WEBVTT 00:00.590 --> 00:02.240 Maybe even a little secretly. 00:02.240 --> 00:10.400 I think this is always been one of my favorite topics to teach because of the fact that we will scare 00:10.400 --> 00:18.050 the heck out of our students when it comes to security attack phases and the many ways that are easily 00:18.290 --> 00:20.540 able to be accomplished in that area. 00:20.840 --> 00:29.480 And then, of course, after scaring them, we can talk about solutions and countermeasures and we have 00:29.480 --> 00:30.920 a ton to talk about. 00:30.920 --> 00:39.530 And notice I'm really getting myself off the hook here legally, if you will, by saying some countermeasures. 00:39.710 --> 00:44.450 That word some is placed very, very intentionally there. 00:44.810 --> 00:51.170 There are other things that we can do, but these are some of the fundamentals that you need to be thinking 00:51.170 --> 00:54.320 about restricting web access. 00:54.560 --> 01:01.610 What I'm talking about here really is just hammering the hardening into your Web servers. 01:01.880 --> 01:06.920 Web servers should be tested constantly for any new vulnerabilities. 01:07.250 --> 01:15.890 You want to make sure that your Web servers are not leaking any metadata or data itself. 01:16.310 --> 01:17.420 Very critical. 01:18.200 --> 01:22.460 Another thing is obviously patching those Web servers. 01:22.730 --> 01:30.380 So we're going to be consistently looking for any, as I said, leaks that might be occurring of any 01:30.380 --> 01:31.160 information. 01:32.310 --> 01:38.650 We are going to be training the crap out of our end users. 01:38.670 --> 01:41.940 There I said it and crap is the official term. 01:42.960 --> 01:45.090 Shout out to the folks at i.t. 01:45.150 --> 01:46.080 Pro tv. 01:46.860 --> 01:53.880 They had invented an internal certification called the certified reboot administrator pro. 01:53.880 --> 02:01.950 I think it was the crap certification and it was a shirt that they created on April Fool's one year 02:02.160 --> 02:04.660 and released a great YouTube about it. 02:04.680 --> 02:05.280 Check it out. 02:05.970 --> 02:11.220 So some great countermeasures in the area of training your end users. 02:11.460 --> 02:14.550 Yeah, we're going to teach them to use pseudonyms. 02:14.880 --> 02:22.080 And, you know, obviously we're going to be teaching them a lot about how they conduct themselves in 02:22.080 --> 02:29.910 social media and really giving away very little about their job. 02:30.030 --> 02:35.850 Often times, right, social media, you know, maybe they're going to be instructed to keep that completely 02:35.850 --> 02:39.780 personal and not be discussing corporate business. 02:40.050 --> 02:41.310 Maybe it's the opposite. 02:41.550 --> 02:46.980 Maybe they'll be given guidelines on exactly how they're supposed to speak about the organization. 02:47.900 --> 02:56.700 We're going to be carefully monitoring all of the information that we release for an organization anywhere. 02:56.840 --> 03:02.480 So we're going to have teams reviewing public website information, teams reviewing what we've told 03:02.480 --> 03:03.110 journalists. 03:03.120 --> 03:04.000 You get the idea. 03:04.280 --> 03:07.490 Monitor all self release of information. 03:07.940 --> 03:13.040 And we are going to be self testing here, pen testing big time. 03:13.490 --> 03:21.200 You're going to be consistently running different types of reconnaissance tests against your own infrastructures 03:21.410 --> 03:24.650 to make sure there is rock solid as you think they are. 03:25.370 --> 03:29.780 You're going to want to reduce or eliminate the caching of your web content. 03:29.960 --> 03:33.350 So we want our web content to be fresh out there. 03:33.560 --> 03:36.980 And the less caching, the less subject we are to attack. 03:37.520 --> 03:44.570 And we are going to have a very strong security policy when it comes to end users, and we are going 03:44.570 --> 03:48.740 to train them how to adhere to that policy. 03:49.280 --> 03:54.770 Something else you want to make sure you engage in is really restricting DNS. 03:54.800 --> 03:58.080 We're going to be very careful about gene transfers. 03:58.100 --> 04:05.960 We're going to be very, very strict about the use of internal versus external DNS servers or will engage 04:05.960 --> 04:14.960 in split DNS when it comes to Web servers, FTP servers, any servers, hosting a public information. 04:14.990 --> 04:21.260 We are going to make sure to harden those, as I said earlier, and we are going to ensure metadata 04:21.260 --> 04:25.310 like directory listings and things of that nature are not available. 04:25.760 --> 04:31.160 We're going to set privacy on our who is service, even if that requires paying a little bit extra. 04:31.520 --> 04:35.840 And we're going to avoid domain level cross-linking. 04:36.170 --> 04:47.390 Now, what this is a reference to is the, you know, free access between or even within the same domain 04:47.390 --> 04:48.230 sometimes. 04:48.830 --> 04:55.220 So what you want to think about is some departments are not going to be sharing information with other 04:55.220 --> 05:02.660 departments, just like your organization is not going to be openly sharing information with other organizations. 05:03.020 --> 05:10.220 So we're just going to be very, very, very careful about linking information outside of our domain 05:10.220 --> 05:11.000 of control. 05:11.180 --> 05:15.260 And again, sometimes this can even refer to inside your organization. 05:16.040 --> 05:27.560 We are hardening all of our devices that may be exposed to any external and internal reconnaissance 05:27.560 --> 05:27.950 attack. 05:28.100 --> 05:28.880 So harden. 05:29.030 --> 05:29.510 Harden. 05:29.660 --> 05:30.170 Harden. 05:30.380 --> 05:31.070 Filter. 05:31.070 --> 05:31.790 Filter. 05:31.790 --> 05:32.350 Filter. 05:32.750 --> 05:40.820 If you don't need ICMP echoes and echo responses in a certain area of your network, then they should 05:40.820 --> 05:41.570 be filtered. 05:41.840 --> 05:47.000 If you have no use for traceroute in areas of your network, they should be filtered. 05:47.180 --> 05:56.180 We are only going to be calling upon the mechanisms that we need for management of our systems when 05:56.180 --> 05:58.970 we absolutely have to have those mechanisms. 05:59.240 --> 06:02.180 Many times we'll do it privilege based or role based. 06:02.390 --> 06:08.660 So you can trace root, you can ping, but your end user cannot. 06:09.440 --> 06:16.670 We want to contact the archive.org and we want to just let them know that we want old copies of our 06:16.670 --> 06:17.570 stuff deleted. 06:17.990 --> 06:21.920 We want to engage in the hiding of our IPS whenever possible. 06:21.950 --> 06:25.940 Oftentimes, VPNs are doing this for us in an automated fashion. 06:26.330 --> 06:36.380 We'll use mobile device management systems so that mobile devices are not geotagging when our end users 06:36.380 --> 06:37.610 are taking photographs. 06:37.950 --> 06:44.810 We'll do other things with the mobile device management as well to mobile devices to ensure that they 06:44.810 --> 06:45.740 are secure. 06:46.490 --> 06:52.280 We'll be very careful about where we store certain data. 06:52.580 --> 06:52.940 Right. 06:53.120 --> 06:55.460 All data is not created equal. 06:55.520 --> 07:00.080 Some of it is extremely sensitive and maybe it's not even stored online. 07:00.830 --> 07:05.540 Other stuff can be stored online, but it must get the strongest of encryption. 07:05.690 --> 07:11.170 So yes, there are plenty of countermeasures that you can implement to guard against this. 07:11.180 --> 07:17.720 So common phase of foot printing against your organization or you yourself. 07:18.260 --> 07:26.030 These are just some of the countermeasures and I'm sure you remember that training came up repeatedly 07:26.030 --> 07:28.370 as we went through these countermeasures. 07:28.610 --> 07:37.130 Notice, lots of these are going to require strict policies and training so that your consumers, your 07:37.130 --> 07:43.550 clients, your fellow peers can carry out the security policy you're asking them to. 07:43.790 --> 07:44.750 Thanks so much for watching.