Improving Cyber Resiliency using Intelligence-led Attack Simulations - - PowerPoint PPT Presentation

▶
improving cyber resiliency using intelligence led attack
SMART_READER_LITE
LIVE PREVIEW

Improving Cyber Resiliency using Intelligence-led Attack Simulations - - PowerPoint PPT Presentation

Dec 23, 2023 14 likes •346 views

Improving Cyber Resiliency using Intelligence-led Attack Simulations Vincent Yiu Who am I? @vysecurity Vincent Yiu vincent.yiu@syonsecurity.com Founder of SYON Security Offensive Operations including Adversary Simulaton and Penetration

slide-1
SLIDE 1

Improving Cyber Resiliency using Intelligence-led Attack Simulations

Vincent Yiu

slide-2
SLIDE 2

Who am I?

Vincent Yiu Founder of SYON Security Offensive Operations including Adversary Simulaton and Penetration Testing Certifications: CREST certified, OSCP, OSCE Speaker at: SSC Xi’an 2018, HITB Singapore 2017 and 2018, JD Security Conference Beijing 2017, Steelcon UK 2017, Bsides Manchester UK 2017, Snoopcon 2017 and 2018. @vysecurity vincent.yiu@syonsecurity.com

slide-3
SLIDE 3

Experiences

  • Global banks
  • Local banks
  • Wealth management
  • Global insurance
  • Smart grid
  • Retail
  • Manufacturing / R&D organizations
  • Satellite
  • HR companies
  • Financial technology providers
  • ISP / Registrars
  • Telecoms
  • Energy
  • Biomedical
  • Health
  • More…
slide-4
SLIDE 4

Financial Technology?

  • Asset Management
  • Automated Teller Machine (ATM) Operators
  • ATM and self-service terminal manufacturing
  • Banks and Credit Unions
  • Credit Report Services
  • Electronic Payment Systems
  • Financial Planners and Investment Advisers
  • Financial Transaction Processing
  • Institutional Securities Brokerages
  • Investment Firms
  • Mortgage Breaks
  • Property/Casualty Insurance Carriers
  • Venture Capital
  • CRYPTOCURRENCY EXCHANGE

https://www.fireeye.com/content/dam/fireeye-www/solutions/pdfs/ib-finance.pdf

slide-5
SLIDE 5

But it all boils down to…

  • The target objective
  • The attacker’s motivation
  • The crown jewels

Hacking a target is not the end goal, acquisition

  • f the objective is the mission.
slide-6
SLIDE 6

Agenda

  • Financial industry threats
  • What is intelligence?
  • Current state of Security Testing across the world
  • What is Cyber Attack Simulation Testing?
  • Attack lifecycle – Modelling real attacker techniques
slide-7
SLIDE 7

Goals: Basic to Basics

Confidentiality Integrity Availability

Data, Information

  • Benefit Records
  • Business and Strategic Plans and Goals
  • Finance Documents
  • Invoices
  • Organizational Charts
  • Pricing Data
  • Recurring Reports
  • Customer Data
  • Payment Card Data

Manipulation

  • Change Customer Account Data
  • Change Amount of Money
  • Change Software
  • Change Website

Access

  • Move Money
  • Withdraw Cash
  • Denial of Service
slide-8
SLIDE 8

Intelligence

  • Who’s hacking who?
  • What are criminals after?
  • Is your company affected?
  • When are they going to hack you?
  • Have they already hacked you but you don’t know?
  • Current scam campaigns going on

Intelligence Report Your Company 1 2 ??? 3

slide-9
SLIDE 9

Intelligence Report: What’s in it?

  • Open Source Intelligence information on your company
  • Enumerated digital asset IP ranges / domains
  • Shodan passive enumeration of digital assets
  • Potential vulnerabilities
  • Competent intelligence providers will have 20+ years historical database of data
  • Provide insight as to what CRIME groups are targeting YOUR industry
  • What CRIME groups are targeting YOUR organization
  • What accounts and data are being sold?
  • What are the capability levels of these CRIME groups?
  • What malware deployments? What tactics, techniques, and procedures do they use?
slide-10
SLIDE 10

Open Source Intelligence

  • Company Name
  • Company Branches
  • Legal entities
  • Revenue
  • Executives
  • Organizational Chart
  • Office locations
  • Email addresses
  • Phone numbers
  • Passwords appeared in previous breaches
  • Digital assets
  • Potential vulnerabilities
slide-11
SLIDE 11

Adversary Information

  • Name of groups and individuals who may be targeting your industry
  • Groups who may be targeting your particular organization
  • Mentions of your organization on the Dark Net / Underground communities
  • TOR network
  • Exploit.in LEVEL X account
  • Public APT and private APT reports
  • Malware samples
  • Indicators of compromise
  • Motivations
  • Origin country
  • Emails
  • Domains
  • IP addresses
  • Accounts for your service being sold
  • Access to your organization being sold (insider threat / previously hacked access)
slide-12
SLIDE 12

Improving Cyber Resiliency using Intelligence-led Attack Simulations

What threats are we facing?

  • SWIFT – Financial motivation
  • ATM Jackpotting – Financial motivation
  • Cryptocurrency Exchange Transfers – Financial motivation
slide-13
SLIDE 13

Improving Cyber Resiliency using Intelligence-led Attack Simulations

Who are the threat actors?

  • Many Advanced Persistent Threat Groups
  • Cabarnak – ATM / Point of Sale Devices
  • Lazarus – SWIFT
slide-14
SLIDE 14

Improving Cyber Resiliency using Intelligence-led Attack Simulations

What are we doing about it?

  • Prepare
  • Assess
  • Understand your company’s defensive capabilities

After breach:

  • Investigations
  • Security hardening
slide-15
SLIDE 15

Case Study

  • Bank X

2014

Simulated Attack $200K

2016

Bangladesh Hacked

  • via. SWIFT

$81 Million

2018

On-going Simulations $200K Prepared for the

FUTURE

slide-16
SLIDE 16

Case Study

  • Financial Technology company Y
  • Global Reach
  • Deploys Infrastructure for many banks
  • “Can an attacker break into our network, and
  • btain access to our customer’s networks?”
slide-17
SLIDE 17

Current State of Security Assessments

Is the Door Locked? Is there a Safe?

COMPLIANCE

slide-18
SLIDE 18

Current State of Security Assessments

Can I get past the door? Can we break into the safe?

PENETRATION TESTING

Project 1 Project 2

slide-19
SLIDE 19

Current State of Security Assessments

UNLOCKED BALCONY DOOR OPEN THE SAFE

ATTACK SIMULATION

ONE PROJECT FIND SAFE COMBINATION IN ROOM SURVEILANCE TO FIND TIME WHEN NO ONES HOME JUMP DOWN FROM FLOOR ABOVE

slide-20
SLIDE 20

Where are we?

  • United Kingdom / USA:
  • Red Teaming / Attack Simulation
  • Penetration Testing
  • Asia:
  • Risk Assessment
  • Buy Security Products
  • Penetration Testing
slide-21
SLIDE 21

Attack Simulation Regulations

  • United Kingdom: CBEST (Financial), TBEST (Telecom),

NBEST (Energy), ATTEST (Aviation)

  • Europe: TIBER-EU
  • Hong Kong: iCAST
  • Singapore: Pending Singapore Montary Authority
slide-22
SLIDE 22

Capabilities

Cyber Capability Spectrum LOW HIGH CREST Certified CREST Basic CREST Simulated Attack Specialist Experienced Consultant Dealing with Critical Infrastructure

slide-23
SLIDE 23

You’ve got an upcoming match against Mike Tyson

slide-24
SLIDE 24

Risk Assessment / Compliance Watch a video, then say “He might take a right punch” Are you ready for the fight with no training?

slide-25
SLIDE 25

Penetration Testing Practicing against a punching bag

slide-26
SLIDE 26

Attack Simulation Train against someone who can mimic Mike Tyon

slide-27
SLIDE 27

Cyber Attack Lifecycle: Microsoft’s Version

slide-28
SLIDE 28

Brief walkthrough of an attack on ACME corporation

  • Financial Technology Provider
  • Global presence
  • Operations in UK, Germany, Singapore, and Philippines
  • Goal: Obtain access to customer data
  • Goal: Obtain access to customer environment
  • Goal: Obtain credentials for a customer environment

How might you go about this sort of an attack?

slide-29
SLIDE 29

Step 1: Reconaissance

  • Map out digital assets
  • Scanning, visualising, understanding the surface
  • Digital footprint / Social media footprint
  • Code leaks, breach dumps
  • Map out physical assets
  • Potential last resort if attack over internet proves infeasible
  • Map out human resources
  • Scraping, searching the internet
  • LinkedIn, 脉脉
slide-30
SLIDE 30

Step 2: Phishing

  • Review target’s email security configuration
  • Set up a phishing campaign
  • Target gets phished
  • Foothold on internal network
slide-31
SLIDE 31

Step 3: Actions on Objectives

  • Skip Privilege Escalation, phished target is a Philippines operations manager
  • Login to internal password management server
  • Dump all credentials for all APAC customers
  • Surveillance of the target over multiple days
  • Target logs into customer Citrix server via. secured virtual machine
slide-32
SLIDE 32

Step 3: Actions on Objectives

  • Connect to virtual machine
  • Lookup customer credentials
  • Login
  • Access to customer environment granted
slide-33
SLIDE 33

THANKS!

Any questions?

@vysecurity vincent.yiu@syonsecurity.com www.vincentyiu.co.uk