>> Techniques for risk reduction.
The learning objectives for
this lesson are to define deceptive technologies,
to describe security data analytics,
and to utilize endpoint
exploitation risk reduction techniques.
Let's get started. The first thing
we're going to discuss are deceptive technologies.
The first one, it would be a Decoy File.
These are files that might look appealing to an attacker,
but we're monitoring them for signs of access.
They're also known as honey tokens.
Then we can move up to a Honeypot.
This pretends to be a real computer system,
but is actually fake and it is designed to
monitor any activity that happens on that system.
Finally, we have a Honeynet,
which uses several Honeypots
together and pretends to be an entire network.
Now the purpose of these Honeypots, files,
and nets is to get attackers redirected
into one direction and stuck over here,
instead of looking over for the real systems
is to take time away from them,
but also is designed
to notify us that something is occurring.
If a device that
should not be accessed by anyone in the network,
because none of the employees of
the company know that it's there
suddenly is being accessed and we get alerts for it,
then we can immediately shift
our focus over there to find out what's going on.
We can also use simulators.
These are less complicated to deploy,
and they can be as simple as
a single application running to simulate services.
We can also use dynamic network configurations.
This is where the network configurations
can be redeployed
after an attack is noticed so that we can contain it.
We could automatically enclose
part of the network to keep them locked in over
there and then isolate
that network now from the rest of our corporate network.
Instructor side note. If you want
to play with a Honeypot for your network,
I would recommend checking out OpenCanary.
You can quickly deploy
a customizable simulation for your own network.
You can find out more information that the URL below.
But you can run it very lightweight and it can
pretend to be a NAS device,
or a Windows device,
or even a Linux machine running something simple as SSH.
But you will receive alerts based on
whatever configurations you have set up to run.
It just sits quietly over in the corner,
I tend to run them in
VMs and no one knows that it's there,
but if that IP address is ever
accessed or scanned with Nmap,
then I'm going to get an alert,
and then that's going to let me know, hey,
someone's on the network is not supposed to be there.
Security data analytics.
These are a set of tools that will help us to collect,
order, and then analyze
the vast amounts of data available on an enterprise.
That way we can identify
security incidents and then
we can perform threat detection.
Data sources are usually either static or streaming.
Static sources would be considered
log files on systems where
streams are live data that is in near real-time.
These tend to be our intrusion detection systems
or intrusion prevention systems.
Endpoint exploitation risk reduction.
This is about preventative controls.
The first one we're going to discuss
is antivirus software.
This will detect and then
identify malicious software on an endpoint.
Most of us are probably familiar with this already.
Then we can also use immutable systems.
This is a system that is unchangeable.
It's also often referred to as frozen.
You can't make any changes to it, therefore,
it's very difficult for it to become compromised.
Next, we can use hardening.
This is where we remove
any unnecessary elements from a system,
make configuration changes to
make the system less vulnerable.
It often involves using establish baselines.
For example, on a Linux system,
if you don't need SSH to administer that machine,
disable the SSH service.
We can also use sandbox detonation.
This is a segregated system
that can allow for the execution of
malware so that we can see what it does without
risking it infecting the rest of our production systems.
Application controls.
We can use allow versus Block Lists.
This will control what can or cannot run.
A good example of this is AppLocker for Windows.
We can also use licensing,
maintaining licensed software to
avoid costly fines or ketchup fees.
We can also use atomic execution.
This is where a task runs with
exclusive access to resources.
We can also use time checks versus time of use, TOCTOU.
Performing a series of
steps after checking that
an important value has occurred,
a user logs into a system
after which the user account is disabled,
but the user would still have
system access since the account
was changed after the authentication.
This is where we want to make sure
that just because we took
an action by disabling that user's account,
if they're still logged in,
that's already passed the authentication process,
they're still accessing our systems.
You want to be very careful
that any decisions that are made,
that you're checking the actions
that happen before those.
Security automation tools.
These will help us to automate
the repetitive tasks on systems and across our networks.
You can use scheduled tasks such as
cron and Windows scheduled task.
You can also use scripting languages
such as batch scripts,
batch files on Windows,
and then PowerShell and Python.
Physical Security Requirements.
Physical security is often overlooked,
but a critical part of our overall security plan.
We want to make sure that we have well-planned lighting,
cameras that work together to ensure
that quality video images are collected.
We also want to make sure we have
access control through the use of locking doors,
visitor sign-ins with badging,
and then access logs.
If we need fencing to make sure that our building
is surrounded by a protective barrier of some sort,
we need to make sure we allocate for that.
Also, we want procedures for handling
incidents that are seen on our videos,
so physical security is going to be different
for every type of organization.
A doctor's office isn't going to
need as much of this as say a corporation would.
But with the plummeting cost of video cameras,
there's almost no reason why
the cameras shouldn't be
installed in almost any business,
especially in key areas.
Let's summarize. We went over endpoint risk reduction.
We also discussed disruptive technologies.
We went over security data analysis and then the use of
security automation tools and
finally, physical security considerations.
Let's do some example questions.
Question 1, a blank is
a fake computer that is designed to lure
attackers in and contain them so they can
be monitored. A Honeypot.
Question 2, this is a system configured to be frozen and
unable to be changed. Immutable System.
Question 3, this type of data source includes
sources such as intrusion detection systems
or intrusion prevention systems.
Stream data. Finally question 4,
the process of removing unnecessary services and making
configuration changes to enhance security is, Hardening.
Hope that lesson was helpful for
you, and I'll see you in the next one.