Brakeing Down Security Podcast Blog

How has COVID-19 changed cybersecurity? Why is cyber resilience especially important now? What are the most important steps to ensure cyber-resiliency? How do you talk to business leaders about investing in cybersecurity to boost resiliency?

The best way for organizations to keep their ‘crown jewels’ secure is adopting a Zero Trust mindset. Organizations need to take advantage of adaptive security infrastructure that can scale to meet current and future organizational needs, and take steps to ensure even third-party hosted data is policy compliant.

Most CISOs don’t talk to the board all the time so they don’t understand that’s the conversation they want to have. By making sure that the security team’s spokesperson has an intelligent plan that shows how wrong things could go. Showing how money is directly connected to mitigating the risks is vital to getting the funding needed, and showing why an increase in spend coordinates with decrease of risk.

Cyber-Resilence-

https://en.wikipedia.org/wiki/Cyber_resilience

https://en.wikipedia.org/wiki/Business_continuity_planning#Resilience

https://www.darkreading.com/cloud/cyber-resiliency-cloud-and-the-evolving-role-of-the-firewall/a/d-id/1337206

Doug Barth and Evan Gilman - https://brakeingsecurity.com/2017-017-zero_trust_networking_with_doug_barth

part1 with Masha Sedova: https://traffic.libsyn.com/secure/brakeingsecurity/Masha_sedova-elevate_security-profiled-education-phishing-part1.mp3

Part2: https://traffic.libsyn.com/secure/brakeingsecurity/2020-019-masha_sedova-privacy-human_behavior-phishing-customized_training.mp3

https://www.helpnetsecurity.com/2017/08/24/assume-breach-world/

Key concepts:

Visibility into your environment

Controls necessary to repel attackers

Architecture of the network to create chokepoints (east/west, north/south isolation)

Threat modeling and regular threat assessment

Mechanisms to allow for rapid response

How long will current security controls hold a determined attacker at bay?

Business-wide Risk Management response can often determine resiliency in a Crisis/Breach situation.

Cyber-Resilence Framework (per NIST https://csrc.nist.gov/publications/detail/sp/800-160/vol-2/final)

What does “cyber resiliency” mean in the to the organization? To the department? To the individual? and what of the mission or business process the system is intended to support?

Which cyber resiliency objectives are most important to a given stakeholder?

To what degree can each cyber resiliency objective be achieved?

How quickly and cost-effectively can each cyber resiliency objective be achieved?

With what degree of confidence or trust can each cyber resiliency objective be achieved?

(What do we as security people do to ensure that all of these are properly answered? --brbr)

Architecture of systems:

Depending on the age of our information systems and technology stacks, cruft builds up or one-off systems are setup and forgotten.

We (infosec industry) talk about shifting security left in a DevOps environment to ensure security gets put in, but should we do as an organization when we think about adding systems in terms of cyber-resilience? (It would seem that resilience may also be tied to the security or functionality in a piece of hardware and software. Proper understanding of all the systems capabilities/settings/options would be essential for drafting responses --brbr)

Some related and tangential suggestions for ideas/comments/themes/topics in case you feel like any fit into the conversation:

Comparison of security to the human immune system.
Does resilience (i.e., assume breach) imply there are failures you can recover from, yet other, existential risks you need to avoid? And what does that mean in practice?
How do you define “most valuable assets”? Value vs. obligations vs. ...?
Does a compliance mindset help or hinder resilience, and vice versa?
Referring back to a prior show, how does the human element contribute to resilience?
NIST doc makes a point that resilience only has meaning when it works across a system, how does this idea impact the cost of entry? And is there a tipping point for resilience?
Another point made is that speed should be viewed as an advantage. Is there an application of the OODA loop concept to resilience, then?
Cyber resilience resonates in other areas: Pandemics, natural disasters, and geo-political stressors. Could impact supply chain workforce effectiveness, other areas. Ransomware (which is cyber, but has other, knock-on effects).

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://pandora.app.link/p9AvwdTpT3

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Download here!

Wednesday, June 10, 2020

2020-022-Andrew Shikiar, FIDO Alliance, removing password from IoT, and discussing FIDO implementation

Andrew Shikiar, executive director and CMO of the (Fast IDentity Online) FIDO Alliance.

What is FIDO?

“ open industry association launched in February 2013 whose mission is to develop and promote authentication standards that help reduce the world’s over-reliance on passwords. FIDO addresses the lack of interoperability among strong authentication devices and reduces the problems users face creating and remembering multiple usernames and passwords.”

FIDO workflow

Did any one event precipitate creation of the FIDO alliance?

UAF= https://fidoalliance.org/specs/fido-uaf-v1.2-rd-20171128/fido-uaf-protocol-v1.2-rd-20171128.html

U2F = https://en.wikipedia.org/wiki/Universal_2nd_Factor (yubikeys, tokens)

https://landing.google.com/advancedprotection/

FIDO supports biometrics - https://www.biometricupdate.com/202002/how-fido-based-biometric-technology-clears-up-the-iot-authentication-mess

FIDO certified software and companies: https://fidoalliance.org/fido-certified-showcase/

IBM: https://www.ibm.com/blogs/sweeden/fido2-conformance-why-its-a-big-deal/ --

Digital Identity Guidelines: Authentication and Lifecycle Management - digital ID framework

NIST guidelines that FIDO meets: https://pages.nist.gov/800-63-3/sp800-63b.html#sec5

https://fidoalliance.org/certification/authenticator-certification-levels/

https://github.com/herrjemand/awesome-webauthn

https://fidoalliance.org/content/case-study/

https://loginwithfido.com/provider/

From a threat modeling perspective, how does ‘2fa’ occur when the authenticating method and the browser are on the same device?

Consumer education initiative https://loginwithfido.com/

IoT Devices- https://fidoalliance.org/internet-of-things/

https://blog.techdesign.com/fido-authentication-to-secure-iot-devices/

For Developers: https://fidoalliance.org/developers/ or https://webauthn.io/ - dev information about WebAuthN

https://github.com/herrjemand/awesome-webauthn

https://fidoalliance.org/events/ - upcoming webinars for FIDO related topics

NTT DOCOMO introduces passwordless authentication for d ACCOUNT

https://groups.google.com/a/fidoalliance.org/forum/#!forum/fido-dev

Download here!

Monday, June 1, 2020

2020-021- Derek Rook, redteam tactics, blue/redteam comms, and detection of testing

**If Derek told you about us at SANS, send a DM to @brakeSec or email bds.podcast@gmail.com for an invite to our slack**

OSCP/HtB/VulnHub is a game... designed to have a tester find a specific nugget of information to pivot or gain access to greater power on the system.

Far different in the 'real' world.

Privilege escalation in Windows:

*as of June 2020, many of these items still work, may not work completely in the future*

*even so, many of these may not work if other mitigating controls are in place*

PENTEST METHODOLOGY :

PTES -http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines

OSSTMM - https://www.isecom.org/OSSTMM.3.pdf

Redteam methodology: https://www.synopsys.com/glossary/what-is-red-teaming.html

https://www.fuzzysecurity.com/tutorials/16.html

https://medium.com/@Shorty420/enumerating-ad-98e0821c4c78

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md

Enumerate the machine

Services

Network connections

Users

Logins

Domains

Files

Software installed (putty, git, MSO, etc) *older software may install with improper permissions*

Service paths (along with users services are ran as)

Windows Features (WSL, SSH, etc)

Patch level (Build 1703, etc)

Wifi networks and passwords (netsh wlan show profile <SSID> key=clear)

Powershell history

Bash History (if WSL is used)

Incognito tokens

Stored credentials (cmdkey /list)

Powershell transcripts (search text files for "Windows PowerShell transcript start")

Context for above: Understand how the users make use of the system, and how they connect to other systems, follow those paths to find lateral movement, misconfigurations, etc. Each new system or user will provide further information to loot or avenues to explore

Linux EoP:
https://guif.re/linuxeop

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

Enumeration

Mostly the same as above

Bash history or profile files

Writable scripts (tampering with paths or environment variables)

Setuid/Setgid binaries

Sticky bit directories

Crontabs

Email spools

World writable/readable files

.ssh config files (keys, active sessions)

Tmux/screen sessions

Application secrets (database files, web files with database connectivity, hard coded creds or keys, etc)

VPN profiles

GNOME keyrings- https://askubuntu.com/questions/96798/where-does-seahorse-gnome-keyring-store-its-keyrings

Ways to defend against those kinds of EoP.

Something cool: https://www.youtube.com/playlist?playnext=1&list=PLnxNbFdr_l6sO6vR6Vx8sAJZKpgKtWaGX&feature=gws_kp_artist -- high Rollers

Derek is speaking at SANS SUMMIT happening on 04-05 June (FREE!) - https://www.sans.org/event/hackfest-ranges-summit-2020

Ms. Berlin is speaking at EDUCAUSE - VIRTUAL (04 June) https://www.educause.edu/

Download here!

Wednesday, May 27, 2020

2020-020-Andrew Shikiar - FIDO Alliance - making Cybersecurity more secure

Andrew Shikiar, executive director and CMO of the (Fast IDentity Online) FIDO Alliance.

What is FIDO?

Did any one event precipitate creation of the FIDO alliance?

UAF= https://fidoalliance.org/specs/fido-uaf-v1.2-rd-20171128/fido-uaf-protocol-v1.2-rd-20171128.html

U2F = https://en.wikipedia.org/wiki/Universal_2nd_Factor (yubikeys, tokens)

https://landing.google.com/advancedprotection/

FIDO supports biometrics - https://www.biometricupdate.com/202002/how-fido-based-biometric-technology-clears-up-the-iot-authentication-mess

FIDO certified software and companies: https://fidoalliance.org/fido-certified-showcase/

IBM: https://www.ibm.com/blogs/sweeden/fido2-conformance-why-its-a-big-deal/ --

Digital Identity Guidelines: Authentication and Lifecycle Management - digital ID framework

NIST guidelines that FIDO meets: https://pages.nist.gov/800-63-3/sp800-63b.html#sec5

https://fidoalliance.org/certification/authenticator-certification-levels/

https://github.com/herrjemand/awesome-webauthn

https://fidoalliance.org/content/case-study/

https://loginwithfido.com/provider/

FIDO DataFlow

From a threat modeling perspective, how does ‘2fa’ occur when the authenticating method and the browser are on the same device?

Consumer education initiative https://loginwithfido.com/

IoT Devices- https://fidoalliance.org/internet-of-things/

https://blog.techdesign.com/fido-authentication-to-secure-iot-devices/

For Developers: https://fidoalliance.org/developers/ or https://webauthn.io/ - dev information about WebAuthN

https://github.com/herrjemand/awesome-webauthn

https://fidoalliance.org/events/ - upcoming webinars for FIDO related topics

NTT DOCOMO introduces passwordless authentication for d ACCOUNT

https://groups.google.com/a/fidoalliance.org/forum/#!forum/fido-dev

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://pandora.app.link/p9AvwdTpT3

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Download here!

Wednesday, May 13, 2020

2020-016-

Masha Sedova - Founder, Elevate Security

Topic ideas from the PR company:

Inability to measure human security behaviors leads to increased risk in our computing environments. For too long, we’ve accepted training completion and mock phishing data as a sufficient way to measure this risk. But where do the vulnerabilities and strengths truly lie?

The secret is, security teams have installed tons of security tooling that can give insights into how our employees are behaving. But we just leave this data on the cutting room floor. Masha Sedova can talk about where to find this goldmine of data and what security teams can do to leverage this new found knowledge.

Technology like vuln scanners or something more?

Study after study shows that the reason why people don’t do things is not always because they don’t understand, it’s because they are not motivated. Motivating employees to change their cybersecurity behavior can seem like an overwhelming task but there are simple behavioral science techniques cybersecurity professionals can leverage to motivate employees to do the right thing. Masha Sedova will discuss the power of integrating elements of behavioral science into security in order to influence positive behavior.

Motivation Theory (deming): https://en.wikipedia.org/wiki/W._Edwards_Deming#Key_principles

X&Y https://en.wikipedia.org/wiki/Theory_X_and_Theory_Y

Ouchi Z theory https://en.wikipedia.org/wiki/Theory_Z_of_Ouchi

http://www.yourarticlelibrary.com/motivation/motivation-theories-top-8-theories-of-motivation-explained/35377

Masha’s suggested topics:

Why do security teams have difficulty in understanding their human risk today? What are the blockers?

What should security teams be measuring to get a holistic view of human risk?

What's the difference between security culture, security behavior change, and security awareness?

Is security culture a core capability in security defense? Why or why not?

Quantifying risk…

Is investing in human training a waste of time?

Phishing - mock phish or real phishing