>> Hey guys, welcome back to
this Cyber kill chain course on Cybrary.
This is Abdurahman Alnaim.
Today we're going to cover defense
in depth using the kill chain.
We went over the kill chain,
we went over reconnaissance where we gathered
as much information as we can about the target.
Then in phase 2,
we use that information that we gained during
reconnaissance to build our weapon,
the payload that we use later on
to exploit and install on the victim's machine.
In delivery, we went over social engineering and we
delivered our payload using
>> a social engineering attack.
>> In exploitation, we exploited
the human weakness and installed
the payload on the victim's machine, in phase 5.
In phase 6, we used
MSFconsole Metasploit to have
command and control over our back door,
the payload that we installed in phase 5.
Finally, we actioned on our objectives
and got access to the current dos dot text file.
Luckily in our example was in the desktop,
but it's usually not as easy as that.
We move to defense.
What we want to do in defense,
we want to use these defense actions,
detect, deny, disrupt,
degrade, deceive, and contain at
each and every level of the Cyber kill chain.
In detector what we're trying to do,
as an example, in reconnaissance.
We're trying to detect any reconnaissance.
In denial, we're trying to deny it in disrupt,
we're trying to stop it or
change it and degrade we're trying to
reduce or counter attack the attacker,
and deceive, we're trying to
either send them false information back during
command and control or send
them fake data during action on objective.
In contain we use our design when
we designed our network and the segregation in
our network to ensure that
the attack is contained in the smallest possible way.
The best idea to attack something like this or to
go through a defense action is to create a matrix.
The matrix would have the seven phases at the top.
Reconnaissance, weaponization,
delivery exploit, install,
C2 is command-and-control and action
on objective on the top.
Then on the other axis we have detect, deny,
disrupt, degrade, deceive and contain.
Then we start building our defense in depth model.
This is more of a framework that you can use.
I'm going to leave a copy of this in
the resources page of this matrix.
Then you can take this matrix,
based on the threat agents,
the risk appetite, and the budget of your company,
decide what controls you want to add.
As an example in reconnaissance,
you need to do some web analytics
because it's a fairly passive step.
You want to know what information
is out there about your company.
As we saw in our example,
Cybrary hit the web masters or
the system admin information, it's not available.
You also want to have something like
a network intrusion detection
to identify any fingerprinting
or any scanning that happens on your system
and deny a strict firewall policy
, is extremely important.
You don't want people to have
access to your back-end servers.
If you have a web application server do not
allow SSH connectivity remotely, something like that.
The other way of denying, because again,
it's a fairly passive step
is something like information sharing policy.
You want to tell your employees what
can they and they can't share on the Internet.
You don't want them to put the
firewall model that you use,
you don't want them to put what kind
of backbone routers use and so on.
In the sub, you want to have something like reporting.
You want to raise the awareness of your employees,
to report any reconnaissance
that is going on the Internet.
Someone might say, how would they know?
Again, with enough awareness,
they would be able to identify that
someone is communicating to them or
accessing their LinkedIn page that is malicious.
I know of a company or organization that
was a victim of
a social engineering campaign
>> on one of the social media.
>> One of the employees identified it,
reported to the company and reported to the authority.
They were able to stop that attack at the recon phase.
He did not even move on to the following stages.
In weaponization again, because
that's needs of being fairly passive,
there's not a lot that you can do.
However, your threat intelligence
should be able to identify
what kind of threats are you vulnerable to,
and you want to continue doing the same thing,
across delivery, exploit,
installation, command and control
and action on objectives.
You can use something like honeypots,
you can privilege access management,
log monitoring its key,
host intrusion, detection system and so on.
Obviously, this is an example and it's
not something that you have to follow.
However, the matrix is
a framework that I highly recommend because it
would give you an idea what kind of controls do
you have and where are you lacking?
Obviously, you want to have
>> as much controls as possible.
>> The matrix, however, due to a higher risk appetite
or a low threat on the corporate and a low budget,
you might not be able to go
through or have controls for each and
every one of the phases.
For our post assessment questions,
what are the steps of the defense actions?
We covered this, we started with detect,
deny, disrupt, degrade, deceive, and contain.
Second is how do we use
>> the Cyber kill chain in defense?
>> As I said, if you want to protect from a hacker,
you have to think like a hacker.
The best way to do that is to use the Cyber kill chain.
Then in each and every phase you want to detect,
deny, disrupt, degrade,
deceive, and contain.
Finally, is the cyber defense matrix,
the one I showed in the example applicable for all.
As I said, the cyber defense matrix
as a framework is applicable for all.
However, the examples that I showed are not necessarily
applicable to your organization or
the company you work for.
In today's video we covered
defense using the cyber kill chain.
In the next video we're going
>> to talk about criticism and
>> the unified cyber-security kill chain and we're going
to conclude our course. See you then.