WEBVTT

00:00:00.240 --> 00:00:03.040
Congratulations for reaching the end of this course.

00:00:03.260 --> 00:00:05.630
If there is one thing to take away from this course,

00:00:05.640 --> 00:00:10.060
it is that all security solutions can be bypassed by an attacker with time,

00:00:10.070 --> 00:00:13.230
money or skills at his or her disposal.

00:00:13.380 --> 00:00:16.160
As an attacker, you probably already know this.

00:00:16.440 --> 00:00:19.650
As someone working on the defensive side of information security,

00:00:19.800 --> 00:00:22.120
this should reinforce your belief that you must

00:00:22.120 --> 00:00:24.560
implement a layered approach to security.

00:00:24.740 --> 00:00:28.060
Although we did bypass the antivirus and the perimeter,

00:00:28.070 --> 00:00:32.700
it doesn't mean that we cannot get caught when operating in secure environments.

00:00:33.040 --> 00:00:37.760
Most security‑conscious organizations may have a SIM, also known as a

00:00:37.760 --> 00:00:42.440
security information management system operated by a team of skilled

00:00:42.440 --> 00:00:46.890
security analysts and engineers leveraging well‑known frameworks such as

00:00:46.890 --> 00:00:51.340
they MITRE ATT&CK framework. Antivirus solutions simply cannot afford to

00:00:51.340 --> 00:00:55.290
have many false positives, because it would prevent end users from being

00:00:55.290 --> 00:00:56.160
productive.

00:00:56.170 --> 00:01:01.540
A team of analysts operating a SIM can handle false positives to some extent

00:01:01.680 --> 00:01:06.970
and react if an alert is deemed to be malicious. On top of that, using a SIM

00:01:06.970 --> 00:01:11.610
can help correlate various events or alerts triggered by various systems,

00:01:11.620 --> 00:01:14.080
which can uncover malicious activity.

00:01:14.220 --> 00:01:15.100
Additionally,

00:01:15.110 --> 00:01:19.230
attacks can be thwarted by hardening endpoints, such as making use

00:01:19.240 --> 00:01:23.160
of application whitelisting and limiting opportunities to execute

00:01:23.160 --> 00:01:25.830
arbitrary code using scripting languages,

00:01:25.840 --> 00:01:29.530
among other things. As an attacker, understanding how endpoints

00:01:29.530 --> 00:01:33.010
can be hardened and how these mechanisms can be bypassed will

00:01:33.010 --> 00:01:35.420
also be required in some circumstances.