Latest Entries »


One of my co-workers, Rodger Wille, will be mentoring SANS’ Computer Forensic Investigations – Windows In-Depth course (FOR408) in Atlanta, Georgia starting February 20th.  This course is great for any Intrusion and Security Analyst, Incident Handlers, and other members of the security staff (or those wishing to get a job with their security teams) who are looking to gain more information and understanding on how to conduct computer forensic investigations within the windows environment and what/where artifacts can be found within a windows system.

This course will cover forensic image acquisition, analysis techniques and tools and will utilize a full-featured forensic lab students will take with them.

Topics covered in the course will include:

  • Windows File System Foundations
  • Evidence Acquisition Tools and Techniques
  • Law Enforcement Bag and Tag
  • Evidence Integrity
  • Registry Forensics
  • Windows Artifact Analysis
    • Facebook, Gmail, Hotmail, Yahoo Chat and Webmail Analysis
    • E-Mail Forensics (Host, Server, Web)
    • Microsoft Office Document Analysis
    • Windows Link File Investigation
    • Windows Recycle Bin Analysis
    • File and Picture Metadata Tracking and Examination
    • Prefetch Analysis
    • Event Log File Analysis
    • Firefox, Chrome, and Internet Explorer Browser Forensics
    • Deleted File Recovery
    • String Searching and Data Carving
    • Examination of Cases involving Windows XP, VISTA, and Windows 7, and Windows 8
    • Media Analysis And Exploitation
    • Forensic Analysis Report Writing

In addition to the great training, each participant will also receive the following:

  • Windows version of the SIFT Workstation Virtual Machine with full Windows 8 standard license
  • Full 3 month trial license to AccessData FTK and Guidance Software EnCase
  • Full 15-day trial license to MagnetForensics Internet Evidence Finder
  • Course DVD
  • Real-world Windows XP and Windows 7 cases for examination
  • Wiebetech Ultradock v5 Write Blocker Kit

SANS Mentor students get the same great SANS content and material as they would at a traditional SANS conference event in a much more relaxed and intimate environment with classes spanning 10 weekly two hour evening sessions.  This format eliminates travel costs and impact to mission by being away from the office during normal business hours and allows students more time to learn the material.  With much smaller classes, usually no more than 8-10 participants, students have the opportunity to get their questions answered in-depth and gain more hands on experience during the labs.  The Mentor, an industry professional and GIAC Certified in the course being mentored, is often available to answer questions from students between class sessions and will highlight more salient portions of the material and lead hands-on exercises each week.

About Rodger:

Rodger has over 14 years of experience in the computer security arena as an Incident Handler and Forensic Analyst. Rodger began his career as a Signals Intelligence Analyst in the US Army conducting Cyber Threat Intelligence. After serving in the Army, Rodger continued supporting the US Army as a Defense Contractor with the Army Computer Emergency Response Team (ACERT) working as an Incident Handler and later as in a Senior Incident Handler role leading a team of incident handlers for the Regional Computer Emergency Response Team CONUS (RCERT-CONUS). Previously, Rodger was the Federal Lead for the Research and Forensics team within the US Department of Health and Human Services Computer Security Incident Response Center (CSIRC) where he was responsible for leading network, memory and disk based forensics, malware analysis and incident response activities.  Currently, Rodger is a Principal Security Consultant for FireEye Labs, where he helps his customers battle advanced threats, conduct forensic analysis, respond to security incidents and develop security policy.

http://www.sans.org/mentor/class/for408-atlanta-20feb2014-rodger-wille  – Rodger can offer special pricing of exceptional savings for up to two seats in the course and 10% discount to all others.  Follow him on Twitter @RAW4n6 and direct message him for details.


Its official 2013 has been declared the year of the Agents.  Even though one of the world’s largest hacks occurred near the end of the year at Target, there is no competition with the NSA privacy issues and Agent Snowden’s escapade to Russia.  Thus, in spirit of Hackers & Agents this year goes to the Agents and in celebration I put together a summary of 2013.

AgentTshirtSpreadshirt Apparel

Check out the Spreadshirt shop.  There are now 25 items available for men, women, and children, including our latest Agent shirt in support of “The Year of the Agents”.  Our top seller for the year still remains the Rootkit Hoodie, but with the new additions we may see that change in 2014.

 

Co-Branding

Hack_Agent_store_Praetorian

Are you looking for a new handout for your next career fair?  How about something to hand out as a part of your company security awareness program?  Well in July of 2013 Hackers & Agents and Praetorian worked together to create a co-branded card deck and website.

Social Media

This year has been a boom on the social media front.  The Facebook page is at over 600 likes for the year and recently the Google + started gaining some traction.  These two avenues continue to be the primary means for communicating updates as well as discounts to our Spreadshirt apparel.

 

Booster Packs

DeckCon Shop AdOriginally the plan was to release two booster packs.  The threat booster which was geared at teaching individuals the threat landscape and the Deckcon booster which was geared at providing more in-depth security awareness on many common topics.  In short, there was a problem with packing small booster packs and as a result these two boosters were combined into one pack.  This new booster pack adds two complete new game mechanic modifiers for faster and engaging play.

 

Gamecrafter Awardsnaquadah_seller

This turned out to be a successful year for both the Gamecrafter and our card sales.  As a result, the core game was awarded four different awards throughout the year for sales.  The Gamecrafter site where the core game and booster packs can be purchased prominently displays these awards in the top right corner or our game.

 

BoardGame Geek

This year the game was also put on BoardGame Geek.  There is still a lot of work to get the name out here and if you own the game we ask that you provide feedback and review.

 

Website Updates

As with any online presence the main Hackers&Agents website has been updated to reflect some of these changes throughout the year.

Header

 


This year I was interviewed by Infotech Research Group pertaining to the difference between a SOC and SOF for a solution they were developing collateral.  Prior to the interview I prepared a response to their questions.  The data they were asking is very similar to questions I’m asked regularly around security operations solutions.  Therefore, I wanted to take this opportunity to put out some content around the core topics of security operations centers and functions. 

The fundamentals

What is the different between a Security Operations Center (SOC) and a Security Operations Function (SOF) and what is required to provide a state of the art intelligent security operations function?

To begin we must first clarify the difference between the two concepts.  In general a SOC is or can be a portion of the overall SOF.  A traditional SOC will usually focus around a SIEM whereas today’s security operations need to integrate multiple products and automate intelligence and response in real time. The traditional SOC was previously a large physical security command center.  Today the SOC has shifted into more of a function where many responsibilities are spread outside of the traditional physical command center.

We should not forget that one advantage of housing the security operation within the same physical location is the capability to easily segment, secure, and control the data within the environment.  When you start opening up the function you also open up access making it harder to secure the security data in larger environments.

1.0 and 2.0 what is the difference?

What are the key differences between a traditional SOC or SOF and the next generation solution (or version 2.0) and how is the next generation going to handle the newer technologies, as well as the continual changing threat landscape associated with big data, mobile computing, and social media?

The big difference is that monitoring is now no longer contained to inside organization and in many cases the data is not either, so in many cases you will be relying on third party organizations more.  That means you must have good processes in place with defined SLA’s to understand the capabilities of each provider.  Having a good understanding of the security for that third party environment will be critical to ensuring your data is not leaked.  Also having a good way to detect malware in the environment will also be important to help prevent lateral movement across the organization and its suppliers or providers.

Also, because of the advanced threats that specifically target individual personnel the next generation of security operations solution will eventually have to enter more into the home environment to protect those key targets.  Key executives that are targeted through their children or other family members will need to have some protections in place that help mitigate the risk.  These advanced threat actors will compromise another family member’s account by sending an email with a title like “homework help” or something similar to fool the victim.  Little does the parent know this was an attacker who hacked their kids account for the entire purpose of sending a word document with malware to attack the target executives work account eventually.

Some other items that will come more into play is real time threat intelligence.  Getting automated feeds in formats like STIX or open IOC with specific data that is relevant to your organization will become the norm for large enterprises.  In some cases even a private intelligence cloud will be used.

Why Implement a SOC or SOF in the first place?

Many of you may not currently even have a security operations function in place, however due to recent attacks you are wondering if this is the right fit for your organization.  To help with that decision understand there are usually two main drivers.

  • One is that the organization has had a series of major incidents and as a result needs to implement some type of monitoring and protection function.
  • The second driver is usually for increased profits.  The large MSSP or Telecommunications organizations will implement models to sell the managed SOF to their clients and therefore will build out operations.

At some point you really need to understand the threats to your organization.  Without a clear indication of the attacks the organization faces daily it will be hard to justify the cost of a SOC/SOF and therefore you may need to consider an outsourced option.

Responsibilities of the SOF

We know that security monitoring and incident response are obviously included at some level, but how about security devices maintenance, identity and access provisioning/de-provisioning, even security solution design and implementation.  Should those all be included?

Personally I don’t think device maintenance is a good function of the SOF.  My experience in the field having done penetration tests against organizations that have MSSP’s (Managed Security Service Provider) who perform both the security and maintain functions show that many items are typically neglected.  In short, the MSSPs can do everything from monitoring to maintenance, but in many cases they end up doing a poor job at everything because there is a lack of focus on one task.  For device management and maintenance the SOF should really only be involved with reviewing security compliance around device maintenance and involved in coaching or developing the processes to ensure out of compliance items are either removed from the network until updated.

Other functions such as identity access and entitlement reviews can be a part of the SOF, but usually this is not included based on a decision around corporate cultural.  Access control in many cases resides outside of the SOF or in an isolated SOF department and unless the organization can manage the cultural issues it will not work effectively in the SOF.  The SOFs function really should be to review and compliance check on access controls and violations of access.  We also need to be careful about giving the SOC too much capability because then the SOC becomes a single point of failure for security.

Overall some core items that should be provided by the SOF are:

  • Monitoring, alerting, threat analysis, correlation and intelligence
  • Incident response, investigation, malware and threat analysis, and serving as an extension of the forensic teams in some cases
  • Advisory on corporate security solution designs

Outsourcing the SOF

How do you determine then if the SOF should be outsourced or not?  There are several drivers in the decision making process that will determine if the function should be outsourced or not.  In almost all cases this is relative to cost or that fact that the organization does not have the appropriate skills in house.  In some cases the organization may also decide that it should not be investing in services that deviate from the core business goals.

Leveraging Centralized or Distributed Response Models

A challenge in many security functions is to determine the correct response model.  This really depends on the global extent and cultural diversity of the organization.  If the organization is global there will be many challenges if a central response team is implemented.  If you have to send someone onsite half way around the world it could take days depending on where in the world that person must fly.  Also you will run into challenges around language and VISA requirements.

On the other hand having a team that is distributed and speaks or reads multiple different languages is will enhance any response team in providing a timely and adequate response.  The time to location is quicker, command and control can be done while onsite (war room), and intelligence can be shared via the coordinating or central lead team.

Key Aspects of the SOF – People, Process, and Technology

To implement and maintain a successful SOF the right defense in depth strategy is required.

People – A successful SOF must have skilled staff that can think like the adversary.  This staff must also have technical knowledge and troubleshooting abilities to understand the threats and attacks.

Technology – The technology strategy at the most basic level must have several core components.  New generation malware detection at the network egress points and endpoints is a requirement.  A SIEM or correlation engine is necessary to integrate the logs of many technologies.  Finally some custom integration between the core network, endpoint, and SIEM products is required to automate as much as possible for both identification and containment of the threat.  Threat intelligence feeds will also become a core item in the next generation SOF to provide awareness of the latest trends as well as threats to the industry and its service providers.  Most current SOC functions try to increase the function with more analysis software.  The mistake with that is it requires the time of your skilled staff where as they should be looking to automate the analysis and containment tasks as much as possible and use a series of base products required to stop the attacks.  Some other SOF based solutions will talk about risk-based decision systems.  This is really just correlation and automation of high risk threats.

Process – For process there are several components.  Sound roles and responsibilities must be defined.  Automation of trouble ticking and remediation processes need to be in place. Threat risk assessments must be conducted to identify critical targets and the threat events that are high risk to the organization.  A SOF at many levels must be integrated into every important aspect of the business.  For example, if a hurricane is coming and the BCP department says we are on hurricane watch.  The SOF should be looking for phishing attempts leveraging the hurricane as an event to try and attack the organization suspecting that employees will be reading every email and website about the hurricane. 

Challenges within a SOF

There are hundreds of challenges to run a top notch next generation SOF, but there are some fundamentals that must be addressed.  Education of staff is critical.  Without the right skills the attackers will always hard to find in the organization and even harder to remove.  Ensuring that the operators follow the procedures with little or no exception and continually update information and tactics based on the threats facing the organization is important.  The management of the SOF must also make sure executive management understands the extent of the threat otherwise funding and other critical controls will be neglected or overlooked.  Also, everyone talks about implementing more process in the next generation SOF, but in reality the real solution is to take as much human interaction out of the process and automate analysis and protection. A solution for querying the endpoint and enforcing rules based on network detections, a solution for leveraging and automating multiple technologies, and a solution for using first detection malware appliances to forward blocking information into Firewalls and Web/email gateways; these are the critical improvements and challenges required to build out the next generation SOF.

The 5 People, Process, and Technology Requirements

There are various sizes of organizations and every SOF will be different in many ways, but with respect to people, process, and technology the simple and most effective measures for providing security to an organization are:

Technology

  1. Egress malware blocking technology covering both email and web vectors combined with a web proxy and spam filter.
  2. Application blocking and anti-virus software on the endpoints
  3. SIEM for centralized logging and correlation of information
  4. Global Risk and Compliance software for integrating security with other processes within the organization
  5. After that you will augment these core components with other software for compliance and other business requirements.

People

  1. Strong leadership
  2. A strong person in network and application security
  3. A strong person in risk management and security policy
  4. A strong malware and forensic skill on staff
  5. After that you can build out the team based on the scope and mission of the security function and leverage contractors or outsourced solutions.

Process

  1. Automation of as much process as possible
  2. A strong set of core policies and procedures for change control, incident response, alerting and reporting that focus on protecting the organization and its mission.
  3. Collection of metrics
  4. A process that modifies regularly to reduce detection, containment and remediation time
  5. A process to understand the real threats to the organization

Measuring Effectiveness

As a person running a SOF you will always be asked to prove the effectiveness.  Is there some important Key Performance Indicators (KPI) to help prove the value of the SOF?  This is a difficult question and each organization may have specific KPIs based on the goals of the organization.  However in general there are some core items that should be measured.

People

To help make sure each member of the SOF is working effectively, metrics around the roles and responsibilities for individual is important to measure.  This is important to help measure the skill level of each person and that each individual is working toward the mission of the SOF.  Therefore, measuring items such as:

  • Shift logs and components captured in shift logs
  • Hours analyzing events, hours automating, and hours researching

Together these items will help determine what you need to focus spending on and to help free up resource time in the future.

Technology

There are several items around the technology to measure including:

  • How many incidents over different time metrics (week/month, etc.)
  • Amount of incidents and events detected and the percentage of those that were automatically blocked or contained
  • Timeline breakdown for each incident (When it was detected, contained, remediated)
  • The breakdown of technology detection; there will always be overlap in detection, so this overlap should be measured to help effectively determine if a control is needed

Process

In the process area you will want to track several many different things to prove the effectiveness around the incident response process including:

  • Amount of time to resolve an incident
  • Estimated cost to resolve an incident
  • Increase or decrease in security spending over time (compare against protection metrics)

One of the other items that gets overlooked sometimes it to track the time it takes collect and report on the metrics.  Inevitably, a large portion of the documentation is manual, and collecting metrics is manual due executive presentable formats not existing.  The SOF will spend days at the end of each reporting period to generate the metrics and report to management.  If you can automate the collection and reporting by using a global risk compliance system, some sort of ticketing system, or by using some custom code then that will help immensely in the long run.

CSAW 2013 and Threads


This year’s CSAW and Threads events really show why NYU is a strong community for Cyber Security.  I was nothing but the best when it comes to the list of speakers.  Some of the key players expanded on their previous talks earlier in the year from Defcon, while others provided some sound interesting new ways to look at old security problems.  I especially enjoyed Hank Leininger’s password topology talk.

Threads Speakers

CSAW was also very impressive.  I had the privilege of seeing this event from the judges perspective for the High School Forensics (HSF) competition.  All I can say is that some of these contestants were simply impressive.  Not only was their forensic work top notch, but their reporting and quality of work performed was amazing for individuals with no professional experience.  The winners of this contest really do deserve the scholarships they are awarded and I’m sure many of them will continue to be key players in the security scene for years to come.  Congrats to all the teams especially The Cams Nugget and Electric Sheep.

CSAW 2013

CSAW High School Forensics (HSF)


With all the healthcare industry regulations around data leakage there has been a decent effort put in place to protect individual records, however the healthcare organizations are still struggling to get this under control from both a physical and cyber perspective.

Even though the medical industry is still battling to protect sensitive records they are facing another more persistent problem.  These organizations are under attack because the adversary wants to understand the underlying business practices and to obtain important intellectual property. With the aging population and billions of dollars spent on research and development for drugs, these organizations have a good deal of market cap to lose.

The recent FireEye report shows that although Healthcare is not the top malware candidate it is continually targeted by these attacks.  Also notice that the energy sector which has been heavily targeted in the past few years is tracking less than the healthcare industry.

FireEye Stats

http://www2.fireeye.com/WEB2012ATR2H_advanced-threat-report-2h2012.html

 

To understand the extent of the threat another posting was released on March 14 titled “Medical Industry Under Attack by Chinese Hackers”.  Here is one of the key quotes from this article.

“Healthcare is listed as one of China’s priorities in its 15-year science and technology development strategy for 2006 to 2020“

“Many of these victims have technology or drugs that are a monopoly. If you are the first to market with some great new technology breakthrough or drug, and you get a profit from that research … it would definitely be an issue for the Chinese to target some of these“

http://www.darkreading.com/threat-intelligence/167901121/security/attacks-breaches/240150858/medical-industry-under-attack-by-chinese-hackers.html

 

As recent as March 20th an article in The Daily Briefing was posted stating:

“Rich Barger—chief intelligence officer for CyberSquared, a data security company—said his firm can confirm that at least three Chinese advanced persistent threat groups, or APT groups, have targeted medical organizations.”

http://www.advisory.com/Daily-Briefing/2013/03/20/Hackers-target-medical-organizations

 

As you can see the industry is definitely under attack and many healthcare organizations are more than likely compromised.  The unfortunate problem is that these companies are spending all their security money to focus on the leakage of personal and medical records, but they are still implementing the wrong controls to protect against a threat that impacts their entire business model.

If the healthcare industry does not shift its current security strategy and prioritize its spending on the right prevention controls then their data and business models will be complexly assimilated in the next decade.


Security technology spending is at an all-time high.  Determining the right strategy to reduce cost is essential to security planning and any CISO’s agenda.  Consider implementing the 7 following ways to optimize new security technology investments.

  1. Consolidating security vendors for particular solutions will reduce cost as a result of volume discounts and costs associated with increased complexity, risk, down time and staff management.
  2. Reducing the number of endpoint agents will reduce cost by decreasing the complexity of the environment, testing cycles per agents, and administrative staff time required.
  3. Negotiating hardware and software licensing costs as well as security professional services for longer periods of time allows security vendors to reduce paperwork and management costs, which in turn can be provided back to the organization.
  4. Implementing adequate security protections can reduce costs associated with employee productivity loss, security breaches, as well as the IT labor costs associated with endpoint infections, managing signatures, false positives, tuning, etc.
  5. Using automated software to provide agent updates, tuning, patches, and signatures reduces costs associated with employee productivity loss and IT labor management.
  6. Reducing complexity of the environment by consolidating consoles for items such as endpoint and network technology, logging, or security configuration management provides faster access to relative data and possible security incidents.  Less complexity and faster access reduce costs by decreasing the infection rate and reducing the IT labor management.
  7. Focusing on the primary business while outsourcing certain security functions should be evaluated regularly.  Some costs may be reduced by avoiding security infrastructure and software costs as well as additional IT labor and training costs.

Whether defending against common malware or some determined Nation State, being able to proactively detect attacks and changes in the organization are required.  The past year I spent a large amount of time helping several organizations setup and put in place the right people, processes, and technology to help defend against increasing security threats.  Although many organizations spend millions of dollars on technology and hire staff to monitor security 24/7 the organizations were still lacking two fundamental items.

  1. The people although good at monitoring lacked the attack and threat mind set.  The staff was not able to figure out when an actual attack was happening.
  2. Second the organizations lacked the basic security operations processes required to keep track and make appropriate use of the vast amounts of data.

As a result I spent the past few months developing a whitepaper that specifically addresses the primary components of a SOC, which can be used to help organizations setup a centralized core and embark on developing the correct operational processes.  Although I don’t address item number one above, this paper explains in detail the following.

  • Defining the SOC
  • Determining the Processes
  • Understanding the Environment that needs protected
  • Identifying the SOC Customers
  • Staffing the SOC
  • Managing the Events
  • Leveraging ITIL compliance

Creating and Maintaining a SOC – The details behind successful Security Operations Centers

If your organization is under attack and you have invested in more people and technology be sure to implement the right processes and build a foundation for future defense.


There has been a large amount of security information and recent attacks posted in the media.  We have Mandiant’s report on China as well as several issues concerning Java.  The pure volume of information over the past year has made it difficult to keep up without a combination sources.  As a result InfoSecAlways has done a few modifications to the site.  Please check out the new “Security Feeds” in the right column (4th Block Down).  This is a combination of about 20 different security RSS feeds piping into the blog now.  You can check the site daily to get the latest news and updates in the industry.

Also, check out the links page as there are several new Threat and Vulnerability links added.  These are great if you are looking for specific attacks, breaches, or threats.


Like any other HackerCon there are good and bad things, so I will jump right into the interesting stuff.  The start of the conference was a little slow taking less of an attacker security approach, which I prefer.  In any event around midafternoon was a talk called “Wipe the Drive!!! Techniques for Malware Persistence”.    Mark Baggett and Jake Williams discussed some amazing techniques used by attackers.  I mean things that even memory forensics don’t catch.  They were discussing persistence tactics like:

  1. You remove malware and later your computer scans for a wireless access point as a part of normal activity and that scan releases the malware again.
  2. Your remove malware and later you plug in a standard clean USB key.  At this point the trigger of the key being plugged in releases the malware and infects the system.

Again their entire suggestion on the talk was to suggest wiping the drive is again the only safe way to possibly remove malware and to think otherwise might be foolish.

Day 2 and More

On the second day I ended up attending a few different sessions.  There was a talk on running a CTF that went through some of the tactics but mostly explained the amount of time it takes to setup and run a CTF.  Several of the other talks I went to were less than technical in my opinion and I felt everything could be Googled in about the same time I was in the presentation.  There was one exception, Carson Zimmerman packed the room (seriously no sitting space) with his talk on “Ten Strategies of World Class Computer Security Incident Response Team”.  I came in late, but what I saw was good.

ShmooganographyOther activities at the Con were always entertaining.  The Lockpick village always provides a good time filler in-between sessions.  I enjoyed spending some time handing out a few Hacker&Agent card decks to  kids.  Also, there was plenty of hacker and security speak in the evenings at the hotel bar.  Otherwise if you like games there were some contests on the Xbox or I would suggest testing your skills by taking a stab at Shmooganography. If you get a chance and get into the 2014 conference its worth at least taking a look.  Below is a preview of the 2013 contest.

Again overall a good Con, but I think some of the talks need to be more technical and in-depth next year.


Over the past three weeks an ongoing LinkedIn thread titled “Shall we trust our employees or not?” has continued to be a hot topic of debate. There simply appears to be no agreement among all the contributors.  Trust is relative.  You can always trust an employee or an organization, but the key is to what extent. You can also always trust that particular characteristics or actions will be repeated by each entity.  For example, some employees will always keep a secret while others will always tell at least one other person.  Therefore, you can trust one person to keep a secret and you can also trust the other person to tell your secret.  Simply put its a matter of behavior and action over time that should be used to build the trust model.

When referring to trust among organizations Section 2.6.1 Establishing Trust Among Organizations in NIST SP800-39 provides the best explanation.

Parties enter into trust relationships based on mission and business needs. Trust among parties typically exists along a continuum with varying degrees of trust achieved based on a number of factors. Organizations can still share information and obtain information technology services even if their trust relationship falls short of complete trust. The degree of trust required for organizations to establish partnerships can vary widely based on many factors including the organizations involved and the specifics of the situation (e.g., the missions, goals, and objectives of the potential partners, the criticality/sensitivity of activities involved in the partnership, the risk tolerance of the organizations participating in the partnership, and the historical relationship among the participants). Finally, the degree of trust among entities is not a static quality but can vary over time as circumstances change.

 

Follow

Get every new post delivered to your Inbox.