start	end	text
0	4840	at the golden age of Insider Threats. I'm Adam Macinci, that's Bryson Bort. We'll introduce
4840	10420	ourselves again here in a second. And just before we get started on anything else, yes,
10420	16380	it is known to be misspelled kind of intentionally because it's you are the adversary within
16380	20020	because it's about Insider Threats. It's a joke.
20020	21960	We're paid to hack things, not tell jokes.
21960	29820	Not tell jokes. It's not great. Anyway, real quick, who am I? I'm Adam Macinci. I do all
29820	34280	sorts of stuff. I volunteer and speak with the Red Team Village. I do their one-on-one
34280	38760	track. I'm a member of the C2 Matrix. I'm the head of product management at Scythe.
38760	42420	I've got a background in enterprise solutions and crypto and privacy and whatever. That's
42420	45360	me. And also here's Bryson.
45820	53780	Ash said a lot of words. He's our token Californian. I founded Grimm eight years ago to build the
53780	58700	best team of hackers because this is no longer an individual sport. It's a team sport. Defenses
58700	65720	have gotten really good. About two years ago, I spun out Scythe. That's my full-time
65720	70100	job for an adversary emulation platform where I work with MASH. And then I'm a co-founder
70100	74420	of the ICS Village non-profit. So hopefully you have a chance here at DEF CON to also
74420	76060	check out the ICS Village.
79130	86330	All right. And so what we'll be talking about today is a bunch of things, not only Insider
86330	91350	Threats, but also the value of post-exploitation and why that's important philosophically.
91370	95510	And we'll talk about defense validation through threat emulation and why focusing on endpoints
95510	100010	from a red team and from a blue team and from a purple team perspective is important. And
100550	105350	obviously, Insider Threats and why their lives are a little easier than most folks when it
105350	109410	comes to being adversaries and why boards and leadership cares and why defenders are
109410	110270	overwhelmed.
110270	114350	And then we'll talk about the cycle of red and blue working together towards purple teaming
114350	117770	and why this is all relevant from an Insider Threat perspective.
118150	126130	So first off, let's talk about the value of post-exploitation. And this is kind of a bit
126130	130890	of a philosophical argument for us, but we generally have the following three principles
130890	136870	that we as the InfoSec community just feel to be true. So one, it's not if, but when.
136870	141630	So everybody has the potential to be compromised and it will inevitably happen. Every organization
141630	147230	has the ability to be compromised. Two, there will always be zero days. There will always
147230	151630	be end days. There will always be bugs in software, which creates a new exploit and
151630	157610	that will always be the case. And then finally, social engineering and Insider Threats, to
157610	162390	whatever degree you want to count that, will always work. There's always someone who will
162390	166050	click the email link. There will always be someone who plugs in the thumb drive. That
166050	169110	is inevitable and there's a lot of reasons for that.
169110	176690	So if we believe those principles to be true, then kind of philosophically, post-exploitation
176690	181550	behaviors from an adversary's perspective is more important than the exploit itself.
181550	186650	It doesn't matter all the CVEs that we use to get in. It's what the adversary does once
186650	190270	they are in. That's the thing that's more important philosophically.
190330	195150	There's also two layers to this. So if you think about this simply, we're talking about
195150	203290	access. Access, typically, people think of the antiquated way of, I have a perimeter
203670	210590	and a third party has gained unauthorized access. And that is part of it. And so what
210590	217410	you can summarize this is, is the ability to gain access is across an infinite scope
217410	222450	of possibility because it's not just technical. It is a question of people and technology.
222450	227510	The second part of access is there's also access within the organization. So once I've
227510	233790	breached the perimeter, once I've compromised, then I'm still working the access problem
233790	239030	in an iterative way as I try to work from where I am to where I want to go. And each
239030	243450	one of those steps starts with that access problem, which again, can be solved through
243450	245510	technical or social means.
246730	252890	And this is all particularly pertinent when we're talking about it from a red team perspective.
252890	257830	So for example, if we take a red team are performing an adversary test and we take the
257830	262990	following two scenarios. So in the first scenario, they take a custom binary that they've made
262990	268510	and they detonated on an endpoint during this engagement. Well, they've been caught and
268510	273990	that's been burned. So that's a valid test of a security control that an unsigned piece
273990	279210	of malware was able to be caught. That's a good thing. But an equally valid test from
279350	285090	a red team perspective is creating that same custom piece of malware and then putting it
285090	290850	in an allow list for that specific binary and then having it go through and not be caught
290850	294650	and letting the behavior run after the fact. These are equally valid tests because in the
294650	300230	first one, you validated the security control of do you block unsigned things that are potentially
300230	305890	malicious, but in the latter, you're running an O day or an N day scenario as if that thing
305890	310810	was able to work its way into being allowed and then fire its behavior after the fact.
310810	315610	So it's important to point that out that these are equally valid tests from a red team perspective.
316990	321710	So the other part here is we're validating our assumptions. I can't tell you how many
321710	325870	conversations I've had with folks where we go in and they're like, oh, you know,
325870	330070	we're paying this amount of money for this and we know it does this. Well, how do you know?
331270	335770	Try it. Check it. Once you do that, you're building up that arsenal of validating those
335770	341590	assumptions and keeping it going. Another way to look at this is it's like being
341590	349470	an APT on the cheap. By proving the control works and then using configuration like allow list to
349470	354490	allow something to go past control, that's the equivalent of a technical compromise like what
354490	360130	an APT can do, right? We assume that they can do that. It's a question of if, not when. And
360130	366890	by doing that allow list, you just, for free, with little effort, achieve the same goal as what that
366890	377290	APT can. So with all that in mind, let's talk about insider threats and what's specific to
377290	382470	them when we talk about insider threats from a red team perspective. And specifically, let's talk
382470	388950	about today's endpoints. So for the sake of this conversation, an endpoint is something that a
388950	393030	user interacts with. So it's not like a web app or a web server or something like that or an S3
393030	399350	bucket. This is something that figures on keyboard, somebody's actually utilizing. And the reason
399350	404290	we're focusing on this, especially from an insider threat perspective, is not only is this most
404290	409230	likely what the user will be interacting with as an insider threat, but also this is where we see
409230	414570	the majority of organizations compromised from. This is the phishing links and everything according
414570	419710	to there. And ultimately, you know, all these systems are in place to try to protect users
420430	425110	from all sorts of malicious stuff and patches are important and all these things are true.
425110	431270	However, humans are difficult to secure. People are curious, they're willing to give out their
431270	436830	password for a candy bar. Phishing is something that's really difficult to get rid of entirely.
436830	442770	People plug USB drives into stuff all the time because of curiosity. And then taking it a step
442770	448270	further, as an organization, you probably have all sorts of third parties and all sorts of vendors
448270	452910	whose technology you're utilizing. And when they come on site, how do you make sure that the
452910	457810	security controls that you have for your staff apply to them? And this is a very difficult problem
457810	464550	to solve, as it turns out. So with this all said, we're down to these couple of points from an
464550	471250	endpoint perspective, which is endpoint usage is really difficult to monitor. And it's particularly
471250	478090	difficult to emulate. And to reiterate here, humans are random, they do all sorts of random
478090	482810	things. And figuring out how to monitor for theoretically random behavior, even though
482810	488910	that humans have trends, it can be very difficult to do. And then it's also tricky to emulate a
488910	493530	perfect user in that way, because people do random stuff all the time. And they, especially when
493530	498190	they're interacting heavily with a laptop, say, well, you can't always reliably and predictably
498190	503490	say what a given user may or may not be browsing to. So it's just those are important to remember
503490	511690	as we move forward. And to preface this upcoming slide, we love privacy and security and encryption,
511690	516930	these are all good things that we believe in philosophically. But it becomes a little
516930	525470	tricky when we talk about securing and specifically monitoring end users. So this has created a world
525470	530090	because of the usability of encryption and privacy and all these pieces of technology,
530090	535310	where it's kind of the best time ever to be an insider threat actor, they have a lot of
535310	542770	capabilities at your disposal. And so just to call out a few, let's look at Firefox's scent,
542770	548130	which is unfortunately been taken offline, because it was being used maliciously, of course. But for
548470	554470	a long time, like almost a year, we had the ability for a high reputation domain that allowed
554470	559830	end to end encrypted exfiltration and delivery of arbitrary things in another networks. Now,
559830	565730	this is a great user privacy tool. But consequently, it was also be used to like deploy malware. And
565730	571290	that's why it's now offline. And the same is true for all sorts of VPN technology, whether it's
571290	581510	cloud flares, 1.1.1.1 plus warp, this is just instant VPN, DNS security at the consumer level.
581510	587210	And these are things that we now like bring your own devices one clearly. And so everybody has
587210	591910	these abilities running in the user space on their own devices. And it just allows for a lot of
591910	597750	exfiltration events outside of an organization. So like MDMs have essentially lost, there is no
597750	603570	real enterprise mobility solution. And then you pair all of these consumer technologies with the
603570	609430	fact that enterprises are just using more cloud based technology. Well, that's instant high
609430	615510	reputation exfiltration right there. So whether it's legitimate cloud use of Google Apps, or
616130	620950	being able to use things like Dropbox, or what have you to steal data out, like who's going to
620950	626890	block Google Drive in an enterprise that uses Google Drive, this is just opening up all these
626890	633610	doors for insider threats to steal stuff out of a network. And of course, we now have the elephant
633610	641910	in the room. In the pandemic era, 60% of all workers are remote. So you no longer have to
641910	648070	worry about the challenge of how do I physically remove assets into a safe location because
648070	654970	your safe location is already at home. So we now have, this is where we've seen a lot of
654970	660570	enterprises moving to the cloud because it's a bandaid for security. Certainly VPN usage has
660570	667110	bumped up because well, at least I can encrypt the corporate asset in the home environment to
667690	672530	the corporate environment. And what I would offer just for some little extra free advice
672530	679930	is think of the using least privilege in these circumstances, have them log into a essentially
680090	685390	a demilitarized zone of minimum privilege access, and then they validate out of that to go further
685390	690150	into the infrastructure. So offering those kinds of things slow them down. The other challenge we
690150	695570	have here is around testing this. We are now talking about a mixed environment where it's no
695570	702490	longer just corporate assets. We now have corporate assets in a private asset environment, right? Who
702490	707550	owns that router? Who owns those other devices on that network? Those are the employees' personal
707550	715870	devices and it makes it difficult to bring that in scope for a test. And this also ties
715870	722950	into the challenge, of course, back in the old days where we did have BYOD where a lot of folks
722950	730690	didn't necessarily have policies around that. And being able to identify IoT traffic and specific
730690	739240	device fingerprinting is a very challenging problem. And that really leads us to the fact that
739240	748640	although trust is critical, and we can't emphasize this enough, it's not only critical,
748640	754420	but it's arguably more critical than ever. Because monitoring solutions, there's a whole
754420	763260	suite of offerings in a pre-COVID-19 era. But now that everyone's at home, monitoring is an even
763260	767560	trickier solution to try to implement when you have all these deployed endpoints in all sorts
767560	774480	of different places. And so trusting your employees is critical because there's fewer
774480	780980	and fewer ways to modify the things that you're doing and monitor always explicitly. And to all
780980	786900	the things that Bryson just said, it's about restricting access now, not so much monitoring
786900	792880	for every keystroke or every bit of browsing bit that goes on. And so we think about allow
792880	797780	requirements, we think about how folks can circumvent blocks and all of these things,
797780	802260	where we're now having to play whack-a-mole with all of the possible consumer solutions as well
802260	808100	that come from legitimate providers and legitimate domains. This is very, very tricky. And so
808860	813860	one of the ways I think about it is, it's not even so much like how do you prevent,
813860	820340	or how do you emulate the APT or the highly motivated adversary? Instead, I think of it as
820340	826960	how do you even prevent exfiltration from a slightly motivated adversary? Someone who doesn't
826960	832000	necessarily know how to roll their own crypto, but they can download a VPN app on their device
832000	838620	and turn it on. They have a motivation, they're just not highly motivated. And so that's where
838620	842700	we get this idea of the slightly motivated adversary. And what to do about that scenario
842700	854820	can be very, very tricky. So with all that about insider threats wrapped up, how do we think about
854820	859120	all this from a red team perspective? Well, the good news, I mean, good news for the red team,
859120	865080	maybe not so much for the blue. The red team can use all these principles and philosophical
865080	871760	paradigms that we're in to create adversary scenarios that use all the advantages of these
871760	877540	things. So this is things running in the user space, things running at runtime, no exploitation
877540	881700	required, because if you're simulating an insider threat, well, they probably have the ability to
881700	886340	double click something on their endpoint. And they're not necessarily doing so because they
886340	889520	were tricked into doing it, they did it because they wanted to, and they're willing to kind of
889520	899130	take a couple steps in order to achieve that goal. So now for the red teamer who's creating a campaign,
899130	905550	they could do what the malware authors do, where they design things around, well, what are the
905550	910630	capability of a slightly motivated adversary, so they can run in the user space, they've got access
910630	915090	to valuable data, like, you know, their documents folder is probably important, there's probably some
915090	921930	PII set more on that drive. Well, they also have access to those things and publicly accessible
921930	926650	exfiltration tools, Pastebin. How many organizations have Pastebin allowed? Like, that's an
926650	931830	exfiltration tool from a slightly motivated attacker perspective. And not only that, the red
931830	937750	team also has on top of those capabilities, knowledge of ODAs and NDAs, knowledge about how
937750	943970	to automate these things, deploy infrastructures to do more advanced exfiltration techniques,
943970	947930	they know how to obfuscate, they know how to be more anonymous. So you ratchet these things
947930	952310	together and you think, what do you get for free by pretending to be an internal adversary? And
952310	955750	then you put on top of that all the stuff you could do as a red teamer. Well, that creates a
955750	962730	very exciting scenario from a red team adversary perspective. Talking about Pastebin and
963350	968510	executing in user space, check out the Blue Team Choose Your Own Adventure. We did a short
968510	973950	Choose Your Own Adventure that involves ransomware that takes advantage of those.
975730	979910	Yeah, that's an excellent point in and of itself. If we think about modern ransomware,
979910	985050	you don't need to run as admin to do modern ransomware, like end users can create and
985050	989690	delete files. They have permissions to do that. And ransomware says, great, I want to create and
989690	993590	delete files, right? That's the point. It's all these things are in the user space, and you just
993590	1000250	get them for free, thinking of as an adversary does. So now that we know all the advantages,
1000250	1005890	what can the red and blue teams do about it? Because the slightly motivated adversary is
1005890	1011890	very, very powerful, and they have the ability to both accidentally and intentionally compromise
1011890	1018450	endpoints. And given that the blue team now has to think about everything from a disgruntled
1018450	1025370	staffer to an APT, well, that's a pretty big scope. Actually, I don't... Bryson, I don't know if I fully
1025370	1034670	get your Joe Rogan, Elon Musk image on this one. Yeah, so what I was going for here was
1034670	1040050	you got a picture of Elon Musk as the disgruntled staffer, and he's sitting there at home.
1041270	1050470	I was employee 53. They don't take me seriously enough. They don't respect me,
1050470	1055210	and I'm gonna quit. I'm gonna burn this place to the ground, and this is him taking his red
1055210	1063260	stapler on the way out while it burns. Fair enough. There's your disgruntled role play.
1063260	1069460	Yeah, that's good. I mean, defining Elon Musk as a staffer might be a bit of a stretch,
1069460	1076580	but the analogy certainly plays. But given that that is inside a threat model for a blue team,
1076580	1084360	that can be incredibly tricky, right? And so what do we do with all this? Well, an answer to this
1084360	1091240	is shoring up the fundamentals. So it's not so much like would you detect a foreign country inside
1091240	1097680	your organization slowly beaconing little documents over the course of years over DNS,
1097680	1102460	but thinking about, well, would you notice standard exfil if someone started dumping gigs
1102460	1107100	of data out in the middle of the night? These sorts of fundamentals are really important.
1107120	1113080	And thinking about validating the controls and validating those tests in a repeatable way via
1113080	1119700	adversary testing, this is that red and blue team working together. So real quick, before we dive
1119700	1126280	deeper on that, I do want to make a quick note about the vendor industry on this one, which is
1126360	1134540	a little awkward. So if we think about breach and attack simulation as a thing, so that is a
1134540	1140380	Gartnerism that is way overly broad, and it can mean a wide variety of things. But generally speaking,
1140380	1145340	we think of it as kind of spectrum. And on one end of the spectrum, we have controls validation
1145340	1150940	tools. So these are agent-based things that repeat known signature actors and traffic in these sorts
1150940	1154220	of PCAP replays and what have you. And then on the other end of the spectrum is more advanced
1154220	1158160	adversarial testing. And there's a whole simulation versus emulation argument that we could talk
1158160	1163320	about. And these are the kinds of tools on the other side that the red teams in Pentesters use.
1163380	1166660	And there's all these sorts of other things we could talk about, like how they align to
1166660	1173420	MITRE ATT&CK and why that's important. But for the most part, all of these things inside of the
1173420	1179260	spectrum do satisfy this idea of assumed compromise and assumed breach scenarios, regardless of
1179260	1183940	whether or not you're compiling something via MS Venom and Metasploit, or whether you're using
1184140	1188340	a breach and attack simulation tool. You could use both of these things in an assumed
1188340	1198560	compromised way. And that's worth noting about this whole spectrum of tools. I mean, the only
1198560	1203480	thing I'd jump on here is where I throw out that MITRE ATT&CK is not a bingo card.
1204900	1210720	What I mean by that is what MITRE ATT&CK is a great compendium of understanding all of the
1211380	1219100	correction, a lot of the elements, because it may never be complete, of a common vernacular for us
1219100	1224100	to describe attacks. You can't use it as a checkboard. You're like, I have successfully
1224100	1231060	made sure that this can never happen. T1033 will never happen. That's the wrong way to look at it.
1231060	1237300	And part of that is because I like to describe it as a periodic table. And the attacks in it
1237300	1242200	are different elements. And the way and the order that those elements are combined is a
1242200	1250260	chemical equation. And whether you get lead or gold depends on that order. And so the point
1250260	1257500	being is that a static look of particular elements without understanding the context that they're in
1257500	1262680	changes what that means. My ability to do lateral movement is going to be affected by
1262680	1268220	whether or not I have credentials or not, for example. Simple example.
1271560	1275880	And when we think about these sorts of chemical elements like Bryce is describing,
1275880	1279840	and these sorts of things are accidentally using it as a bingo card, well, this can be
1279840	1284120	exceptionally tempting when we're talking about something like a controls validation solution,
1284120	1289460	where it's automatically testing whether or not you can send data to something that's known as
1289460	1295180	evildomain.com over these firewall ports and all these sorts of things. Well, you can define
1295180	1299040	these rules in the controls validation tool and have it automatically test those things over and
1299040	1302320	over and over again and let you know if your configuration management's falling over and
1302320	1307460	that sort of thing, which is all very valuable. But it is tempting to just say, oh, we're tagging,
1307460	1312260	we're looking for that port for exfiltration, we're done with that MITRE ATT&CK ID. And again,
1312260	1317220	it's important to note that these controls validation tools are very static. They're
1317220	1322140	agent-based, they're signature-based. And kind of most important from our perspective,
1322140	1326640	we're talking about internal adversaries and insider threats. These aren't production endpoints
1326640	1331740	that these things are installed on. These things aren't simulating users or internal threat actors,
1331740	1336720	necessarily. They're just doing, here's some analysis from the threat intel community,
1336720	1341540	fire for effect, here's a PCAP. So it's not exactly what we're talking about here from
1341540	1353080	an insider threat emulation perspective. Just to kind of finish that off, there's no people in the
1353080	1357100	loop on this one, right? It's about automating these solutions and detecting these sorts of
1357100	1361100	things. And so it is repeatable, and it is easy to implement these controls validation tools.
1361100	1365520	But ultimately, they're not really something that the red team is going to utilize.
1365680	1371060	And they're more about unit testing than adversary behavior. And often these are unfortunately at
1371060	1376280	the mercy of the vendor, because the vendor is the thing that's pulling down the threat intel.
1376280	1381140	It says, these are all the tests you can run, you might have very limited ability to change them a
1381140	1386040	bit, but it's not a customizable tool. So that's a concern when we're thinking about controls
1386040	1391120	validation from an insider threat perspective. The only thing I'll add there is what's at the
1391120	1396440	top is that people are not in the loop. And what we mean by that is that these are great detection
1396440	1402660	engineering tools, but you're not including the user affecting the behavior around looking at
1402660	1407900	what those technical controls do or don't do. And then the second part is you're not able to
1407900	1415960	measure the response, because it's a set stage for what your sock is looking at.
1416140	1421460	But I think it was also a bit glossed over on what the pros here with change control,
1422000	1426520	your ability to know what you're always going to see and building that library out.
1426720	1430980	We take it for granted that things work the way that they're supposed to work,
1430980	1436120	and that our challenge is finding attackers in that noise. There is also the challenge that
1436120	1443940	tools break, configurations drift, things stop working for various reasons. And so knowing for
1443940	1448540	sure what I'm looking for, be able to identify that is a significant value proposition.
1452580	1458000	And so with all that in mind from a controls validation benefit, like cost benefit evaluation,
1458560	1462880	let's look at the other kinds of tooling that we mentioned, which is adversary testing or
1462880	1467560	adversarial testing. And so again, for the sake of this discussion, an adversarial test is more
1467560	1471860	about behavior. And we've been talking about post exploitation behavior specifically,
1471860	1477180	whereas a pen test is often focused on those exploitations. So here, it's about a red team
1477180	1483520	creating a scenario where they can validate and see what the network defenders would notice. So
1483520	1488040	will they notice exfiltration? Will they notice lateral movement? Will they notice if I increase
1488040	1493140	my beacon heartbeats or the randomization of those heartbeats, that sort of thing. And this allows
1493140	1500140	the red team or third party pen test or red teaming firm to test these things and to see if
1500140	1504920	they can get an initial foothold and see what the remediation time on that looks like. And they can
1504920	1510880	also define whatever artifacts they may choose to leave. So you could say, well, we think that in
1510880	1517080	this kind of threat scenario, someone may want to... the adversary would drop this folder, or they would
1517080	1522400	they try to create this key and leave that on an endpoint. Those can be predefined with an
1522400	1528740	adversary test. And so moving a little further down that rabbit hole, these things are highly
1528740	1534180	customizable, which can be a good and a bad thing. The more time a red team takes to create them,
1534180	1539940	the more difficult it can be to replicate them. And especially when it comes to the idea of a blue
1539940	1544340	team might want to remediate this thing and then test it again. Well, the more complex it was to
1544340	1549500	create it, the more difficult it is to test it and validate it again. So although there's a lot
1549500	1554060	of flexibility from creating these sorts of engagements that are very red team adversarial
1554060	1559880	focused, they are fairly technical, there's a high learning curve, and they tend to be more expensive.
1559880	1564300	And then finally, one of the cons for them is that they are very limited snapshot in time.
1564400	1570280	So for example, if a red team comes in and performs a high criticality test and nobody notices,
1570280	1574200	the blue team could come back and say, oh, well, we didn't notice that because the person who would
1574200	1578220	have noticed it was out on vacation. Can you come back and do it again? But if the level of effort
1578220	1590360	for doing it again is significant, you have a bit of a problem now. So with all that said, let's talk
1590360	1594460	about the goals for a blue team, not only from a red team, blue team perspective, but also what
1594460	1600400	we're thinking about insider threat actors. What are the goals? Well, the initial goal should be,
1600400	1606100	do you notice network anomalies, those baselines again? Would you notice if there's weird
1606100	1610620	exfiltration happening at odd times from odd places? Would you notice if someone was downloading
1610840	1616640	a bunch of stuff off of a shared drive from their house? Are those sorts of things, the anomalies,
1616640	1623540	the big ones, noticeable? And how do you handle the signal to noise ratio? How do you handle weird
1623540	1628620	DNS traffic? Are you logging for things like PowerShell on workstations that probably don't
1628620	1634060	need to be running PowerShell in the user space? And then how do you slowly but surely build those
1634060	1639820	fundamentals and scale all the way up to more advanced persistent threats, more advanced admin
1639820	1645420	capabilities, more advanced threat actors? And how do you internally build up those defenses
1645420	1650760	over time? So this is one way to think about it from a defensive perspective of trying to catch
1650760	1656280	the most verbose of insider threats or adversaries and then slowly working your way towards the more
1656280	1667480	subtle adversaries. Now on the flip side of that, we have what are the goals for the red team? So
1667480	1672940	the red team for the adversary is starting with crown jewel assets. And I'll actually let Bryson
1672940	1679400	speak to that one because this is a Brysonism if there ever has been one. So if there's ever been
1679400	1686740	I think I have many. I don't know that this one qualifies as special. This grew out of a
1686740	1693380	Twitter discussion I was having around systemic risk yesterday. So for those of you who think
1693380	1698880	that it's just unicorn and cooking picks, I also will occasionally lead what's sometimes fast for
1698880	1703820	intellectual discussions on different aspects of InfoSec. Because I don't think I know everything,
1703820	1710580	I think combined we all know a lot. So somebody in particular talked about crown jewels and the
1710580	1715640	idea was talking around the fact that assets have different value, just like users have different
1715640	1722280	value. There are different qualities of assets and insider threats based on that user and those
1722280	1729740	assets and their access to those assets combined. And so we do not have unlimited resources. Nobody
1729740	1735120	here has a limited time, people, or money to do everything that they want to do. And so the key is
1735120	1740820	figuring out, well, what matters to the business? What are the critical things, the crown jewels, in
1740820	1747900	the organization? And prioritizing those when we're looking at our assessments and emulations.
1748740	1753300	And the simple metaphor that I use to describe this, which I'll pivot off of crown jewels, is
1753300	1757820	you're circling the wagons around the campfire. You can imagine that you're on the Oregon Trail,
1757820	1762600	only a few of your party have died of dysentery, camp down for the night, eating your squirrel meat
1762600	1767020	that you hunted during the day, and you circle the wagons around that part of the organization
1767020	1772500	that you know for sure you have some level of positive control about. The rest of the organization
1773120	1781880	is on fire, pillaged by the wasteland. You start with what you can control effectively
1781880	1787300	and then you slowly grow out from there in increasing priority with the context of the
1787300	1796680	business. That's behind my crown jewels assets CJA Brysonism. That's perfect. And what we've
1796680	1801120	seen from an industry perspective is that boards and executives are very comfortable with that idea
1801120	1805900	of identifying the crown jewels and it's scaling out accordingly. Because there are things that
1805900	1810780	the entire organization can absolutely agree on as being the most critical assets. And identifying
1810780	1815240	those both from a technical and from an organization perspective is really important,
1815240	1819640	as it turns out. And then moving with that from an operational perspective,
1819640	1825560	creating reproducible scenarios to make sure that the defenses around those things are valid and
1825560	1831000	they continue to be valid over and over and over again over time. And then taking that a step
1831000	1835820	further, decoupling the techniques at the high level that you might be trying to execute on
1835820	1840920	from its actual literal execution. Again, going back to the MITRE ATT&CK thing. Well, there's a
1840920	1845500	ton of different ways to perform any individual technique. And keeping that in mind that you're
1845500	1850220	not just coded to, oh, we block this one command and therefore we're good to go. You have to think
1850220	1854600	of it iteratively. You have to think about it as an adversary growing over time and changing the
1854600	1861220	way they execute these actions. And so don't ever hesitate to not only change the way you do things,
1861220	1866360	but also use some of the same stuff that an internal adversary would. Maybe it's you're
1866360	1870900	doing the slightly motivated attacker and you're just exfiltrating over a VPN that you downloaded.
1870920	1875920	Or maybe you want to do something where you write a little bit of custom or download a little bit of
1875920	1881140	something that's Google-able, right? Those sorts of things are absolutely in scope and they don't
1881140	1886260	require Kali or Metasploit or any of these things. Because again, the slightly motivated insider
1886260	1892900	threat actor probably doesn't know how to spin up a Kali USB bootable stick, right? So thinking
1892900	1897760	about yourself in their shoes and the tools that they've got access to can create for some really
1897760	1904500	interesting scenarios. Just picture Elon Musk on Joe Rogan.
1905700	1909280	Just keep that in your mind as you're doing your threat actor analysis.
1910780	1917360	So we would be remiss if we didn't bring this up in a red team, blue team analysis monitoring
1917360	1922340	conversation. And we just want to make a quick note about AI and machine learning specifically
1922340	1928720	for blue teams. There's a lot of things that are pitched as like AI machine learning,
1928720	1937800	user behavior monitoring, adversary analysis stuff. Just be careful and remember that
1938500	1944420	there's a reason most adversaries don't need to have AI and machine learning in their malware.
1944420	1950160	It's because like their goals are pretty set. They know what they want to do and they don't
1950160	1956680	need to have polymorphic logic about trying to create ransomware, right? Like it's pretty
1956680	1962820	solid about what it wants to do. And so just remembering that their goals tend to be pretty
1962820	1968020	explicit going back to those crown jewels. So you don't need a polymorphic circle of wagons
1968020	1973280	around your fire necessarily. It's important to keep that simplicity sometimes is valuable,
1973280	1977280	especially if you don't know the scope of what you're trying to monitor or the scope of the
1977280	1983540	problem. And so just be careful when you're rolling out AI and machine learning based defenses
1983540	1989280	and validate your vendor because some of them don't find anomalies correctly and some of them
1989280	1994220	need to be trained. And if you don't know that going into it, you might not have the silver
1994220	1999640	bullet you may have been paying for. And this is one of my favorite quotes, the difference between
1999640	2004220	machine learning and AI. If it's written in Python, it's probably machine learning. If it's
2004220	2009220	written in PowerPoint, it's probably AI. Just keep that in mind when you're hearing vendors say
2009220	2020930	things about these to you. It's just an important perspective. So one other thing that's worth noting,
2020930	2025470	and this was based off of some conversations we've had with experts in network monitoring,
2026990	2031370	beacons as a thing, like the how often malware phones home for its next instruction or
2031370	2036950	exfiltration. This is kind of an interesting use case for thinking of red team versus blue team or
2036950	2042410	working together to train a network monitoring team or what have you. So if a piece of malware
2042410	2046750	beacons home from an endpoint every five seconds, that's easy mode. It's pretty easy to notice that
2046750	2053690	on the wire from a network analysis perspective. Cool. So maybe you add 20 seconds beacons with 25%
2053690	2058530	randomization on that. Well, okay, now it's getting a little harder, but usually a team can identify
2058530	2064950	that. Then when you say, well, what about a five minute beacon with 75% randomization on that? Well,
2064950	2068850	it gets a little trickier, but it's still inside of scope for most network monitors.
2069030	2075190	But there is this kind of belief that once you hit the 30 minute mark, well, threat actors don't want
2075190	2079670	to have phone home every 30 minutes. That's impractical for them. So it's probably out of
2079670	2083850	scope for most network monitors. This is what we're talking about when we talk about scaling up
2083850	2090030	the fundamentals towards more advanced persistent threats, because beaconing home every 30 minutes
2090030	2094970	is, that's an easy one. When if you're thinking about a real advanced persistent threat, whose
2094970	2102130	engagement is not designed to last a week, it's designed to last years in total. And so,
2102130	2109050	you know, thinking about it as, oh, well, we trained our data set based on known traffic. Well, if this
2109050	2114270	user has been exfiltrating a gig of data to Dropbox every night for as long as you've been
2114270	2120270	monitoring the network, like, don't just assume that that's not an anomaly, because that threat
2120270	2124650	actor might have been there for a long time. And if they're slightly motivated, like they might not
2124650	2129750	know how to write an automation framework, but they could probably Google how cron works or
2129750	2134930	services work and how to, you know, dump a copy of something to Dropbox every night.
2134930	2143780	So just a quick note on adversary testing there. All right, to summarize,
2145340	2150220	employees are the best hackers. And this is another, thank you, Bryce. And this is a great
2150220	2158060	line, because they will work hard to achieve their goals. And even if they won't work hard,
2158060	2161360	they are slightly motivated to achieve their goals. And they're willing to try different
2161360	2168820	things to circumvent. So keeping that in mind, the red team should run scenarios as if they are
2168820	2172960	those slightly motivated attackers that have access to consumer grade tools that are very
2172960	2178780	good for things like exfiltration. And the red team is there to help design repeatable adversary
2178780	2183760	testing to help test the blue. The blue team should be working on baselines and shoring up
2183760	2188100	the fundamentals and learning network norms and understanding the standard of traffic,
2188100	2192300	which creates those purple team engagements. After you've identified the baseline together,
2192300	2198600	you can then validate that those baselines are being held and continue to shore up more and more
2198600	2204440	of the organization or better define these things as you move forward so that you can start to scale
2204440	2213680	up to the advanced threat actor beyond the slightly motivated. And yeah, Bryson, do you
2213680	2220100	have anything else before we wrap up? That's pretty much it. No, I look forward to a robust Q&A.
2220820	2225340	Awesome. Thank you, everyone, for your time. There's some notes there about some of the sources
2225340	2231040	we used, and we look forward to having discussions wherever those discussions maybe happen,
2231040	2234660	whether it's in the DEF CON Discord or otherwise. Thanks, everyone.