, anything. 28:16.860 --> 28:18.420 They are not allowing anything. 28:18.660 --> 28:26.220 So, in that case, we need to make some changes in our techniques and improvise. 28:26.320 --> 28:29.940 We should find the next feasible option. 28:30.660 --> 28:41.630 For example, in this case, we can try running unmanaged PowerShell. 28:41.650 --> 28:49.790 Maybe the different systems, they are not considering unmanaged PowerShell executables as malicious. 28:49.890 --> 28:54.950 So, sometimes we can bypass the different mechanisms in there. 29:01.940 --> 29:08.740 From Phase 1 and 2, we had identified the Crown Jewels and Pupil. 29:08.900 --> 29:11.540 And the vulnerable path needs to be fixed. 29:11.540 --> 29:19.620 The vulnerable path which can lead the Crown Jewels into a breach. 29:20.780 --> 29:25.100 Also, the next point, evaluation of incident response process. 29:25.100 --> 29:27.100 This is also important. 29:27.100 --> 29:31.760 What is your organization's process once it's been compromised? 29:31.860 --> 29:36.180 How much time did it take to detect the incident and respond to it? 29:36.180 --> 29:38.860 That is also important, very much important. 29:40.100 --> 29:48.800 And using the output of the previous phases, we could really improvise and make a new RTO process documentation. 29:48.940 --> 29:55.940 There is a final point, we can learn from the previous phases. 29:55.940 --> 30:01.080 And what have we learned from the previous phases, we can improvise from that. 30:01.080 --> 30:07.660 And we can create a new operations manual or new operations process to move further. 30:07.660 --> 30:10.860 So, that is the end of Phase 3. 30:13.040 --> 30:18.940 Moving on to the next slide, Phase 4, IRTO Phase 4. 30:20.420 --> 30:23.400 We have the Phase 4 here. 30:25.320 --> 30:31.960 So, it's like, for example, collaborative and continuous Pupil team exercises. 30:31.960 --> 30:41.760 So, whatever tasks are being done by the red team, the end goal should be empowering the blue team, right? 30:42.240 --> 30:48.960 So, it's always better to organize a collaborative and continuous Pupil team exercises. 30:48.960 --> 30:53.260 Just join forces with the red teams and blue teams. 30:53.700 --> 30:57.280 Also, bring in more tooling capabilities. 30:57.280 --> 31:05.740 Many interesting platforms and tools are there, you know, we should empower the red teams and blue teams. 31:06.400 --> 31:14.360 Also, you can perform a targeted campaign, targeted and very specific campaigns against the crown jewels and key people. 31:14.360 --> 31:16.600 For example, business executives. 31:28.210 --> 31:33.070 You guys can still see my screen, right? 31:33.090 --> 31:38.850 Could you please give me some hearts if you can see the screens, I mean the slides? 31:41.270 --> 31:42.370 Okay, okay, okay. 31:42.370 --> 31:43.830 Awesome, awesome, awesome. 31:44.670 --> 31:49.710 Moving on to the next point, overt physical security assessment. 31:49.710 --> 31:57.190 We know that, you know, physical security assessment, they are a very big part of red teaming activities. 31:57.190 --> 32:03.830 So, we can, in phase three, phase four, we can start overt physical security assessment. 32:03.830 --> 32:13.210 We can identify the most important data centers, manufacturing plants, processing centers or anything based on your company's business. 32:13.210 --> 32:19.390 You know, it may differ, there may be, you know, different set of goals based on your company's portfolio. 32:20.790 --> 32:35.330 So, regarding the overt security assessment, you could just go to the premises, walk around the premises with the person in charge and perform your review in front of the, you know, in front of the reviewer as well. 32:35.390 --> 32:38.230 So, that is like, you are not breaking into anything. 32:38.230 --> 32:41.190 This is just overt physical security assessment. 32:41.250 --> 32:44.870 You are just going to the client side and you are just walking around. 32:44.870 --> 32:49.930 You are just trying to find as many as physical vulnerabilities in there and report them. 32:49.930 --> 32:51.650 It is as simple as that. 32:54.050 --> 33:00.970 So, you can, you know, as an example, you can refer the work of Devin Olam, you know, in YouTube. 33:00.970 --> 33:02.130 He is a legend. 33:02.130 --> 33:07.130 He is the very best guy out there regarding physical, you know, security assessments. 33:07.130 --> 33:08.590 He is really awesome. 33:12.240 --> 33:16.100 Also, continuous awareness program for employees and key people. 33:16.100 --> 33:25.740 Like, you know, after, for example, you have done a couple of phishing campaigns, fear phishing campaigns, you know, you did some bad ESP drop and everything. 33:26.100 --> 33:45.080 But from that, we need to share, we need to create a set of training series and we need to perform continuous awareness and training programs for employees and the top manager so that they can protect themselves from the future attacks of real adversaries. 33:45.080 --> 33:46.880 That is really important. 33:49.100 --> 34:03.500 Also, an operational tip, you know, when you go for a physical security assessment, do not show up with military apparel or a tactical bag along with a laptop which is full of hacking stickers. 34:03.840 --> 34:10.420 If you are going like this to the client side, you know, that raises a lot of eyebrows and that is going to be really funny. 34:10.420 --> 34:12.320 People will be looking at you all the time. 34:12.320 --> 34:18.000 Who is this guy, you know, wearing this tactical backpack and a laptop full of stickers? 34:18.280 --> 34:21.680 So that's kind of very, you know, attractive thing, right? 34:21.680 --> 34:26.440 So do not do that, even if you are doing a covert assessment or an overt assessment. 34:26.440 --> 34:27.780 It's pretty important. 34:30.920 --> 34:37.960 Going to the next slide, phase five, which is time to five. 34:38.660 --> 34:43.800 Okay, so this is the final phase of IRTO framework. 34:45.020 --> 34:53.620 By the time we reach phase five, we'll be having a kind of a matured team operations capabilities. 34:55.060 --> 34:59.020 It is the time to grow some wings and fly away, right? 34:59.020 --> 35:06.000 Not from the organization, but, you know, like capabilities wise, just, you know, fly away. 35:06.920 --> 35:11.220 This is the phase where we have a matured team operations capabilities. 35:11.940 --> 35:20.800 The main important thing would be by this time, you should have a significant improvement of organizational security posture. 35:20.800 --> 35:24.440 Because we have passed four different phases, right? 35:24.440 --> 35:28.740 We did many things, you know, from the phase one. 35:28.740 --> 35:38.240 So by the time we reach phase five, it is very important to have significant improvement of organizational security posture. 35:38.440 --> 35:45.880 So that is the clear proof of having a powerful and practical internal working. 35:46.240 --> 35:50.180 It is important for both systems and the key people. 35:50.980 --> 35:57.320 So you can also start, you know, covert physical security assessment, you know, instead of overt. 35:57.320 --> 36:04.040 You could just go to client sites without telling them you are an internal employee, you could do assessment. 36:04.240 --> 36:06.060 That will be very much fun. 36:06.060 --> 36:20.140 So also, by the time we reach phase five, we will have highly skilled operators and we will be having custom tools to create custom security patterns. 36:21.540 --> 36:26.160 Custom scripts and, you know, custom attack patterns. 36:26.160 --> 36:27.240 That is very important. 36:27.240 --> 36:30.620 That is very interesting capability to have. 36:31.460 --> 36:37.820 So also, continuous advisory simulation to keep the defendants on their toes. 36:37.820 --> 36:43.640 So by the time we reach phase five, we attend many things, right? 36:43.640 --> 36:50.320 And one of the things would be, one of the main thing would be having continuous advisory simulation. 36:50.520 --> 36:55.640 Just to make sure that everything is going very well with the organization. 36:57.320 --> 37:02.080 Finally, continuous routine operations with a very different process. 37:02.180 --> 37:08.620 As an end result, we also will be having a very different process to carry this task forward. 37:08.620 --> 37:12.600 You know, just repeat the process, make this as a cycle. 37:12.920 --> 37:20.000 You know, continuous routine operation will be like, you know, the actual results of, you know, reaching phase five. 37:20.000 --> 37:21.700 That is really important. 37:21.700 --> 37:34.860 So we can assume that by the time we reach the phase five, you know, there will be a lot of significant changes within our internal security posture. 37:34.860 --> 37:37.900 That is pretty important to have such a huge change. 37:39.880 --> 37:42.880 And moving on to the next slide. 37:53.280 --> 37:59.820 So the five phases which I have shown you, that is really customizable. 37:59.820 --> 38:05.920 Like, you know, you can change that to your own needs and you can add your own points. 38:05.920 --> 38:14.200 Even if you think that some of the points are misaligned in different phases, you can just modify the steps and you can make it your own. 38:14.200 --> 38:15.500 That is pretty simple. 38:15.920 --> 38:26.720 And coming back to the strategic and tactical plans, you can see, you know, there is a strategy plan, which is a total sum of a couple of tactical plans, right? 38:26.720 --> 38:37.100 So the strategy plans, they are focusing on long-term objectives, where the tactical plans focus on short-term engagements. 38:37.100 --> 38:44.400 So you can derive a couple of tactical plans and change them together, you know, just to reach the highest goal. 38:44.400 --> 38:50.160 For example, you are planning, you are creating a strategy plan for one year. 38:50.300 --> 38:53.700 So you can split that into three. 38:53.700 --> 39:00.280 So each tactical plan is having four months to attain a certain role, a certain goal. 39:00.280 --> 39:08.680 For example, earlier we mentioned, we need to identify the critical assets, key people and crown jewels, right? 39:08.680 --> 39:17.840 So for the tactical plan on, you can take that as an objective and you can start identifying the critical assets and people. 39:17.840 --> 39:24.760 Then you can try to, you know, perform adversarial simulation against those assets and people. 39:24.760 --> 39:28.400 Just to identify, you know, are they vulnerable to phishing campaigns? 39:28.440 --> 39:29.440 What are the results? 39:29.440 --> 39:33.360 And we got a couple of credentials from these people. 39:33.360 --> 39:35.900 What are the privileges for these credentials? 39:36.020 --> 39:44.120 So by the end of the tactical plan one, you will have a clear set of reports, you know, for your very first objective. 39:44.120 --> 39:52.300 So like that, we can, you know, change a couple of tactical plans to have a very long-term objective. 39:52.600 --> 39:58.900 You know, that is the end goal of creating this IRTO platform. 39:58.900 --> 40:02.440 You can create your own plans and both tactical and strategy. 40:02.440 --> 40:06.380 Our end goal should be, you know, attaining the long-term objective. 40:10.110 --> 40:11.310 Okay, cool. 40:11.830 --> 40:14.070 Could you go to the next slide, please? 40:20.800 --> 40:23.640 Okay, this is the final slide. 40:23.640 --> 40:34.460 If you guys have any questions related to, you know, the team like faces and maturity models, you know, please feel free to ask me. 40:36.450 --> 40:42.290 If you have any questions, you could just send some hearts and we can start talking. 40:45.210 --> 40:46.410 Anyone? 40:48.690 --> 40:53.350 Oh, okay. 40:54.510 --> 41:01.390 Okay, so all those who have questions, please give some heart reacts so that I can unmute you all. 41:04.460 --> 41:06.600 Actually, I can't hear you. 41:06.600 --> 41:08.560 Yeah, I can see and strike. 41:08.560 --> 41:09.360 Just a second. 41:21.880 --> 41:23.920 Could you please come near me? 41:23.920 --> 41:25.760 I can't hear you. 41:30.970 --> 41:31.990 Can you hear me? 41:33.210 --> 41:35.170 Yeah, tell me. 41:36.170 --> 41:43.010 So, do you model your adversarial campaigns off of APTs? 41:44.710 --> 41:46.990 Could you please come again? 41:47.330 --> 41:52.530 Do you model your adversarial campaigns off of APTs? 41:53.830 --> 41:56.250 Yeah, APT emulation, right? 41:56.250 --> 41:57.330 Yes. 41:57.330 --> 42:02.610 Yeah, we can, because I think I stated in one of my previous slides. 42:03.370 --> 42:06.090 That is in phase two, I think. 42:06.430 --> 42:07.070 Okay. 42:07.070 --> 42:09.190 This adversarial emulation. 42:09.730 --> 42:18.890 So, I mean, as a beginning in phase two, you can start doing emulation using, you know, Atomic Red Team or Caldera. 42:18.890 --> 42:21.770 Also, you can use Mitre framework. 42:21.870 --> 42:25.190 You know, there are a couple of APTs listed in there. 42:25.190 --> 42:33.490 You can, you know, check those APTs and start collecting their commands and you can execute them in your, you know, test environment. 42:33.650 --> 42:39.550 So, the end result would be, you can understand the detection capabilities of your Blue Team. 42:39.550 --> 42:40.950 That is really cool. 42:40.950 --> 42:48.010 Mitre is doing a wonderful job, you know, collecting all these emulation and, you know, simulation plans. 42:48.830 --> 42:49.790 Okay, cool. 42:49.790 --> 42:50.390 Thank you. 42:50.730 --> 42:52.170 Yeah, thank you. 43:01.040 --> 43:04.320 So, you could always reach me on... 43:11.920 --> 43:14.260 Is anyone asking any questions? 43:15.460 --> 43:18.940 Could you please raise your hands or, like, you know, give me some hearts? 43:19.100 --> 43:20.540 I'll come near you. 43:25.680 --> 43:27.060 Could you throw some hearts? 43:27.060 --> 43:29.140 I'll come to you. 43:34.270 --> 43:35.190 Okay. 43:35.330 --> 43:39.650 So, if there are no questions, you can always reach me on Discord. 43:40.010 --> 43:42.110 It is abh1474. 43:42.110 --> 43:47.930 Also, you can reach me on my Twitter account, which is abhijitbr. 43:49.030 --> 43:49.510 And... 43:50.350 --> 43:52.810 Could you guys please move to the next slide? 43:59.270 --> 44:00.270 Next slide, please. 44:00.270 --> 44:00.910 Okay. 44:01.330 --> 44:03.330 And, yeah, thank you, everyone. 44:03.330 --> 44:04.650 Thank you for being here. 44:04.650 --> 44:07.270 Thank you to attend my talk. 44:07.330 --> 44:13.270 Thanks a lot, everyone, for, you know, being in the virtual village hosted by DEF CON groups. 44:13.350 --> 44:14.510 Thanks a lot. 44:14.510 --> 44:26.570 Also, I would like to, you know, thank Jason Eastridge and DEF CON groups to give me this opportunity to stand here and take this presentation. 44:26.850 --> 44:33.010 Also, I would like to thank TX and his fabulous DEF CON group, Delphi. 44:33.190 --> 44:36.030 Also, DEF CON group Trivandrum, Mumbai. 44:36.350 --> 44:37.110 Thank you. 44:37.110 --> 44:38.190 Thank you, everyone. 44:46.340 --> 44:48.920 Okay, so... 44:48.920 --> 44:49.640 Okay.