Frameworks serve as a structured approach, employed by security analysts to dissect and comprehend
the tactics, techniques, and procedures employed by cyber attackers.
These frameworks aid us in recognizing, prioritizing, and mitigating potential security threats.
Targeting organizations information security systems.
The first one I want to discuss today is called miter.
Miter is an attack framework designed against adversary tactics, techniques and procedures, or Ttps.
It goes through matrices, which is a broad spectrum of tactics techniques.
They may use the different tactics or high level objectives pursued by the attackers.
The techniques, which are specific methods or procedures employed.
Data sources the types of information utilized to detect or prevent such attacks, things like logs
or network traffic, the different mitigations or defensive measures that organizations such as ours
can adopt to thwart or mitigate and minimize the impact of such an attack threat actor groups, which
employ specific tactics and techniques, each assigned a unique identifier, for instance APT 67, maybe
in a specific threat group that we're looking at the software or malware tools utilized by an attacker,
these are mapped with the techniques they may execute, the different campaigns or instances of attacks
executed by threat actors.
These are mapped to the text that said techniques they've already used, and finally resources.
Additional information aligning with the understanding and defending against those specific threats,
the organizations, or the tactics and techniques we may have seen.
These could utilize research papers, blog posts, even the dark web within the enterprise attack methodology.
This concentrates on the adversary techniques and behaviors that we have seen in the past, or may see
in the future the initial access methodology they may use.
This is employed to establish a foothold within our targeted network or within the network we're trying
to defend.
These can be such things as a phishing attack or exploiting a vulnerability.
The execution they may have utilized.
Did they pull off a specific phishing email with a specific link, or did they take advantage of a specific
vulnerability using a specific malware?
This is the execution persistence.
Once they got into our network, did they open additional doors?
Maybe provide a back door into a new aspect to our network that provides persistence access?
This could also be rootkits or scheduled tasks that they may be utilized inside of our system.
Privilege escalation these actions are aimed at attaining elevated access.
I think I've used the janitor scenario before where a janitor may have access to email, but not access
to servers, and so you could do privilege escalation or lateral escalation, going either across up
to get access to a specific system or subsystem that the attacker is trying to get access to.
Defense evasion.
This is the strategies we employ to circumvent detection and bypass security controls such as encryption
or obfuscation.
Credentialed access can we grab credentials from a specific user.
Can we harvest credentials off a database?
Or can we brute force our way into getting more access?
Discovery.
These are the techniques of gathering intelligence about the target system or network.
These can include network scanning or active directory enumeration.
Lateral movement which I've kind of already covered.
But this is traversing laterally from one position over to another.
Once we've gained access, we can also do such things as pass the hash or remote desktop exploitation
collection.
This is the action of harvesting data or information from a compromised system, such as keylogging
or taking screenshots.
Exfiltration.
How do we get that data out?
Or how did they get that data out from a compromised network, such as leverage a command and control
server or external storage device, and then command and control itself?
The techniques for communicating with those compromised systems involving a command and control infrastructure,
and how that's utilized across the system.
Iman methodology.
We're really talking about four specific points.
Adversaries.
Who is attacking us?
Where are they attacking from?
The infrastructure that we're utilizing or the infrastructure that they have taken advantage of.
And in our system, in our network, what capabilities they have?
Do they have the capability of just using malware, or do they have the capability of doing some pretty
advanced social engineering attacks?
And finally, their targets, who is their target?
Are we talking about specific people systems of vulnerability?
What specifically are they addressing when it comes to this target?
The cyber kill chain recognizes seven distinct steps that threat adversaries may utilize against an
enterprise environment.
The first step is reconnaissance.
How do I develop a reconnaissance, either via passive or active measures, to identify different traits,
assets, or infrastructure that your organization may utilize?
The recon stage really kind of pinpoints not just the assets that you may utilize, but the vulnerabilities
as well.
Weaponization.
What kind of delivery system am I going to utilize?
What kind of malware am I going to utilize?
What kind of attack am I going to develop to target your specific systems.
This could be anything from a social engineering attack like a spear phishing email or a phishing email,
maybe even phishing all the way down to malware use through a rootkit or a trojan.
We're really kind of developing that weapon against the infrastructure.
Then there's delivery.
How do I get that system into your environment?
Am I taking advantage of a vulnerability?
What's the delivery methodology?
Now, this isn't exploitation.
We're not actually executing the malware on your system, but we're delivering it to your system.
This could be taking advantage of a vulnerability without actually exploiting it.
This could be sending off a phishing email with a link in it.
That's the delivery phase.
Exploitation is the actual exploitation of the system.
If I'm exploiting a vulnerability, then I'm taking that piece of malware, I'm delivering it to the
system, and then I'm actually executing it.
That's the exploitation phase.
Installation of new malware into the system for persistence or for privilege escalation, and then finally
command and control.
How do I circumvent your systems and provide a command and control structure, where I can maintain
access to your enterprise environment, and further gain more control mechanisms over to the different
systems?
The OSS team or open source security testing methodology model is a widely applied in various practical
scenarios and utilizes penetration testing, which serves as a comprehensive guide for simulating attacks
on systems, networks, people or assets to come.
Cover vulnerabilities.
Most companies or enterprise environments will use a third party environment or a third party vendor
to pull off penetration penetration testing, and that penetration testing utilizes a scope of work
that clearly identifies what they're testing for.
We can utilize security auditing, which leverages the auditing process to evaluate our system and infrastructure
security.
It also facilitates the identification of vulnerabilities and the assessment of security controls and
how they are effective within our system, we can do.
Compliance and certification or recertification.
This is recognized by the.
ISO 2701, which identifies specific methodologies that we utilize to.
Ensure that we're complying with regulatory bodies or contractual agreements for certification.
And finally, security training, where we're training security professionals and the employees that
are within our enterprise environment in a structured manner.
This aids in the development and enhancement of their skill set, their awareness, and their expertise
in security testing methodologies.
The OWASp Web Security Testing Framework is designed specifically for web applications and web developers.
It's designed to go through six distinct phases to identify different security vulnerabilities within
web applications.
The first phase planning and preparation.
This initial phase involves defining objectives for the security test and determining the scope of the
assessment that we're going to utilize against our web application Web information gathering or information
gathering is phase two, and this phase the tester gathers relevant information about the target web
application.
This includes architecture functionality, maybe potential attack vectors.
In phase three, we're doing a vulnerability identification.
We systematically assess the web application for security vulnerabilities such as injection, cross-site
scripting, SQL, or session management flaws.
Step four exploitation.
Once we've identified a vulnerability, we're going to attempt to exploit that and assess the severity
of the potential impact of that application.
Poised to exploitation the fifth phase, uh, testers are going to evaluate the level of access gained
and potential consequences that could be attributed to that exploitation against that web application.
And the sixth phase reporting.
We're going to document and report out those test results.
We're going to present to our stakeholders.
A comprehensive report.
And that report should include the vulnerabilities discovered, the severity rating and actual recommendations
for remediation of our web application.