WEBVTT 00:00.000 --> 00:02.220 at the golden age of Insider Threats. 00:02.220 --> 00:04.380 I'm Adam Macinci, that's Bryson Bort. 00:04.380 --> 00:06.660 We'll introduce ourselves again here in a second. 00:07.040 --> 00:18.980 And just before we get started on anything else, yes, it is known to be misspelled kind of intentionally because it's you are the adversary within because it's about Insider Threats. 00:18.980 --> 00:20.020 It's a joke. 00:20.020 --> 00:21.960 We're paid to hack things, not tell jokes. 00:21.960 --> 00:23.020 Not tell jokes. 00:23.380 --> 00:24.700 It's not great. 00:24.700 --> 00:27.460 Anyway, real quick, who am I? 00:27.460 --> 00:28.840 I'm Adam Macinci. 00:28.960 --> 00:30.700 I do all sorts of stuff. 00:30.700 --> 00:33.620 I volunteer and speak with the Red Team Village. 00:33.620 --> 00:34.740 I do their one-on-one track. 00:34.740 --> 00:36.420 I'm a member of the C2 Matrix. 00:36.520 --> 00:38.760 I'm the head of product management at Scythe. 00:38.760 --> 00:42.260 I've got a background in enterprise solutions and crypto and privacy and whatever. 00:42.260 --> 00:43.200 That's me. 00:43.320 --> 00:45.360 And also here's Bryson. 00:45.820 --> 00:47.220 Ash said a lot of words. 00:47.220 --> 00:49.020 He's our token Californian. 00:50.080 --> 00:57.120 I founded Grimm eight years ago to build the best team of hackers because this is no longer an individual sport. 00:57.120 --> 00:58.320 It's a team sport. 00:58.320 --> 01:00.000 Defenses have gotten really good. 01:01.540 --> 01:04.720 About two years ago, I spun out Scythe. 01:04.940 --> 01:08.960 That's my full-time job for an adversary emulation platform where I work with MASH. 01:09.020 --> 01:12.160 And then I'm a co-founder of the ICS Village non-profit. 01:12.460 --> 01:16.060 So hopefully you have a chance here at DEF CON to also check out the ICS Village. 01:19.130 --> 01:20.250 All right. 01:20.510 --> 01:31.350 And so what we'll be talking about today is a bunch of things, not only Insider Threats, but also the value of post-exploitation and why that's important philosophically. 01:31.370 --> 01:39.650 And we'll talk about defense validation through threat emulation and why focusing on endpoints from a red team and from a blue team and from a purple team perspective is important. 01:39.890 --> 01:50.270 And obviously, Insider Threats and why their lives are a little easier than most folks when it comes to being adversaries and why boards and leadership cares and why defenders are overwhelmed. 01:50.270 --> 01:57.770 And then we'll talk about the cycle of red and blue working together towards purple teaming and why this is all relevant from an Insider Threat perspective. 01:58.150 --> 02:03.510 So first off, let's talk about the value of post-exploitation. 02:03.510 --> 02:14.470 And this is kind of a bit of a philosophical argument for us, but we generally have the following three principles that we as the InfoSec community just feel to be true. 02:14.470 --> 02:16.870 So one, it's not if, but when. 02:16.870 --> 02:20.930 So everybody has the potential to be compromised and it will inevitably happen. 02:20.930 --> 02:24.010 Every organization has the ability to be compromised. 02:24.450 --> 02:26.850 Two, there will always be zero days. 02:26.850 --> 02:28.430 There will always be end days. 02:28.550 --> 02:33.910 There will always be bugs in software, which creates a new exploit and that will always be the case. 02:34.010 --> 02:40.490 And then finally, social engineering and Insider Threats, to whatever degree you want to count that, will always work. 02:40.490 --> 02:44.090 There's always someone who will click the email link. 02:44.090 --> 02:45.890 There will always be someone who plugs in the thumb drive. 02:45.890 --> 02:49.110 That is inevitable and there's a lot of reasons for that. 02:49.110 --> 03:01.550 So if we believe those principles to be true, then kind of philosophically, post-exploitation behaviors from an adversary's perspective is more important than the exploit itself. 03:01.550 --> 03:04.930 It doesn't matter all the CVEs that we use to get in. 03:04.930 --> 03:07.410 It's what the adversary does once they are in. 03:07.410 --> 03:10.270 That's the thing that's more important philosophically. 03:10.330 --> 03:12.050 There's also two layers to this. 03:12.050 --> 03:16.110 So if you think about this simply, we're talking about access. 03:16.390 --> 03:28.250 Access, typically, people think of the antiquated way of, I have a perimeter and a third party has gained unauthorized access. 03:28.250 --> 03:29.750 And that is part of it. 03:29.750 --> 03:40.230 And so what you can summarize this is, is the ability to gain access is across an infinite scope of possibility because it's not just technical. 03:40.230 --> 03:42.450 It is a question of people and technology. 03:42.450 --> 03:47.010 The second part of access is there's also access within the organization. 03:47.010 --> 03:58.630 So once I've breached the perimeter, once I've compromised, then I'm still working the access problem in an iterative way as I try to work from where I am to where I want to go. 03:58.630 --> 04:05.510 And each one of those steps starts with that access problem, which again, can be solved through technical or social means. 04:06.730 --> 04:12.890 And this is all particularly pertinent when we're talking about it from a red team perspective. 04:12.890 --> 04:18.810 So for example, if we take a red team are performing an adversary test and we take the following two scenarios. 04:18.810 --> 04:27.110 So in the first scenario, they take a custom binary that they've made and they detonated on an endpoint during this engagement. 04:27.110 --> 04:29.790 Well, they've been caught and that's been burned. 04:29.790 --> 04:36.010 So that's a valid test of a security control that an unsigned piece of malware was able to be caught. 04:36.010 --> 04:37.370 That's a good thing. 04:37.490 --> 04:52.630 But an equally valid test from a red team perspective is creating that same custom piece of malware and then putting it in an allow list for that specific binary and then having it go through and not be caught and letting the behavior run after the fact. 04:52.630 --> 05:10.810 These are equally valid tests because in the first one, you validated the security control of do you block unsigned things that are potentially malicious, but in the latter, you're running an O day or an N day scenario as if that thing was able to work its way into being allowed and then fire its behavior after the fact. 05:10.810 --> 05:15.610 So it's important to point that out that these are equally valid tests from a red team perspective. 05:16.990 --> 05:20.810 So the other part here is we're validating our assumptions. 05:20.810 --> 05:29.150 I can't tell you how many conversations I've had with folks where we go in and they're like, oh, you know, we're paying this amount of money for this and we know it does this. 05:29.370 --> 05:30.070 Well, how do you know? 05:31.270 --> 05:32.070 Try it. 05:32.070 --> 05:32.910 Check it. 05:33.010 --> 05:37.630 Once you do that, you're building up that arsenal of validating those assumptions and keeping it going. 05:39.490 --> 05:43.950 Another way to look at this is it's like being an APT on the cheap. 05:43.950 --> 05:56.230 By proving the control works and then using configuration like allow list to allow something to go past control, that's the equivalent of a technical compromise like what an APT can do, right? 05:56.230 --> 05:57.770 We assume that they can do that. 05:57.770 --> 05:59.950 It's a question of if, not when. 05:59.950 --> 06:07.970 And by doing that allow list, you just, for free, with little effort, achieve the same goal as what that APT can. 06:11.890 --> 06:20.570 So with all that in mind, let's talk about insider threats and what's specific to them when we talk about insider threats from a red team perspective. 06:20.850 --> 06:25.690 And specifically, let's talk about today's endpoints. 06:25.690 --> 06:29.970 So for the sake of this conversation, an endpoint is something that a user interacts with. 06:29.970 --> 06:33.650 So it's not like a web app or a web server or something like that or an S3 bucket. 06:33.650 --> 06:38.810 This is something that figures on keyboard, somebody's actually utilizing. 06:38.850 --> 06:52.190 And the reason we're focusing on this, especially from an insider threat perspective, is not only is this most likely what the user will be interacting with as an insider threat, but also this is where we see the majority of organizations compromised from. 06:52.190 --> 06:55.690 This is the phishing links and everything according to there. 06:55.690 --> 07:05.110 And ultimately, you know, all these systems are in place to try to protect users from all sorts of malicious stuff and patches are important and all these things are true. 07:05.110 --> 07:08.850 However, humans are difficult to secure. 07:08.850 --> 07:13.110 People are curious, they're willing to give out their password for a candy bar. 07:13.110 --> 07:16.830 Phishing is something that's really difficult to get rid of entirely. 07:16.830 --> 07:21.230 People plug USB drives into stuff all the time because of curiosity. 07:21.230 --> 07:30.330 And then taking it a step further, as an organization, you probably have all sorts of third parties and all sorts of vendors whose technology you're utilizing. 07:30.330 --> 07:36.210 And when they come on site, how do you make sure that the security controls that you have for your staff apply to them? 07:36.210 --> 07:39.590 And this is a very difficult problem to solve, as it turns out. 07:40.550 --> 07:49.290 So with this all said, we're down to these couple of points from an endpoint perspective, which is endpoint usage is really difficult to monitor. 07:49.470 --> 07:53.030 And it's particularly difficult to emulate. 07:53.030 --> 07:58.710 And to reiterate here, humans are random, they do all sorts of random things. 07:58.710 --> 08:06.130 And figuring out how to monitor for theoretically random behavior, even though that humans have trends, it can be very difficult to do. 08:06.130 --> 08:12.530 And then it's also tricky to emulate a perfect user in that way, because people do random stuff all the time. 08:12.530 --> 08:21.250 And they, especially when they're interacting heavily with a laptop, say, well, you can't always reliably and predictably say what a given user may or may not be browsing to. 08:21.350 --> 08:25.130 So it's just those are important to remember as we move forward. 08:25.570 --> 08:34.690 And to preface this upcoming slide, we love privacy and security and encryption, these are all good things that we believe in philosophically. 08:34.690 --> 08:42.030 But it becomes a little tricky when we talk about securing and specifically monitoring end users. 08:42.190 --> 08:57.170 So this has created a world because of the usability of encryption and privacy and all these pieces of technology, where it's kind of the best time ever to be an insider threat actor, they have a lot of capabilities at your disposal. 08:57.370 --> 09:07.670 And so just to call out a few, let's look at Firefox's scent, which is unfortunately been taken offline, because it was being used maliciously, of course. 09:07.670 --> 09:19.730 But for a long time, like almost a year, we had the ability for a high reputation domain that allowed end to end encrypted exfiltration and delivery of arbitrary things in another networks. 09:19.730 --> 09:22.370 Now, this is a great user privacy tool. 09:22.370 --> 09:25.670 But consequently, it was also be used to like deploy malware. 09:25.670 --> 09:27.370 And that's why it's now offline. 09:27.370 --> 09:41.510 And the same is true for all sorts of VPN technology, whether it's cloud flares, 1.1.1.1 plus warp, this is just instant VPN, DNS security at the consumer level. 09:41.510 --> 09:46.450 And these are things that we now like bring your own devices one clearly. 09:46.450 --> 09:50.030 And so everybody has these abilities running in the user space on their own devices. 09:50.070 --> 09:54.330 And it just allows for a lot of exfiltration events outside of an organization. 09:54.330 --> 10:00.870 So like MDMs have essentially lost, there is no real enterprise mobility solution. 10:00.870 --> 10:08.070 And then you pair all of these consumer technologies with the fact that enterprises are just using more cloud based technology. 10:08.070 --> 10:11.870 Well, that's instant high reputation exfiltration right there. 10:11.870 --> 10:30.990 So whether it's legitimate cloud use of Google Apps, or being able to use things like Dropbox, or what have you to steal data out, like who's going to block Google Drive in an enterprise that uses Google Drive, this is just opening up all these doors for insider threats to steal stuff out of a network. 10:31.850 --> 10:34.690 And of course, we now have the elephant in the room. 10:35.070 --> 10:40.190 In the pandemic era, 60% of all workers are remote. 10:40.510 --> 10:51.090 So you no longer have to worry about the challenge of how do I physically remove assets into a safe location because your safe location is already at home. 10:51.310 --> 10:58.930 So we now have, this is where we've seen a lot of enterprises moving to the cloud because it's a bandaid for security. 10:59.030 --> 11:09.990 Certainly VPN usage has bumped up because well, at least I can encrypt the corporate asset in the home environment to the corporate environment. 11:10.090 --> 11:26.530 And what I would offer just for some little extra free advice is think of the using least privilege in these circumstances, have them log into a essentially a demilitarized zone of minimum privilege access, and then they validate out of that to go further into the infrastructure. 11:26.530 --> 11:29.170 So offering those kinds of things slow them down. 11:29.230 --> 11:32.850 The other challenge we have here is around testing this. 11:33.090 --> 11:37.450 We are now talking about a mixed environment where it's no longer just corporate assets. 11:37.450 --> 11:42.310 We now have corporate assets in a private asset environment, right? 11:42.310 --> 11:43.690 Who owns that router? 11:43.690 --> 11:45.370 Who owns those other devices on that network? 11:45.370 --> 11:52.890 Those are the employees' personal devices and it makes it difficult to bring that in scope for a test. 11:53.630 --> 12:05.370 And this also ties into the challenge, of course, back in the old days where we did have BYOD where a lot of folks didn't necessarily have policies around that. 12:05.370 --> 12:14.070 And being able to identify IoT traffic and specific device fingerprinting is a very challenging problem. 12:16.960 --> 12:30.640 And that really leads us to the fact that although trust is critical, and we can't emphasize this enough, it's not only critical, but it's arguably more critical than ever. 12:30.640 --> 12:40.340 Because monitoring solutions, there's a whole suite of offerings in a pre-COVID-19 era. 12:40.340 --> 12:48.940 But now that everyone's at home, monitoring is an even trickier solution to try to implement when you have all these deployed endpoints in all sorts of different places. 12:48.940 --> 13:00.420 And so trusting your employees is critical because there's fewer and fewer ways to modify the things that you're doing and monitor always explicitly. 13:00.420 --> 13:11.060 And to all the things that Bryson just said, it's about restricting access now, not so much monitoring for every keystroke or every bit of browsing bit that goes on. 13:11.060 --> 13:25.480 And so we think about allow requirements, we think about how folks can circumvent blocks and all of these things, where we're now having to play whack-a-mole with all of the possible consumer solutions as well that come from legitimate providers and legitimate domains. 13:25.480 --> 13:27.700 This is very, very tricky. 13:27.700 --> 13:39.080 And so one of the ways I think about it is, it's not even so much like how do you prevent, or how do you emulate the APT or the highly motivated adversary? 13:39.080 --> 13:45.840 Instead, I think of it as how do you even prevent exfiltration from a slightly motivated adversary? 13:45.840 --> 13:53.100 Someone who doesn't necessarily know how to roll their own crypto, but they can download a VPN app on their device and turn it on. 13:53.100 --> 13:57.940 They have a motivation, they're just not highly motivated. 13:57.940 --> 14:01.280 And so that's where we get this idea of the slightly motivated adversary. 14:01.280 --> 14:04.340 And what to do about that scenario can be very, very tricky. 14:09.740 --> 14:16.580 So with all that about insider threats wrapped up, how do we think about all this from a red team perspective? 14:16.580 --> 14:21.080 Well, the good news, I mean, good news for the red team, maybe not so much for the blue. 14:21.540 --> 14:32.000 The red team can use all these principles and philosophical paradigms that we're in to create adversary scenarios that use all the advantages of these things. 14:32.000 --> 14:43.640 So this is things running in the user space, things running at runtime, no exploitation required, because if you're simulating an insider threat, well, they probably have the ability to double click something on their endpoint. 14:43.640 --> 14:52.540 And they're not necessarily doing so because they were tricked into doing it, they did it because they wanted to, and they're willing to kind of take a couple steps in order to achieve that goal. 14:55.670 --> 15:11.950 So now for the red teamer who's creating a campaign, they could do what the malware authors do, where they design things around, well, what are the capability of a slightly motivated adversary, so they can run in the user space, they've got access to valuable data, 15:11.950 --> 15:17.890 like, you know, their documents folder is probably important, there's probably some PII set more on that drive. 15:17.890 --> 15:23.790 Well, they also have access to those things and publicly accessible exfiltration tools, Pastebin. 15:23.790 --> 15:26.090 How many organizations have Pastebin allowed? 15:26.090 --> 15:30.470 Like, that's an exfiltration tool from a slightly motivated attacker perspective. 15:30.610 --> 15:46.490 And not only that, the red team also has on top of those capabilities, knowledge of ODAs and NDAs, knowledge about how to automate these things, deploy infrastructures to do more advanced exfiltration techniques, they know how to obfuscate, they know how to be more anonymous. 15:46.490 --> 15:52.210 So you ratchet these things together and you think, what do you get for free by pretending to be an internal adversary? 15:52.210 --> 15:54.950 And then you put on top of that all the stuff you could do as a red teamer. 15:54.950 --> 15:59.890 Well, that creates a very exciting scenario from a red team adversary perspective. 16:00.970 --> 16:07.790 Talking about Pastebin and executing in user space, check out the Blue Team Choose Your Own Adventure. 16:07.790 --> 16:13.950 We did a short Choose Your Own Adventure that involves ransomware that takes advantage of those. 16:15.730 --> 16:17.810 Yeah, that's an excellent point in and of itself. 16:17.810 --> 16:25.950 If we think about modern ransomware, you don't need to run as admin to do modern ransomware, like end users can create and delete files. 16:25.950 --> 16:27.410 They have permissions to do that. 16:27.410 --> 16:30.630 And ransomware says, great, I want to create and delete files, right? 16:30.630 --> 16:31.510 That's the point. 16:31.510 --> 16:36.490 It's all these things are in the user space, and you just get them for free, thinking of as an adversary does. 16:36.830 --> 16:42.730 So now that we know all the advantages, what can the red and blue teams do about it? 16:42.730 --> 16:53.070 Because the slightly motivated adversary is very, very powerful, and they have the ability to both accidentally and intentionally compromise endpoints. 16:53.130 --> 17:02.130 And given that the blue team now has to think about everything from a disgruntled staffer to an APT, well, that's a pretty big scope. 17:02.130 --> 17:11.550 Actually, I don't... Bryson, I don't know if I fully get your Joe Rogan, Elon Musk image on this one. 17:11.870 --> 17:20.050 Yeah, so what I was going for here was you got a picture of Elon Musk as the disgruntled staffer, and he's sitting there at home. 17:21.270 --> 17:23.790 I was employee 53. 17:23.790 --> 17:29.150 They don't take me seriously enough. 17:29.150 --> 17:31.530 They don't respect me, and I'm gonna quit. 17:31.530 --> 17:37.610 I'm gonna burn this place to the ground, and this is him taking his red stapler on the way out while it burns. 17:40.260 --> 17:41.180 Fair enough. 17:41.180 --> 17:43.260 There's your disgruntled role play. 17:43.260 --> 17:44.780 Yeah, that's good. 17:45.280 --> 17:52.660 I mean, defining Elon Musk as a staffer might be a bit of a stretch, but the analogy certainly plays. 17:52.660 --> 17:58.760 But given that that is inside a threat model for a blue team, that can be incredibly tricky, right? 17:58.760 --> 18:02.160 And so what do we do with all this? 18:02.160 --> 18:06.820 Well, an answer to this is shoring up the fundamentals. 18:06.820 --> 18:24.220 So it's not so much like would you detect a foreign country inside your organization slowly beaconing little documents over the course of years over DNS, but thinking about, well, would you notice standard exfil if someone started dumping gigs of data out in the middle of the night? 18:24.220 --> 18:27.100 These sorts of fundamentals are really important. 18:27.120 --> 18:36.820 And thinking about validating the controls and validating those tests in a repeatable way via adversary testing, this is that red and blue team working together. 18:37.660 --> 18:47.340 So real quick, before we dive deeper on that, I do want to make a quick note about the vendor industry on this one, which is a little awkward. 18:47.860 --> 18:58.640 So if we think about breach and attack simulation as a thing, so that is a Gartnerism that is way overly broad, and it can mean a wide variety of things. 18:58.640 --> 19:01.440 But generally speaking, we think of it as kind of spectrum. 19:01.440 --> 19:05.100 And on one end of the spectrum, we have controls validation tools. 19:05.100 --> 19:12.020 So these are agent-based things that repeat known signature actors and traffic in these sorts of PCAP replays and what have you. 19:12.020 --> 19:15.320 And then on the other end of the spectrum is more advanced adversarial testing. 19:15.320 --> 19:18.840 And there's a whole simulation versus emulation argument that we could talk about. 19:18.840 --> 19:23.320 And these are the kinds of tools on the other side that the red teams in Pentesters use. 19:23.380 --> 19:28.660 And there's all these sorts of other things we could talk about, like how they align to MITRE ATT&CK and why that's important. 19:28.700 --> 19:45.580 But for the most part, all of these things inside of the spectrum do satisfy this idea of assumed compromise and assumed breach scenarios, regardless of whether or not you're compiling something via MS Venom and Metasploit, or whether you're using a breach and attack simulation tool. 19:45.580 --> 19:49.460 You could use both of these things in an assumed compromised way. 19:49.460 --> 19:54.040 And that's worth noting about this whole spectrum of tools. 19:57.800 --> 20:03.480 I mean, the only thing I'd jump on here is where I throw out that MITRE ATT&CK is not a bingo card. 20:04.900 --> 20:20.600 What I mean by that is what MITRE ATT&CK is a great compendium of understanding all of the correction, a lot of the elements, because it may never be complete, of a common vernacular for us to describe attacks. 20:20.900 --> 20:22.700 You can't use it as a checkboard. 20:22.700 --> 20:26.320 You're like, I have successfully made sure that this can never happen. 20:26.620 --> 20:28.380 T1033 will never happen. 20:28.720 --> 20:31.060 That's the wrong way to look at it. 20:31.060 --> 20:35.820 And part of that is because I like to describe it as a periodic table. 20:35.820 --> 20:38.440 And the attacks in it are different elements. 20:38.440 --> 20:43.280 And the way and the order that those elements are combined is a chemical equation. 20:43.280 --> 20:48.340 And whether you get lead or gold depends on that order. 20:48.620 --> 20:59.040 And so the point being is that a static look of particular elements without understanding the context that they're in changes what that means. 20:59.040 --> 21:05.820 My ability to do lateral movement is going to be affected by whether or not I have credentials or not, for example. 21:06.940 --> 21:08.220 Simple example. 21:11.560 --> 21:24.120 And when we think about these sorts of chemical elements like Bryce is describing, and these sorts of things are accidentally using it as a bingo card, well, this can be exceptionally tempting when we're talking about something like a controls validation solution, 21:24.120 --> 21:33.540 where it's automatically testing whether or not you can send data to something that's known as evildomain.com over these firewall ports and all these sorts of things. 21:33.540 --> 21:44.600 Well, you can define these rules in the controls validation tool and have it automatically test those things over and over and over again and let you know if your configuration management's falling over and that sort of thing, which is all very valuable. 21:44.600 --> 21:51.440 But it is tempting to just say, oh, we're tagging, we're looking for that port for exfiltration, we're done with that MITRE ATT&CK ID. 21:51.580 --> 21:57.100 And again, it's important to note that these controls validation tools are very static. 21:57.100 --> 21:59.740 They're agent-based, they're signature-based. 21:59.740 --> 22:05.180 And kind of most important from our perspective, we're talking about internal adversaries and insider threats. 22:05.180 --> 22:07.900 These aren't production endpoints that these things are installed on. 22:07.900 --> 22:12.620 These things aren't simulating users or internal threat actors, necessarily. 22:12.620 --> 22:18.920 They're just doing, here's some analysis from the threat intel community, fire for effect, here's a PCAP. 22:19.020 --> 22:23.760 So it's not exactly what we're talking about here from an insider threat emulation perspective. 22:27.220 --> 22:34.300 Just to kind of finish that off, there's no people in the loop on this one, right? 22:34.300 --> 22:37.380 It's about automating these solutions and detecting these sorts of things. 22:37.380 --> 22:41.100 And so it is repeatable, and it is easy to implement these controls validation tools. 22:41.100 --> 22:45.520 But ultimately, they're not really something that the red team is going to utilize. 22:45.680 --> 22:49.080 And they're more about unit testing than adversary behavior. 22:49.080 --> 22:56.280 And often these are unfortunately at the mercy of the vendor, because the vendor is the thing that's pulling down the threat intel. 22:56.280 --> 23:03.300 It says, these are all the tests you can run, you might have very limited ability to change them a bit , but it's not a customizable tool. 23:03.300 --> 23:08.300 So that's a concern when we're thinking about controls validation from an insider threat perspective. 23:08.900 --> 23:13.240 The only thing I'll add there is what's at the top is that people are not in the loop. 23:13.240 --> 23:25.420 And what we mean by that is that these are great detection engineering tools, but you're not including the user affecting the behavior around looking at what those technical controls do or don't do. 23:25.440 --> 23:35.960 And then the second part is you're not able to measure the response, because it's a set stage for what your sock is looking at. 23:36.140 --> 23:46.520 But I think it was also a bit glossed over on what the pros here with change control, your ability to know what you're always going to see and building that library out. 23:46.720 --> 23:54.620 We take it for granted that things work the way that they're supposed to work, and that our challenge is finding attackers in that noise. 23:54.620 --> 24:03.140 There is also the challenge that tools break, configurations drift, things stop working for various reasons. 24:03.140 --> 24:08.540 And so knowing for sure what I'm looking for, be able to identify that is a significant value proposition. 24:12.580 --> 24:24.080 And so with all that in mind from a controls validation benefit, like cost benefit evaluation, let's look at the other kinds of tooling that we mentioned, which is adversary testing or adversarial testing. 24:24.080 --> 24:28.540 And so again, for the sake of this discussion, an adversarial test is more about behavior. 24:28.540 --> 24:34.660 And we've been talking about post exploitation behavior specifically, whereas a pen test is often focused on those exploitations. 24:34.660 --> 24:43.320 So here, it's about a red team creating a scenario where they can validate and see what the network defenders would notice. 24:43.320 --> 24:45.140 So will they notice exfiltration? 24:45.140 --> 24:46.720 Will they notice lateral movement? 24:46.720 --> 24:52.460 Will they notice if I increase my beacon heartbeats or the randomization of those heartbeats, that sort of thing. 24:52.460 --> 25:04.180 And this allows the red team or third party pen test or red teaming firm to test these things and to see if they can get an initial foothold and see what the remediation time on that looks like. 25:04.180 --> 25:08.820 And they can also define whatever artifacts they may choose to leave. 25:08.820 --> 25:20.880 So you could say, well, we think that in this kind of threat scenario, someone may want to... the adversary would drop this folder, or they would they try to create this key and leave that on an endpoint. 25:20.880 --> 25:23.860 Those can be predefined with an adversary test. 25:24.020 --> 25:31.740 And so moving a little further down that rabbit hole, these things are highly customizable, which can be a good and a bad thing. 25:31.740 --> 25:37.320 The more time a red team takes to create them, the more difficult it can be to replicate them. 25:37.320 --> 25:42.720 And especially when it comes to the idea of a blue team might want to remediate this thing and then test it again. 25:42.720 --> 25:47.960 Well, the more complex it was to create it, the more difficult it is to test it and validate it again. 25:47.960 --> 25:59.880 So although there's a lot of flexibility from creating these sorts of engagements that are very red team adversarial focused, they are fairly technical, there's a high learning curve, and they tend to be more expensive. 25:59.880 --> 26:04.300 And then finally, one of the cons for them is that they are very limited snapshot in time. 26:04.400 --> 26:15.660 So for example, if a red team comes in and performs a high criticality test and nobody notices, the blue team could come back and say, oh, well, we didn't notice that because the person who would have noticed it was out on vacation. 26:15.660 --> 26:17.300 Can you come back and do it again? 26:17.300 --> 26:21.560 But if the level of effort for doing it again is significant, you have a bit of a problem now. 26:28.180 --> 26:36.520 So with all that said, let's talk about the goals for a blue team, not only from a red team, blue team perspective, but also what we're thinking about insider threat actors. 26:36.520 --> 26:38.260 What are the goals? 26:38.260 --> 26:44.480 Well, the initial goal should be, do you notice network anomalies, those baselines again? 26:44.480 --> 26:48.900 Would you notice if there's weird exfiltration happening at odd times from odd places? 26:48.900 --> 26:53.940 Would you notice if someone was downloading a bunch of stuff off of a shared drive from their house? 26:53.940 --> 26:58.200 Are those sorts of things, the anomalies, the big ones, noticeable? 26:58.200 --> 27:02.060 And how do you handle the signal to noise ratio? 27:02.060 --> 27:04.440 How do you handle weird DNS traffic? 27:04.440 --> 27:11.240 Are you logging for things like PowerShell on workstations that probably don't need to be running PowerShell in the user space? 27:11.280 --> 27:22.280 And then how do you slowly but surely build those fundamentals and scale all the way up to more advanced persistent threats, more advanced admin capabilities, more advanced threat actors? 27:22.280 --> 27:26.720 And how do you internally build up those defenses over time? 27:26.720 --> 27:38.060 So this is one way to think about it from a defensive perspective of trying to catch the most verbose of insider threats or adversaries and then slowly working your way towards the more subtle adversaries. 27:43.660 --> 27:47.360 Now on the flip side of that, we have what are the goals for the red team? 27:47.360 --> 27:51.880 So the red team for the adversary is starting with crown jewel assets. 27:51.880 --> 27:56.760 And I'll actually let Bryson speak to that one because this is a Brysonism if there ever has been one. 27:57.900 --> 28:01.120 So if there's ever been I think I have many. 28:01.120 --> 28:04.000 I don't know that this one qualifies as special. 28:04.060 --> 28:09.860 This grew out of a Twitter discussion I was having around systemic risk yesterday. 28:09.860 --> 28:22.060 So for those of you who think that it's just unicorn and cooking picks, I also will occasionally lead what's sometimes fast for intellectual discussions on different aspects of InfoSec. 28:22.140 --> 28:26.400 Because I don't think I know everything, I think combined we all know a lot. 28:26.620 --> 28:36.560 So somebody in particular talked about crown jewels and the idea was talking around the fact that assets have different value, just like users have different value. 28:36.560 --> 28:45.000 There are different qualities of assets and insider threats based on that user and those assets and their access to those assets combined. 28:45.440 --> 28:49.540 And so we do not have unlimited resources. 28:49.540 --> 28:54.300 Nobody here has a limited time, people, or money to do everything that they want to do. 28:54.380 --> 28:58.000 And so the key is figuring out, well, what matters to the business? 28:58.000 --> 29:02.060 What are the critical things, the crown jewels, in the organization? 29:02.060 --> 29:07.900 And prioritizing those when we're looking at our assessments and emulations. 29:08.740 --> 29:15.580 And the simple metaphor that I use to describe this, which I'll pivot off of crown jewels, is you're circling the wagons around the campfire. 29:15.580 --> 29:31.060 You can imagine that you're on the Oregon Trail, only a few of your party have died of dysentery, camp down for the night, eating your squirrel meat that you hunted during the day, and you circle the wagons around that part of the organization that you know for sure you have some level of positive control about. 29:31.060 --> 29:39.040 The rest of the organization is on fire, pillaged by the wasteland. 29:39.420 --> 29:47.740 You start with what you can control effectively and then you slowly grow out from there in increasing priority with the context of the business. 29:47.740 --> 29:53.620 That's behind my crown jewels assets CJA Brysonism. 29:54.960 --> 29:56.080 That's perfect. 29:56.080 --> 30:04.360 And what we've seen from an industry perspective is that boards and executives are very comfortable with that idea of identifying the crown jewels and it's scaling out accordingly. 30:04.360 --> 30:10.300 Because there are things that the entire organization can absolutely agree on as being the most critical assets. 30:10.300 --> 30:16.460 And identifying those both from a technical and from an organization perspective is really important, as it turns out. 30:16.460 --> 30:29.340 And then moving with that from an operational perspective, creating reproducible scenarios to make sure that the defenses around those things are valid and they continue to be valid over and over and over again over time. 30:29.340 --> 30:38.120 And then taking that a step further, decoupling the techniques at the high level that you might be trying to execute on from its actual literal execution. 30:38.120 --> 30:40.160 Again, going back to the MITRE ATT&CK thing. 30:40.160 --> 30:44.040 Well, there's a ton of different ways to perform any individual technique. 30:44.040 --> 30:49.300 And keeping that in mind that you're not just coded to, oh, we block this one command and therefore we're good to go. 30:49.300 --> 30:51.040 You have to think of it iteratively. 30:51.040 --> 30:56.380 You have to think about it as an adversary growing over time and changing the way they execute these actions. 30:56.640 --> 31:05.420 And so don't ever hesitate to not only change the way you do things, but also use some of the same stuff that an internal adversary would. 31:05.420 --> 31:10.900 Maybe it's you're doing the slightly motivated attacker and you're just exfiltrating over a VPN that you downloaded. 31:10.920 --> 31:17.340 Or maybe you want to do something where you write a little bit of custom or download a little bit of something that's Google-able, right? 31:17.340 --> 31:23.820 Those sorts of things are absolutely in scope and they don't require Kali or Metasploit or any of these things. 31:23.820 --> 31:32.420 Because again, the slightly motivated insider threat actor probably doesn't know how to spin up a Kali USB bootable stick, right? 31:32.420 --> 31:39.340 So thinking about yourself in their shoes and the tools that they've got access to can create for some really interesting scenarios. 31:40.360 --> 31:44.500 Just picture Elon Musk on Joe Rogan. 31:45.700 --> 31:49.280 Just keep that in your mind as you're doing your threat actor analysis. 31:50.780 --> 31:58.780 So we would be remiss if we didn't bring this up in a red team, blue team analysis monitoring conversation. 31:58.780 --> 32:03.880 And we just want to make a quick note about AI and machine learning specifically for blue teams. 32:04.520 --> 32:13.860 There's a lot of things that are pitched as like AI machine learning, user behavior monitoring, adversary analysis stuff. 32:14.060 --> 32:24.420 Just be careful and remember that there's a reason most adversaries don't need to have AI and machine learning in their malware. 32:24.420 --> 32:28.520 It's because like their goals are pretty set. 32:28.520 --> 32:35.600 They know what they want to do and they don't need to have polymorphic logic about trying to create ransomware, right? 32:35.600 --> 32:38.700 Like it's pretty solid about what it wants to do. 32:38.740 --> 32:44.660 And so just remembering that their goals tend to be pretty explicit going back to those crown jewels. 32:44.660 --> 32:49.980 So you don't need a polymorphic circle of wagons around your fire necessarily. 32:49.980 --> 32:58.200 It's important to keep that simplicity sometimes is valuable, especially if you don't know the scope of what you're trying to monitor or the scope of the problem. 32:58.260 --> 33:10.540 And so just be careful when you're rolling out AI and machine learning based defenses and validate your vendor because some of them don't find anomalies correctly and some of them need to be trained. 33:10.540 --> 33:16.620 And if you don't know that going into it, you might not have the silver bullet you may have been paying for. 33:16.620 --> 33:20.980 And this is one of my favorite quotes, the difference between machine learning and AI. 33:20.980 --> 33:23.920 If it's written in Python, it's probably machine learning. 33:23.920 --> 33:26.360 If it's written in PowerPoint, it's probably AI. 33:26.360 --> 33:31.540 Just keep that in mind when you're hearing vendors say things about these to you. 33:31.700 --> 33:34.560 It's just an important perspective. 33:38.570 --> 33:52.430 So one other thing that's worth noting, and this was based off of some conversations we've had with experts in network monitoring, beacons as a thing, like the how often malware phones home for its next instruction or exfiltration. 33:52.950 --> 34:00.410 This is kind of an interesting use case for thinking of red team versus blue team or working together to train a network monitoring team or what have you. 34:00.410 --> 34:05.450 So if a piece of malware beacons home from an endpoint every five seconds, that's easy mode. 34:05.450 --> 34:09.270 It's pretty easy to notice that on the wire from a network analysis perspective. 34:09.270 --> 34:10.030 Cool. 34:10.070 --> 34:14.950 So maybe you add 20 seconds beacons with 25% randomization on that. 34:14.950 --> 34:19.190 Well, okay, now it's getting a little harder, but usually a team can identify that. 34:19.750 --> 34:24.710 Then when you say, well, what about a five minute beacon with 75% randomization on that? 34:24.710 --> 34:28.850 Well, it gets a little trickier, but it's still inside of scope for most network monitors. 34:29.030 --> 34:37.370 But there is this kind of belief that once you hit the 30 minute mark, well, threat actors don't want to have phone home every 30 minutes. 34:37.370 --> 34:38.610 That's impractical for them. 34:38.610 --> 34:41.510 So it's probably out of scope for most network monitors. 34:41.650 --> 34:52.050 This is what we're talking about when we talk about scaling up the fundamentals towards more advanced persistent threats, because beaconing home every 30 minutes is, that's an easy one. 34:52.050 --> 35:01.270 When if you're thinking about a real advanced persistent threat, whose engagement is not designed to last a week, it's designed to last years in total. 35:01.270 --> 35:08.070 And so, you know, thinking about it as, oh, well, we trained our data set based on known traffic. 35:08.070 --> 35:22.390 Well, if this user has been exfiltrating a gig of data to Dropbox every night for as long as you've been monitoring the network, like, don't just assume that that's not an anomaly, because that threat actor might have been there for a long time. 35:22.390 --> 35:34.930 And if they're slightly motivated, like they might not know how to write an automation framework, but they could probably Google how cron works or services work and how to, you know, dump a copy of something to Dropbox every night. 35:34.930 --> 35:38.330 So just a quick note on adversary testing there. 35:41.820 --> 35:47.240 All right, to summarize, employees are the best hackers. 35:47.240 --> 35:49.400 And this is another, thank you, Bryce. 35:49.400 --> 35:55.620 And this is a great line, because they will work hard to achieve their goals. 35:55.620 --> 36:00.200 And even if they won't work hard, they are slightly motivated to achieve their goals. 36:00.200 --> 36:02.620 And they're willing to try different things to circumvent. 36:02.620 --> 36:15.040 So keeping that in mind, the red team should run scenarios as if they are those slightly motivated attackers that have access to consumer grade tools that are very good for things like exfiltration. 36:15.100 --> 36:21.200 And the red team is there to help design repeatable adversary testing to help test the blue. 36:21.200 --> 36:30.280 The blue team should be working on baselines and shoring up the fundamentals and learning network norms and understanding the standard of traffic, which creates those purple team engagements. 36:30.280 --> 36:47.760 After you've identified the baseline together, you can then validate that those baselines are being held and continue to shore up more and more of the organization or better define these things as you move forward so that you can start to scale up to the advanced threat actor beyond the slightly motivated. 36:51.860 --> 36:55.540 And yeah, Bryson, do you have anything else before we wrap up? 36:55.540 --> 36:57.500 That's pretty much it. 36:57.600 --> 37:00.100 No, I look forward to a robust Q&A. 37:00.820 --> 37:01.460 Awesome. 37:01.460 --> 37:03.140 Thank you, everyone, for your time. 37:03.140 --> 37:13.800 There's some notes there about some of the sources we used, and we look forward to having discussions wherever those discussions maybe happen, whether it's in the DEF CON Discord or otherwise. 37:13.860 --> 37:14.660 Thanks, everyone.