WEBVTT

00:00:00.440 --> 00:00:02.430
Before we get to the Infection Monkey demo,

00:00:02.440 --> 00:00:05.050
I want to take a moment to talk about where it fits in the MITRE

00:00:05.050 --> 00:00:07.250
ATT&CK framework and the Zero Trust model.

00:00:07.970 --> 00:00:12.170
MITRE ATT&CK classifies adversary tactics and techniques into categories

00:00:12.180 --> 00:00:14.510
associated with the different phases of an attack,

00:00:14.800 --> 00:00:19.180
to allow defensive teams to identify and emulate threat actor behavior and

00:00:19.180 --> 00:00:21.850
improve security controls around those vulnerabilities.

00:00:22.240 --> 00:00:25.150
We will cover three tactics: remote discovery,

00:00:25.790 --> 00:00:29.230
exploitation of remote services, and finally,

00:00:29.240 --> 00:00:35.160
remote services sub‑techniques, SMB/Windows Admin Shares and SSH.

00:00:35.300 --> 00:00:38.240
The Infection Monkey can do this by copying itself on remote

00:00:38.240 --> 00:00:41.550
systems from its initial access point host and attempting to

00:00:41.550 --> 00:00:43.050
create and escalate its own user.

00:00:45.340 --> 00:00:50.540
Zero Trust, a term originally coined by John Kindervag, means what it says.

00:00:50.700 --> 00:00:53.350
Don't trust anyone who is accessing your network.

00:00:53.740 --> 00:00:56.900
That means, instead of assuming everything behind the corporate firewall

00:00:56.900 --> 00:01:01.480
is safe, the Zero Trust model assumes breach and verifies each request as

00:01:01.480 --> 00:01:05.170
though it originates from an open network. Regardless of where the

00:01:05.170 --> 00:01:09.770
request originates or what resource it accesses, Zero Trust teaches us to

00:01:09.770 --> 00:01:14.290
never trust, always verify. Users do not have access until they are

00:01:14.290 --> 00:01:15.450
approved to do so.

00:01:15.940 --> 00:01:18.950
The company sets up entitlements that allow them to access what they

00:01:18.950 --> 00:01:21.650
need, and only what they need, for their work role.

00:01:22.110 --> 00:01:24.720
Every access request is fully authenticated,

00:01:24.730 --> 00:01:28.150
authorized, and encrypted before granting access.

00:01:28.540 --> 00:01:31.360
Micro‑segmentation and least privileged access principles

00:01:31.370 --> 00:01:33.250
are applied to minimize lateral movement.

00:01:33.920 --> 00:01:36.590
Bridge intelligence and analytics are utilized to detect

00:01:36.590 --> 00:01:38.850
and respond to anomalies in real‑time.

00:01:39.620 --> 00:01:42.350
Zero Trust is based on three main principles.

00:01:43.140 --> 00:01:44.750
Verify explicitly,

00:01:44.970 --> 00:01:47.330
which means to always authenticate and authorize

00:01:47.330 --> 00:01:51.060
based on all available data points, including user identity,

00:01:51.260 --> 00:01:54.920
location, device health, service or workload,

00:01:55.190 --> 00:01:57.350
data classification, and anomalies.

00:01:58.290 --> 00:01:59.980
Next is use least privilege,

00:01:59.980 --> 00:02:03.840
meaning limit user access with risk‑based adaptive policies

00:02:03.840 --> 00:02:06.580
and data protection to help secure both data and

00:02:06.580 --> 00:02:09.930
productivity. And ultimately, assume breach,

00:02:09.930 --> 00:02:14.120
which minimizes blast radius for breaches and prevents lateral movement by

00:02:14.120 --> 00:02:19.620
segmenting access by network, user, devices, and app awareness. Verify all

00:02:19.620 --> 00:02:23.930
sessions are encrypted end‑to‑end, and use analytics to get visibility and

00:02:23.930 --> 00:02:26.650
drive threat detection to improve defenses.

00:02:27.640 --> 00:02:28.510
In this course,

00:02:28.520 --> 00:02:30.950
we will take a look at two different use cases Monkey

00:02:30.950 --> 00:02:33.050
can test for in a real‑world scenario.

00:02:33.540 --> 00:02:34.150
First,

00:02:34.540 --> 00:02:38.040
if an attacker successfully phished a network, then the endpoint would be

00:02:38.040 --> 00:02:42.340
an initial access site. Then, those authentic user credentials would be

00:02:42.340 --> 00:02:44.790
used to try and press deeper into the network.

00:02:45.130 --> 00:02:45.880
In this case,

00:02:45.880 --> 00:02:49.720
the assumed breach approach is testing identity and access management, as

00:02:49.720 --> 00:02:52.250
well as configuration management on the network shares.

00:02:52.890 --> 00:02:56.370
Second, if you wanted to test micro‑segmentation specifically,

00:02:56.540 --> 00:03:00.890
you would enter the IP address ranges of at least two different subnets,

00:03:00.940 --> 00:03:02.750
which should not be able to communicate.

00:03:03.210 --> 00:03:06.260
The Monkey will start at one and attempt to access the

00:03:06.260 --> 00:03:08.250
other subnets hosting other machines.

00:03:08.840 --> 00:03:09.880
Depending on the results,

00:03:09.890 --> 00:03:13.730
successful connections will be shown on the infection map tab, as well as in

00:03:13.730 --> 00:03:16.320
the logs of the Monkey's attempts to access those machines.

00:03:16.740 --> 00:03:20.310
Those tactics demonstrated as successful can be confirmed in

00:03:20.310 --> 00:03:23.820
another tool or selected specifically to be run again once

00:03:23.820 --> 00:03:27.350
mitigating measures are put in place, to see if that path still

00:03:27.350 --> 00:03:28.930
exists where it should not.