1
00:00:00,000 --> 00:00:02,220
at the golden age of Insider Threats.

2
00:00:02,220 --> 00:00:04,380
I'm Adam Macinci, that's Bryson Bort.

3
00:00:04,380 --> 00:00:06,660
We'll introduce ourselves again here in a second.

4
00:00:07,040 --> 00:00:18,980
And just before we get started on anything else, yes, it is known to be misspelled kind of intentionally because it's you are the adversary within because it's about Insider Threats.

5
00:00:18,980 --> 00:00:20,020
It's a joke.

6
00:00:20,020 --> 00:00:21,960
We're paid to hack things, not tell jokes.

7
00:00:21,960 --> 00:00:23,020
Not tell jokes.

8
00:00:23,380 --> 00:00:24,700
It's not great.

9
00:00:24,700 --> 00:00:27,460
Anyway, real quick, who am I?

10
00:00:27,460 --> 00:00:28,840
I'm Adam Macinci.

11
00:00:28,960 --> 00:00:30,700
I do all sorts of stuff.

12
00:00:30,700 --> 00:00:33,620
I volunteer and speak with the Red Team Village.

13
00:00:33,620 --> 00:00:34,740
I do their one-on-one track.

14
00:00:34,740 --> 00:00:36,420
I'm a member of the C2 Matrix.

15
00:00:36,520 --> 00:00:38,760
I'm the head of product management at Scythe.

16
00:00:38,760 --> 00:00:42,260
I've got a background in enterprise solutions and crypto and privacy and whatever.

17
00:00:42,260 --> 00:00:43,200
That's me.

18
00:00:43,320 --> 00:00:45,360
And also here's Bryson.

19
00:00:45,820 --> 00:00:47,220
Ash said a lot of words.

20
00:00:47,220 --> 00:00:49,020
He's our token Californian.

21
00:00:50,080 --> 00:00:57,120
I founded Grimm eight years ago to build the best team of hackers because this is no longer an individual sport.

22
00:00:57,120 --> 00:00:58,320
It's a team sport.

23
00:00:58,320 --> 00:01:00,000
Defenses have gotten really good.

24
00:01:01,540 --> 00:01:04,720
About two years ago, I spun out Scythe.

25
00:01:04,940 --> 00:01:08,960
That's my full-time job for an adversary emulation platform where I work with MASH.

26
00:01:09,020 --> 00:01:12,160
And then I'm a co-founder of the ICS Village non-profit.

27
00:01:12,460 --> 00:01:16,060
So hopefully you have a chance here at DEF CON to also check out the ICS Village.

28
00:01:19,130 --> 00:01:20,250
All right.

29
00:01:20,510 --> 00:01:31,350
And so what we'll be talking about today is a bunch of things, not only Insider Threats, but also the value of post-exploitation and why that's important philosophically.

30
00:01:31,370 --> 00:01:39,650
And we'll talk about defense validation through threat emulation and why focusing on endpoints from a red team and from a blue team and from a purple team perspective is important.

31
00:01:39,890 --> 00:01:50,270
And obviously, Insider Threats and why their lives are a little easier than most folks when it comes to being adversaries and why boards and leadership cares and why defenders are overwhelmed.

32
00:01:50,270 --> 00:01:57,770
And then we'll talk about the cycle of red and blue working together towards purple teaming and why this is all relevant from an Insider Threat perspective.

33
00:01:58,150 --> 00:02:03,510
So first off, let's talk about the value of post-exploitation.

34
00:02:03,510 --> 00:02:14,470
And this is kind of a bit of a philosophical argument for us, but we generally have the following three principles that we as the InfoSec community just feel to be true.

35
00:02:14,470 --> 00:02:16,870
So one, it's not if, but when.

36
00:02:16,870 --> 00:02:20,930
So everybody has the potential to be compromised and it will inevitably happen.

37
00:02:20,930 --> 00:02:24,010
Every organization has the ability to be compromised.

38
00:02:24,450 --> 00:02:26,850
Two, there will always be zero days.

39
00:02:26,850 --> 00:02:28,430
There will always be end days.

40
00:02:28,550 --> 00:02:33,910
There will always be bugs in software, which creates a new exploit and that will always be the case.

41
00:02:34,010 --> 00:02:40,490
And then finally, social engineering and Insider Threats, to whatever degree you want to count that, will always work.

42
00:02:40,490 --> 00:02:44,090
There's always someone who will click the email link.

43
00:02:44,090 --> 00:02:45,890
There will always be someone who plugs in the thumb drive.

44
00:02:45,890 --> 00:02:49,110
That is inevitable and there's a lot of reasons for that.

45
00:02:49,110 --> 00:03:01,550
So if we believe those principles to be true, then kind of philosophically, post-exploitation behaviors from an adversary's perspective is more important than the exploit itself.

46
00:03:01,550 --> 00:03:04,930
It doesn't matter all the CVEs that we use to get in.

47
00:03:04,930 --> 00:03:07,410
It's what the adversary does once they are in.

48
00:03:07,410 --> 00:03:10,270
That's the thing that's more important philosophically.

49
00:03:10,330 --> 00:03:12,050
There's also two layers to this.

50
00:03:12,050 --> 00:03:16,110
So if you think about this simply, we're talking about access.

51
00:03:16,390 --> 00:03:28,250
Access, typically, people think of the antiquated way of, I have a perimeter and a third party has gained unauthorized access.

52
00:03:28,250 --> 00:03:29,750
And that is part of it.

53
00:03:29,750 --> 00:03:40,230
And so what you can summarize this is, is the ability to gain access is across an infinite scope of possibility because it's not just technical.

54
00:03:40,230 --> 00:03:42,450
It is a question of people and technology.

55
00:03:42,450 --> 00:03:47,010
The second part of access is there's also access within the organization.

56
00:03:47,010 --> 00:03:58,630
So once I've breached the perimeter, once I've compromised, then I'm still working the access problem in an iterative way as I try to work from where I am to where I want to go.

57
00:03:58,630 --> 00:04:05,510
And each one of those steps starts with that access problem, which again, can be solved through technical or social means.

58
00:04:06,730 --> 00:04:12,890
And this is all particularly pertinent when we're talking about it from a red team perspective.

59
00:04:12,890 --> 00:04:18,810
So for example, if we take a red team are performing an adversary test and we take the following two scenarios.

60
00:04:18,810 --> 00:04:27,110
So in the first scenario, they take a custom binary that they've made and they detonated on an endpoint during this engagement.

61
00:04:27,110 --> 00:04:29,790
Well, they've been caught and that's been burned.

62
00:04:29,790 --> 00:04:36,010
So that's a valid test of a security control that an unsigned piece of malware was able to be caught.

63
00:04:36,010 --> 00:04:37,370
That's a good thing.

64
00:04:37,490 --> 00:04:52,630
But an equally valid test from a red team perspective is creating that same custom piece of malware and then putting it in an allow list for that specific binary and then having it go through and not be caught and letting the behavior run after the fact.

65
00:04:52,630 --> 00:05:10,810
These are equally valid tests because in the first one, you validated the security control of do you block unsigned things that are potentially malicious, but in the latter, you're running an O day or an N day scenario as if that thing was able to work its way into being allowed and then fire its behavior after the fact.

66
00:05:10,810 --> 00:05:15,610
So it's important to point that out that these are equally valid tests from a red team perspective.

67
00:05:16,990 --> 00:05:20,810
So the other part here is we're validating our assumptions.

68
00:05:20,810 --> 00:05:29,150
I can't tell you how many conversations I've had with folks where we go in and they're like, oh, you know, we're paying this amount of money for this and we know it does this.

69
00:05:29,370 --> 00:05:30,070
Well, how do you know?

70
00:05:31,270 --> 00:05:32,070
Try it.

71
00:05:32,070 --> 00:05:32,910
Check it.

72
00:05:33,010 --> 00:05:37,630
Once you do that, you're building up that arsenal of validating those assumptions and keeping it going.

73
00:05:39,490 --> 00:05:43,950
Another way to look at this is it's like being an APT on the cheap.

74
00:05:43,950 --> 00:05:56,230
By proving the control works and then using configuration like allow list to allow something to go past control, that's the equivalent of a technical compromise like what an APT can do, right?

75
00:05:56,230 --> 00:05:57,770
We assume that they can do that.

76
00:05:57,770 --> 00:05:59,950
It's a question of if, not when.

77
00:05:59,950 --> 00:06:07,970
And by doing that allow list, you just, for free, with little effort, achieve the same goal as what that APT can.

78
00:06:11,890 --> 00:06:20,570
So with all that in mind, let's talk about insider threats and what's specific to them when we talk about insider threats from a red team perspective.

79
00:06:20,850 --> 00:06:25,690
And specifically, let's talk about today's endpoints.

80
00:06:25,690 --> 00:06:29,970
So for the sake of this conversation, an endpoint is something that a user interacts with.

81
00:06:29,970 --> 00:06:33,650
So it's not like a web app or a web server or something like that or an S3 bucket.

82
00:06:33,650 --> 00:06:38,810
This is something that figures on keyboard, somebody's actually utilizing.

83
00:06:38,850 --> 00:06:52,190
And the reason we're focusing on this, especially from an insider threat perspective, is not only is this most likely what the user will be interacting with as an insider threat, but also this is where we see the majority of organizations compromised from.

84
00:06:52,190 --> 00:06:55,690
This is the phishing links and everything according to there.

85
00:06:55,690 --> 00:07:05,110
And ultimately, you know, all these systems are in place to try to protect users from all sorts of malicious stuff and patches are important and all these things are true.

86
00:07:05,110 --> 00:07:08,850
However, humans are difficult to secure.

87
00:07:08,850 --> 00:07:13,110
People are curious, they're willing to give out their password for a candy bar.

88
00:07:13,110 --> 00:07:16,830
Phishing is something that's really difficult to get rid of entirely.

89
00:07:16,830 --> 00:07:21,230
People plug USB drives into stuff all the time because of curiosity.

90
00:07:21,230 --> 00:07:30,330
And then taking it a step further, as an organization, you probably have all sorts of third parties and all sorts of vendors whose technology you're utilizing.

91
00:07:30,330 --> 00:07:36,210
And when they come on site, how do you make sure that the security controls that you have for your staff apply to them?

92
00:07:36,210 --> 00:07:39,590
And this is a very difficult problem to solve, as it turns out.

93
00:07:40,550 --> 00:07:49,290
So with this all said, we're down to these couple of points from an endpoint perspective, which is endpoint usage is really difficult to monitor.

94
00:07:49,470 --> 00:07:53,030
And it's particularly difficult to emulate.

95
00:07:53,030 --> 00:07:58,710
And to reiterate here, humans are random, they do all sorts of random things.

96
00:07:58,710 --> 00:08:06,130
And figuring out how to monitor for theoretically random behavior, even though that humans have trends, it can be very difficult to do.

97
00:08:06,130 --> 00:08:12,530
And then it's also tricky to emulate a perfect user in that way, because people do random stuff all the time.

98
00:08:12,530 --> 00:08:21,250
And they, especially when they're interacting heavily with a laptop, say, well, you can't always reliably and predictably say what a given user may or may not be browsing to.

99
00:08:21,350 --> 00:08:25,130
So it's just those are important to remember as we move forward.

100
00:08:25,570 --> 00:08:34,690
And to preface this upcoming slide, we love privacy and security and encryption, these are all good things that we believe in philosophically.

101
00:08:34,690 --> 00:08:42,030
But it becomes a little tricky when we talk about securing and specifically monitoring end users.

102
00:08:42,190 --> 00:08:57,170
So this has created a world because of the usability of encryption and privacy and all these pieces of technology, where it's kind of the best time ever to be an insider threat actor, they have a lot of capabilities at your disposal.

103
00:08:57,370 --> 00:09:07,670
And so just to call out a few, let's look at Firefox's scent, which is unfortunately been taken offline, because it was being used maliciously, of course.

104
00:09:07,670 --> 00:09:19,730
But for a long time, like almost a year, we had the ability for a high reputation domain that allowed end to end encrypted exfiltration and delivery of arbitrary things in another networks.

105
00:09:19,730 --> 00:09:22,370
Now, this is a great user privacy tool.

106
00:09:22,370 --> 00:09:25,670
But consequently, it was also be used to like deploy malware.

107
00:09:25,670 --> 00:09:27,370
And that's why it's now offline.

108
00:09:27,370 --> 00:09:41,510
And the same is true for all sorts of VPN technology, whether it's cloud flares, 1.1.1.1 plus warp, this is just instant VPN, DNS security at the consumer level.

109
00:09:41,510 --> 00:09:46,450
And these are things that we now like bring your own devices one clearly.

110
00:09:46,450 --> 00:09:50,030
And so everybody has these abilities running in the user space on their own devices.

111
00:09:50,070 --> 00:09:54,330
And it just allows for a lot of exfiltration events outside of an organization.

112
00:09:54,330 --> 00:10:00,870
So like MDMs have essentially lost, there is no real enterprise mobility solution.

113
00:10:00,870 --> 00:10:08,070
And then you pair all of these consumer technologies with the fact that enterprises are just using more cloud based technology.

114
00:10:08,070 --> 00:10:11,870
Well, that's instant high reputation exfiltration right there.

115
00:10:11,870 --> 00:10:30,990
So whether it's legitimate cloud use of Google Apps, or being able to use things like Dropbox, or what have you to steal data out, like who's going to block Google Drive in an enterprise that uses Google Drive, this is just opening up all these doors for insider threats to steal stuff out of a network.

116
00:10:31,850 --> 00:10:34,690
And of course, we now have the elephant in the room.

117
00:10:35,070 --> 00:10:40,190
In the pandemic era, 60% of all workers are remote.

118
00:10:40,510 --> 00:10:51,090
So you no longer have to worry about the challenge of how do I physically remove assets into a safe location because your safe location is already at home.

119
00:10:51,310 --> 00:10:58,930
So we now have, this is where we've seen a lot of enterprises moving to the cloud because it's a bandaid for security.

120
00:10:59,030 --> 00:11:09,990
Certainly VPN usage has bumped up because well, at least I can encrypt the corporate asset in the home environment to the corporate environment.

121
00:11:10,090 --> 00:11:26,530
And what I would offer just for some little extra free advice is think of the using least privilege in these circumstances, have them log into a essentially a demilitarized zone of minimum privilege access, and then they validate out of that to go further into the infrastructure.

122
00:11:26,530 --> 00:11:29,170
So offering those kinds of things slow them down.

123
00:11:29,230 --> 00:11:32,850
The other challenge we have here is around testing this.

124
00:11:33,090 --> 00:11:37,450
We are now talking about a mixed environment where it's no longer just corporate assets.

125
00:11:37,450 --> 00:11:42,310
We now have corporate assets in a private asset environment, right?

126
00:11:42,310 --> 00:11:43,690
Who owns that router?

127
00:11:43,690 --> 00:11:45,370
Who owns those other devices on that network?

128
00:11:45,370 --> 00:11:52,890
Those are the employees' personal devices and it makes it difficult to bring that in scope for a test.

129
00:11:53,630 --> 00:12:05,370
And this also ties into the challenge, of course, back in the old days where we did have BYOD where a lot of folks didn't necessarily have policies around that.

130
00:12:05,370 --> 00:12:14,070
And being able to identify IoT traffic and specific device fingerprinting is a very challenging problem.

131
00:12:16,960 --> 00:12:30,640
And that really leads us to the fact that although trust is critical, and we can't emphasize this enough, it's not only critical, but it's arguably more critical than ever.

132
00:12:30,640 --> 00:12:40,340
Because monitoring solutions, there's a whole suite of offerings in a pre-COVID-19 era.

133
00:12:40,340 --> 00:12:48,940
But now that everyone's at home, monitoring is an even trickier solution to try to implement when you have all these deployed endpoints in all sorts of different places.

134
00:12:48,940 --> 00:13:00,420
And so trusting your employees is critical because there's fewer and fewer ways to modify the things that you're doing and monitor always explicitly.

135
00:13:00,420 --> 00:13:11,060
And to all the things that Bryson just said, it's about restricting access now, not so much monitoring for every keystroke or every bit of browsing bit that goes on.

136
00:13:11,060 --> 00:13:25,480
And so we think about allow requirements, we think about how folks can circumvent blocks and all of these things, where we're now having to play whack-a-mole with all of the possible consumer solutions as well that come from legitimate providers and legitimate domains.

137
00:13:25,480 --> 00:13:27,700
This is very, very tricky.

138
00:13:27,700 --> 00:13:39,080
And so one of the ways I think about it is, it's not even so much like how do you prevent, or how do you emulate the APT or the highly motivated adversary?

139
00:13:39,080 --> 00:13:45,840
Instead, I think of it as how do you even prevent exfiltration from a slightly motivated adversary?

140
00:13:45,840 --> 00:13:53,100
Someone who doesn't necessarily know how to roll their own crypto, but they can download a VPN app on their device and turn it on.

141
00:13:53,100 --> 00:13:57,940
They have a motivation, they're just not highly motivated.

142
00:13:57,940 --> 00:14:01,280
And so that's where we get this idea of the slightly motivated adversary.

143
00:14:01,280 --> 00:14:04,340
And what to do about that scenario can be very, very tricky.

144
00:14:09,740 --> 00:14:16,580
So with all that about insider threats wrapped up, how do we think about all this from a red team perspective?

145
00:14:16,580 --> 00:14:21,080
Well, the good news, I mean, good news for the red team, maybe not so much for the blue.

146
00:14:21,540 --> 00:14:32,000
The red team can use all these principles and philosophical paradigms that we're in to create adversary scenarios that use all the advantages of these things.

147
00:14:32,000 --> 00:14:43,640
So this is things running in the user space, things running at runtime, no exploitation required, because if you're simulating an insider threat, well, they probably have the ability to double click something on their endpoint.

148
00:14:43,640 --> 00:14:52,540
And they're not necessarily doing so because they were tricked into doing it, they did it because they wanted to, and they're willing to kind of take a couple steps in order to achieve that goal.

149
00:14:55,670 --> 00:15:11,950
So now for the red teamer who's creating a campaign, they could do what the malware authors do, where they design things around, well, what are the capability of a slightly motivated adversary, so they can run in the user space, they've got access to valuable data,

150
00:15:11,950 --> 00:15:17,890
like, you know, their documents folder is probably important, there's probably some PII set more on that drive.

151
00:15:17,890 --> 00:15:23,790
Well, they also have access to those things and publicly accessible exfiltration tools, Pastebin.

152
00:15:23,790 --> 00:15:26,090
How many organizations have Pastebin allowed?

153
00:15:26,090 --> 00:15:30,470
Like, that's an exfiltration tool from a slightly motivated attacker perspective.

154
00:15:30,610 --> 00:15:46,490
And not only that, the red team also has on top of those capabilities, knowledge of ODAs and NDAs, knowledge about how to automate these things, deploy infrastructures to do more advanced exfiltration techniques, they know how to obfuscate, they know how to be more anonymous.

155
00:15:46,490 --> 00:15:52,210
So you ratchet these things together and you think, what do you get for free by pretending to be an internal adversary?

156
00:15:52,210 --> 00:15:54,950
And then you put on top of that all the stuff you could do as a red teamer.

157
00:15:54,950 --> 00:15:59,890
Well, that creates a very exciting scenario from a red team adversary perspective.

158
00:16:00,970 --> 00:16:07,790
Talking about Pastebin and executing in user space, check out the Blue Team Choose Your Own Adventure.

159
00:16:07,790 --> 00:16:13,950
We did a short Choose Your Own Adventure that involves ransomware that takes advantage of those.

160
00:16:15,730 --> 00:16:17,810
Yeah, that's an excellent point in and of itself.

161
00:16:17,810 --> 00:16:25,950
If we think about modern ransomware, you don't need to run as admin to do modern ransomware, like end users can create and delete files.

162
00:16:25,950 --> 00:16:27,410
They have permissions to do that.

163
00:16:27,410 --> 00:16:30,630
And ransomware says, great, I want to create and delete files, right?

164
00:16:30,630 --> 00:16:31,510
That's the point.

165
00:16:31,510 --> 00:16:36,490
It's all these things are in the user space, and you just get them for free, thinking of as an adversary does.

166
00:16:36,830 --> 00:16:42,730
So now that we know all the advantages, what can the red and blue teams do about it?

167
00:16:42,730 --> 00:16:53,070
Because the slightly motivated adversary is very, very powerful, and they have the ability to both accidentally and intentionally compromise endpoints.

168
00:16:53,130 --> 00:17:02,130
And given that the blue team now has to think about everything from a disgruntled staffer to an APT, well, that's a pretty big scope.

169
00:17:02,130 --> 00:17:11,550
Actually, I don't... Bryson, I don't know if I fully get your Joe Rogan, Elon Musk image on this one.

170
00:17:11,870 --> 00:17:20,050
Yeah, so what I was going for here was you got a picture of Elon Musk as the disgruntled staffer, and he's sitting there at home.

171
00:17:21,270 --> 00:17:23,790
I was employee 53.

172
00:17:23,790 --> 00:17:29,150
They don't take me seriously enough.

173
00:17:29,150 --> 00:17:31,530
They don't respect me, and I'm gonna quit.

174
00:17:31,530 --> 00:17:37,610
I'm gonna burn this place to the ground, and this is him taking his red stapler on the way out while it burns.

175
00:17:40,260 --> 00:17:41,180
Fair enough.

176
00:17:41,180 --> 00:17:43,260
There's your disgruntled role play.

177
00:17:43,260 --> 00:17:44,780
Yeah, that's good.

178
00:17:45,280 --> 00:17:52,660
I mean, defining Elon Musk as a staffer might be a bit of a stretch, but the analogy certainly plays.

179
00:17:52,660 --> 00:17:58,760
But given that that is inside a threat model for a blue team, that can be incredibly tricky, right?

180
00:17:58,760 --> 00:18:02,160
And so what do we do with all this?

181
00:18:02,160 --> 00:18:06,820
Well, an answer to this is shoring up the fundamentals.

182
00:18:06,820 --> 00:18:24,220
So it's not so much like would you detect a foreign country inside your organization slowly beaconing little documents over the course of years over DNS, but thinking about, well, would you notice standard exfil if someone started dumping gigs of data out in the middle of the night?

183
00:18:24,220 --> 00:18:27,100
These sorts of fundamentals are really important.

184
00:18:27,120 --> 00:18:36,820
And thinking about validating the controls and validating those tests in a repeatable way via adversary testing, this is that red and blue team working together.

185
00:18:37,660 --> 00:18:47,340
So real quick, before we dive deeper on that, I do want to make a quick note about the vendor industry on this one, which is a little awkward.

186
00:18:47,860 --> 00:18:58,640
So if we think about breach and attack simulation as a thing, so that is a Gartnerism that is way overly broad, and it can mean a wide variety of things.

187
00:18:58,640 --> 00:19:01,440
But generally speaking, we think of it as kind of spectrum.

188
00:19:01,440 --> 00:19:05,100
And on one end of the spectrum, we have controls validation tools.

189
00:19:05,100 --> 00:19:12,020
So these are agent-based things that repeat known signature actors and traffic in these sorts of PCAP replays and what have you.

190
00:19:12,020 --> 00:19:15,320
And then on the other end of the spectrum is more advanced adversarial testing.

191
00:19:15,320 --> 00:19:18,840
And there's a whole simulation versus emulation argument that we could talk about.

192
00:19:18,840 --> 00:19:23,320
And these are the kinds of tools on the other side that the red teams in Pentesters use.

193
00:19:23,380 --> 00:19:28,660
And there's all these sorts of other things we could talk about, like how they align to MITRE ATT&CK and why that's important.

194
00:19:28,700 --> 00:19:45,580
But for the most part, all of these things inside of the spectrum do satisfy this idea of assumed compromise and assumed breach scenarios, regardless of whether or not you're compiling something via MS Venom and Metasploit, or whether you're using a breach and attack simulation tool.

195
00:19:45,580 --> 00:19:49,460
You could use both of these things in an assumed compromised way.

196
00:19:49,460 --> 00:19:54,040
And that's worth noting about this whole spectrum of tools.

197
00:19:57,800 --> 00:20:03,480
I mean, the only thing I'd jump on here is where I throw out that MITRE ATT&CK is not a bingo card.

198
00:20:04,900 --> 00:20:20,600
What I mean by that is what MITRE ATT&CK is a great compendium of understanding all of the correction, a lot of the elements, because it may never be complete, of a common vernacular for us to describe attacks.

199
00:20:20,900 --> 00:20:22,700
You can't use it as a checkboard.

200
00:20:22,700 --> 00:20:26,320
You're like, I have successfully made sure that this can never happen.

201
00:20:26,620 --> 00:20:28,380
T1033 will never happen.

202
00:20:28,720 --> 00:20:31,060
That's the wrong way to look at it.

203
00:20:31,060 --> 00:20:35,820
And part of that is because I like to describe it as a periodic table.

204
00:20:35,820 --> 00:20:38,440
And the attacks in it are different elements.

205
00:20:38,440 --> 00:20:43,280
And the way and the order that those elements are combined is a chemical equation.

206
00:20:43,280 --> 00:20:48,340
And whether you get lead or gold depends on that order.

207
00:20:48,620 --> 00:20:59,040
And so the point being is that a static look of particular elements without understanding the context that they're in changes what that means.

208
00:20:59,040 --> 00:21:05,820
My ability to do lateral movement is going to be affected by whether or not I have credentials or not, for example.

209
00:21:06,940 --> 00:21:08,220
Simple example.

210
00:21:11,560 --> 00:21:24,120
And when we think about these sorts of chemical elements like Bryce is describing, and these sorts of things are accidentally using it as a bingo card, well, this can be exceptionally tempting when we're talking about something like a controls validation solution,

211
00:21:24,120 --> 00:21:33,540
where it's automatically testing whether or not you can send data to something that's known as evildomain.com over these firewall ports and all these sorts of things.

212
00:21:33,540 --> 00:21:44,600
Well, you can define these rules in the controls validation tool and have it automatically test those things over and over and over again and let you know if your configuration management's falling over and that sort of thing, which is all very valuable.

213
00:21:44,600 --> 00:21:51,440
But it is tempting to just say, oh, we're tagging, we're looking for that port for exfiltration, we're done with that MITRE ATT&CK ID.

214
00:21:51,580 --> 00:21:57,100
And again, it's important to note that these controls validation tools are very static.

215
00:21:57,100 --> 00:21:59,740
They're agent-based, they're signature-based.

216
00:21:59,740 --> 00:22:05,180
And kind of most important from our perspective, we're talking about internal adversaries and insider threats.

217
00:22:05,180 --> 00:22:07,900
These aren't production endpoints that these things are installed on.

218
00:22:07,900 --> 00:22:12,620
These things aren't simulating users or internal threat actors, necessarily.

219
00:22:12,620 --> 00:22:18,920
They're just doing, here's some analysis from the threat intel community, fire for effect, here's a PCAP.

220
00:22:19,020 --> 00:22:23,760
So it's not exactly what we're talking about here from an insider threat emulation perspective.

221
00:22:27,220 --> 00:22:34,300
Just to kind of finish that off, there's no people in the loop on this one, right?

222
00:22:34,300 --> 00:22:37,380
It's about automating these solutions and detecting these sorts of things.

223
00:22:37,380 --> 00:22:41,100
And so it is repeatable, and it is easy to implement these controls validation tools.

224
00:22:41,100 --> 00:22:45,520
But ultimately, they're not really something that the red team is going to utilize.

225
00:22:45,680 --> 00:22:49,080
And they're more about unit testing than adversary behavior.

226
00:22:49,080 --> 00:22:56,280
And often these are unfortunately at the mercy of the vendor, because the vendor is the thing that's pulling down the threat intel.

227
00:22:56,280 --> 00:23:03,300
It says, these are all the tests you can run, you might have very limited ability to change them a bit , but it's not a customizable tool.

228
00:23:03,300 --> 00:23:08,300
So that's a concern when we're thinking about controls validation from an insider threat perspective.

229
00:23:08,900 --> 00:23:13,240
The only thing I'll add there is what's at the top is that people are not in the loop.

230
00:23:13,240 --> 00:23:25,420
And what we mean by that is that these are great detection engineering tools, but you're not including the user affecting the behavior around looking at what those technical controls do or don't do.

231
00:23:25,440 --> 00:23:35,960
And then the second part is you're not able to measure the response, because it's a set stage for what your sock is looking at.

232
00:23:36,140 --> 00:23:46,520
But I think it was also a bit glossed over on what the pros here with change control, your ability to know what you're always going to see and building that library out.

233
00:23:46,720 --> 00:23:54,620
We take it for granted that things work the way that they're supposed to work, and that our challenge is finding attackers in that noise.

234
00:23:54,620 --> 00:24:03,140
There is also the challenge that tools break, configurations drift, things stop working for various reasons.

235
00:24:03,140 --> 00:24:08,540
And so knowing for sure what I'm looking for, be able to identify that is a significant value proposition.

236
00:24:12,580 --> 00:24:24,080
And so with all that in mind from a controls validation benefit, like cost benefit evaluation, let's look at the other kinds of tooling that we mentioned, which is adversary testing or adversarial testing.

237
00:24:24,080 --> 00:24:28,540
And so again, for the sake of this discussion, an adversarial test is more about behavior.

238
00:24:28,540 --> 00:24:34,660
And we've been talking about post exploitation behavior specifically, whereas a pen test is often focused on those exploitations.

239
00:24:34,660 --> 00:24:43,320
So here, it's about a red team creating a scenario where they can validate and see what the network defenders would notice.

240
00:24:43,320 --> 00:24:45,140
So will they notice exfiltration?

241
00:24:45,140 --> 00:24:46,720
Will they notice lateral movement?

242
00:24:46,720 --> 00:24:52,460
Will they notice if I increase my beacon heartbeats or the randomization of those heartbeats, that sort of thing.

243
00:24:52,460 --> 00:25:04,180
And this allows the red team or third party pen test or red teaming firm to test these things and to see if they can get an initial foothold and see what the remediation time on that looks like.

244
00:25:04,180 --> 00:25:08,820
And they can also define whatever artifacts they may choose to leave.

245
00:25:08,820 --> 00:25:20,880
So you could say, well, we think that in this kind of threat scenario, someone may want to... the adversary would drop this folder, or they would they try to create this key and leave that on an endpoint.

246
00:25:20,880 --> 00:25:23,860
Those can be predefined with an adversary test.

247
00:25:24,020 --> 00:25:31,740
And so moving a little further down that rabbit hole, these things are highly customizable, which can be a good and a bad thing.

248
00:25:31,740 --> 00:25:37,320
The more time a red team takes to create them, the more difficult it can be to replicate them.

249
00:25:37,320 --> 00:25:42,720
And especially when it comes to the idea of a blue team might want to remediate this thing and then test it again.

250
00:25:42,720 --> 00:25:47,960
Well, the more complex it was to create it, the more difficult it is to test it and validate it again.

251
00:25:47,960 --> 00:25:59,880
So although there's a lot of flexibility from creating these sorts of engagements that are very red team adversarial focused, they are fairly technical, there's a high learning curve, and they tend to be more expensive.

252
00:25:59,880 --> 00:26:04,300
And then finally, one of the cons for them is that they are very limited snapshot in time.

253
00:26:04,400 --> 00:26:15,660
So for example, if a red team comes in and performs a high criticality test and nobody notices, the blue team could come back and say, oh, well, we didn't notice that because the person who would have noticed it was out on vacation.

254
00:26:15,660 --> 00:26:17,300
Can you come back and do it again?

255
00:26:17,300 --> 00:26:21,560
But if the level of effort for doing it again is significant, you have a bit of a problem now.

256
00:26:28,180 --> 00:26:36,520
So with all that said, let's talk about the goals for a blue team, not only from a red team, blue team perspective, but also what we're thinking about insider threat actors.

257
00:26:36,520 --> 00:26:38,260
What are the goals?

258
00:26:38,260 --> 00:26:44,480
Well, the initial goal should be, do you notice network anomalies, those baselines again?

259
00:26:44,480 --> 00:26:48,900
Would you notice if there's weird exfiltration happening at odd times from odd places?

260
00:26:48,900 --> 00:26:53,940
Would you notice if someone was downloading a bunch of stuff off of a shared drive from their house?

261
00:26:53,940 --> 00:26:58,200
Are those sorts of things, the anomalies, the big ones, noticeable?

262
00:26:58,200 --> 00:27:02,060
And how do you handle the signal to noise ratio?

263
00:27:02,060 --> 00:27:04,440
How do you handle weird DNS traffic?

264
00:27:04,440 --> 00:27:11,240
Are you logging for things like PowerShell on workstations that probably don't need to be running PowerShell in the user space?

265
00:27:11,280 --> 00:27:22,280
And then how do you slowly but surely build those fundamentals and scale all the way up to more advanced persistent threats, more advanced admin capabilities, more advanced threat actors?

266
00:27:22,280 --> 00:27:26,720
And how do you internally build up those defenses over time?

267
00:27:26,720 --> 00:27:38,060
So this is one way to think about it from a defensive perspective of trying to catch the most verbose of insider threats or adversaries and then slowly working your way towards the more subtle adversaries.

268
00:27:43,660 --> 00:27:47,360
Now on the flip side of that, we have what are the goals for the red team?

269
00:27:47,360 --> 00:27:51,880
So the red team for the adversary is starting with crown jewel assets.

270
00:27:51,880 --> 00:27:56,760
And I'll actually let Bryson speak to that one because this is a Brysonism if there ever has been one.

271
00:27:57,900 --> 00:28:01,120
So if there's ever been I think I have many.

272
00:28:01,120 --> 00:28:04,000
I don't know that this one qualifies as special.

273
00:28:04,060 --> 00:28:09,860
This grew out of a Twitter discussion I was having around systemic risk yesterday.

274
00:28:09,860 --> 00:28:22,060
So for those of you who think that it's just unicorn and cooking picks, I also will occasionally lead what's sometimes fast for intellectual discussions on different aspects of InfoSec.

275
00:28:22,140 --> 00:28:26,400
Because I don't think I know everything, I think combined we all know a lot.

276
00:28:26,620 --> 00:28:36,560
So somebody in particular talked about crown jewels and the idea was talking around the fact that assets have different value, just like users have different value.

277
00:28:36,560 --> 00:28:45,000
There are different qualities of assets and insider threats based on that user and those assets and their access to those assets combined.

278
00:28:45,440 --> 00:28:49,540
And so we do not have unlimited resources.

279
00:28:49,540 --> 00:28:54,300
Nobody here has a limited time, people, or money to do everything that they want to do.

280
00:28:54,380 --> 00:28:58,000
And so the key is figuring out, well, what matters to the business?

281
00:28:58,000 --> 00:29:02,060
What are the critical things, the crown jewels, in the organization?

282
00:29:02,060 --> 00:29:07,900
And prioritizing those when we're looking at our assessments and emulations.

283
00:29:08,740 --> 00:29:15,580
And the simple metaphor that I use to describe this, which I'll pivot off of crown jewels, is you're circling the wagons around the campfire.

284
00:29:15,580 --> 00:29:31,060
You can imagine that you're on the Oregon Trail, only a few of your party have died of dysentery, camp down for the night, eating your squirrel meat that you hunted during the day, and you circle the wagons around that part of the organization that you know for sure you have some level of positive control about.

285
00:29:31,060 --> 00:29:39,040
The rest of the organization is on fire, pillaged by the wasteland.

286
00:29:39,420 --> 00:29:47,740
You start with what you can control effectively and then you slowly grow out from there in increasing priority with the context of the business.

287
00:29:47,740 --> 00:29:53,620
That's behind my crown jewels assets CJA Brysonism.

288
00:29:54,960 --> 00:29:56,080
That's perfect.

289
00:29:56,080 --> 00:30:04,360
And what we've seen from an industry perspective is that boards and executives are very comfortable with that idea of identifying the crown jewels and it's scaling out accordingly.

290
00:30:04,360 --> 00:30:10,300
Because there are things that the entire organization can absolutely agree on as being the most critical assets.

291
00:30:10,300 --> 00:30:16,460
And identifying those both from a technical and from an organization perspective is really important, as it turns out.

292
00:30:16,460 --> 00:30:29,340
And then moving with that from an operational perspective, creating reproducible scenarios to make sure that the defenses around those things are valid and they continue to be valid over and over and over again over time.

293
00:30:29,340 --> 00:30:38,120
And then taking that a step further, decoupling the techniques at the high level that you might be trying to execute on from its actual literal execution.

294
00:30:38,120 --> 00:30:40,160
Again, going back to the MITRE ATT&CK thing.

295
00:30:40,160 --> 00:30:44,040
Well, there's a ton of different ways to perform any individual technique.

296
00:30:44,040 --> 00:30:49,300
And keeping that in mind that you're not just coded to, oh, we block this one command and therefore we're good to go.

297
00:30:49,300 --> 00:30:51,040
You have to think of it iteratively.

298
00:30:51,040 --> 00:30:56,380
You have to think about it as an adversary growing over time and changing the way they execute these actions.

299
00:30:56,640 --> 00:31:05,420
And so don't ever hesitate to not only change the way you do things, but also use some of the same stuff that an internal adversary would.

300
00:31:05,420 --> 00:31:10,900
Maybe it's you're doing the slightly motivated attacker and you're just exfiltrating over a VPN that you downloaded.

301
00:31:10,920 --> 00:31:17,340
Or maybe you want to do something where you write a little bit of custom or download a little bit of something that's Google-able, right?

302
00:31:17,340 --> 00:31:23,820
Those sorts of things are absolutely in scope and they don't require Kali or Metasploit or any of these things.

303
00:31:23,820 --> 00:31:32,420
Because again, the slightly motivated insider threat actor probably doesn't know how to spin up a Kali USB bootable stick, right?

304
00:31:32,420 --> 00:31:39,340
So thinking about yourself in their shoes and the tools that they've got access to can create for some really interesting scenarios.

305
00:31:40,360 --> 00:31:44,500
Just picture Elon Musk on Joe Rogan.

306
00:31:45,700 --> 00:31:49,280
Just keep that in your mind as you're doing your threat actor analysis.

307
00:31:50,780 --> 00:31:58,780
So we would be remiss if we didn't bring this up in a red team, blue team analysis monitoring conversation.

308
00:31:58,780 --> 00:32:03,880
And we just want to make a quick note about AI and machine learning specifically for blue teams.

309
00:32:04,520 --> 00:32:13,860
There's a lot of things that are pitched as like AI machine learning, user behavior monitoring, adversary analysis stuff.

310
00:32:14,060 --> 00:32:24,420
Just be careful and remember that there's a reason most adversaries don't need to have AI and machine learning in their malware.

311
00:32:24,420 --> 00:32:28,520
It's because like their goals are pretty set.

312
00:32:28,520 --> 00:32:35,600
They know what they want to do and they don't need to have polymorphic logic about trying to create ransomware, right?

313
00:32:35,600 --> 00:32:38,700
Like it's pretty solid about what it wants to do.

314
00:32:38,740 --> 00:32:44,660
And so just remembering that their goals tend to be pretty explicit going back to those crown jewels.

315
00:32:44,660 --> 00:32:49,980
So you don't need a polymorphic circle of wagons around your fire necessarily.

316
00:32:49,980 --> 00:32:58,200
It's important to keep that simplicity sometimes is valuable, especially if you don't know the scope of what you're trying to monitor or the scope of the problem.

317
00:32:58,260 --> 00:33:10,540
And so just be careful when you're rolling out AI and machine learning based defenses and validate your vendor because some of them don't find anomalies correctly and some of them need to be trained.

318
00:33:10,540 --> 00:33:16,620
And if you don't know that going into it, you might not have the silver bullet you may have been paying for.

319
00:33:16,620 --> 00:33:20,980
And this is one of my favorite quotes, the difference between machine learning and AI.

320
00:33:20,980 --> 00:33:23,920
If it's written in Python, it's probably machine learning.

321
00:33:23,920 --> 00:33:26,360
If it's written in PowerPoint, it's probably AI.

322
00:33:26,360 --> 00:33:31,540
Just keep that in mind when you're hearing vendors say things about these to you.

323
00:33:31,700 --> 00:33:34,560
It's just an important perspective.

324
00:33:38,570 --> 00:33:52,430
So one other thing that's worth noting, and this was based off of some conversations we've had with experts in network monitoring, beacons as a thing, like the how often malware phones home for its next instruction or exfiltration.

325
00:33:52,950 --> 00:34:00,410
This is kind of an interesting use case for thinking of red team versus blue team or working together to train a network monitoring team or what have you.

326
00:34:00,410 --> 00:34:05,450
So if a piece of malware beacons home from an endpoint every five seconds, that's easy mode.

327
00:34:05,450 --> 00:34:09,270
It's pretty easy to notice that on the wire from a network analysis perspective.

328
00:34:09,270 --> 00:34:10,030
Cool.

329
00:34:10,070 --> 00:34:14,950
So maybe you add 20 seconds beacons with 25% randomization on that.

330
00:34:14,950 --> 00:34:19,190
Well, okay, now it's getting a little harder, but usually a team can identify that.

331
00:34:19,750 --> 00:34:24,710
Then when you say, well, what about a five minute beacon with 75% randomization on that?

332
00:34:24,710 --> 00:34:28,850
Well, it gets a little trickier, but it's still inside of scope for most network monitors.

333
00:34:29,030 --> 00:34:37,370
But there is this kind of belief that once you hit the 30 minute mark, well, threat actors don't want to have phone home every 30 minutes.

334
00:34:37,370 --> 00:34:38,610
That's impractical for them.

335
00:34:38,610 --> 00:34:41,510
So it's probably out of scope for most network monitors.

336
00:34:41,650 --> 00:34:52,050
This is what we're talking about when we talk about scaling up the fundamentals towards more advanced persistent threats, because beaconing home every 30 minutes is, that's an easy one.

337
00:34:52,050 --> 00:35:01,270
When if you're thinking about a real advanced persistent threat, whose engagement is not designed to last a week, it's designed to last years in total.

338
00:35:01,270 --> 00:35:08,070
And so, you know, thinking about it as, oh, well, we trained our data set based on known traffic.

339
00:35:08,070 --> 00:35:22,390
Well, if this user has been exfiltrating a gig of data to Dropbox every night for as long as you've been monitoring the network, like, don't just assume that that's not an anomaly, because that threat actor might have been there for a long time.

340
00:35:22,390 --> 00:35:34,930
And if they're slightly motivated, like they might not know how to write an automation framework, but they could probably Google how cron works or services work and how to, you know, dump a copy of something to Dropbox every night.

341
00:35:34,930 --> 00:35:38,330
So just a quick note on adversary testing there.

342
00:35:41,820 --> 00:35:47,240
All right, to summarize, employees are the best hackers.

343
00:35:47,240 --> 00:35:49,400
And this is another, thank you, Bryce.

344
00:35:49,400 --> 00:35:55,620
And this is a great line, because they will work hard to achieve their goals.

345
00:35:55,620 --> 00:36:00,200
And even if they won't work hard, they are slightly motivated to achieve their goals.

346
00:36:00,200 --> 00:36:02,620
And they're willing to try different things to circumvent.

347
00:36:02,620 --> 00:36:15,040
So keeping that in mind, the red team should run scenarios as if they are those slightly motivated attackers that have access to consumer grade tools that are very good for things like exfiltration.

348
00:36:15,100 --> 00:36:21,200
And the red team is there to help design repeatable adversary testing to help test the blue.

349
00:36:21,200 --> 00:36:30,280
The blue team should be working on baselines and shoring up the fundamentals and learning network norms and understanding the standard of traffic, which creates those purple team engagements.

350
00:36:30,280 --> 00:36:47,760
After you've identified the baseline together, you can then validate that those baselines are being held and continue to shore up more and more of the organization or better define these things as you move forward so that you can start to scale up to the advanced threat actor beyond the slightly motivated.

351
00:36:51,860 --> 00:36:55,540
And yeah, Bryson, do you have anything else before we wrap up?

352
00:36:55,540 --> 00:36:57,500
That's pretty much it.

353
00:36:57,600 --> 00:37:00,100
No, I look forward to a robust Q&A.

354
00:37:00,820 --> 00:37:01,460
Awesome.

355
00:37:01,460 --> 00:37:03,140
Thank you, everyone, for your time.

356
00:37:03,140 --> 00:37:13,800
There's some notes there about some of the sources we used, and we look forward to having discussions wherever those discussions maybe happen, whether it's in the DEF CON Discord or otherwise.

357
00:37:13,860 --> 00:37:14,660
Thanks, everyone.