Introduction to Cyber Warfare

Part 1: Threat Landscape

• Agenda etc.
• What is cyber and the digital universe
• Damage 1: denying service
  • Flooding
  • Spoofing
  • Protocol malformations
  • Reflections and amplifications
• Damage 2: information gathering
  • Scanning, fingerprinting and enumeration
  • Manual vs. Automated spidering
  • Credential harvesting
  • Resource mapping
  • Error based information disclosure
• Damage 3: gaining privileges
  • Brute-force logins and passwords
  • Password hashes and password dictionaries
  • Custom dictionaries and password complexity
  • Bypass authentication mechanisms
  • Bypass session management
  • Bypass OS user and fs permissions
  • Bypass security software
• Damage 4: injecting code
  • cmd OS injections
  • data-store injections
  • file injections (XML, json, etc)
  • remote file and resource inclusion
  • injecting web clients (browsers)
  • injecting client applications (office, pdf, etc)
• Damage 5: binary exploitation
  • Buffer, stack and heap overflows
  • Browser and plugin exploitation
  • Memory corruptions
  • Code execution
     
    Part-2: Mitigation strategies                                                           
• What is defense all about
• Mitigation 1: blacklists
  • IP blacklists
  • Anti-malware defenses
  • URL filtering (... and ad blocking too)
  • Block mail SPAM and spoofs
  • Application firewalls (proxies and reverse-proxies, WAFs, DB-fw)
  • IDS/IPS/HIPS
• Mitigation 2: whitelists
  • NAC
  • Firewalls and access-lists
  • Application whitelisting
  • Application firewalls (positive proxies and reverse-proxies)
  • Web content filtering (WAFs and application-layer filtering)
• Mitigation 3: better authentication
  • strong passphrases
  • certificates
  • cryptography
  • multi-factor authentication
  • permissions and the ‘need to know’ rule
  • admins (locale & domain) and roots
  • audit
• Mitigation 4: manage your assets
  • patch operating systems and applications
  • perform vulnerability scans
  • harden OS and application configurations
  • maintain a ‘master’ system image bank
  • backup and disaster recovery
  • keep detailed logs and network traffic captures
• Mitigation 5: misbehave is the new malware
  • New rule: do not block
  • Sandboxes and dynamic analysis
  • Honeypots and decoys
  • Exploit mitigation tools
  • Centralized log collection and analysis (aka SIEM)
  • Network/host-based anomaly detection
  • Heuristic A/V and HIPS
• Mitigation 6: it’s all about the people
  • New profession: security analyst
  • User education
  • Skill assessment and training (of security teams)
  • Secure coding for developers
  • Penetration test
     
     
    Part-3: Putting it all together (optional)                                        
• Worst case scenarios (APT breach case study)
• APT kill-chains
• Security truisms
• Mitigation strategies compared (ASD mitigations)
• Security as a process (SANS 20 CSC)
• What is security by design?
• Final project: Security by design