OPSEC Obsessed Making good OPSEC decisions @JakeKamieniak { - - PowerPoint PPT Presentation
OPSEC Obsessed Making good OPSEC decisions @JakeKamieniak { description : Cybersecurity Researcher jack of all Trades , curent_role : { job: Red Team , company: GE } prior_experience : [
Making good OPSEC decisions
{ ‘description’: ‘Cybersecurity Researcher jack of all Trades’, ‘curent_role’: { ‘job’: ‘Red Team’, ‘company’: ‘GE’ } ‘prior_experience’: [ ‘pentester’, ‘OT & ICS Vuln Research’, ‘Vuln Management Manager’, ] }
~ the Army ~~specifically ar530-1
In concise terms, the OPSEC process identifies the critical information of military plans, operations, and supporting activities and the indicators that can reveal it, and then develops measures to eliminate, reduce, or conceal those indicators. It also determines when that information may cease to be critical in the lifespan of an organization’s specific operation. Critical information is information that is vital to a mission that if an adversary obtains it, correctly analyzes it, and acts upon it; the compromise
More excerpts from ar530-1
More OPSEC Less OPSEC
Pros
Cons
Pros
Cons
Cost vs Value
Red Team vs Scans Objective of the test
Risk vs Reward
It is a Vulnerability! Ask: criticality of the vuln and asset? Test beyond the vuln
Consequences
Issue gets fixed Hard to test beyond Other occurrences? Detections?
Cost vs Value
Value to Detections? R&D is Time is $$$
Risk vs Reward
Bad guys could be using same TTPs RT needs capabilities to assess impact
Consequences
TTP is burned Detection for TTP General Detection? RT R&D time needed
Cost vs Value
R&D is Time is $$$ Exploitation is hard Value of blocking?
Risk vs Reward
Company vulnerable to method Testing C2, Exfil Testing detection & response
Consequences
Access is burned Response behavior may change RT R&D time needed
AND
Note: There are my words, not our team directors, nor a published / official strategy.
“the compromise of this information could prevent or seriously degrade mission success.”
Critical Information Risks Controls TTPs 1. Delay of testing if blocked 2. Distraction from Technique and Tactic level 1. Generally not disclosed to Blue 2. Get mngr approval to share Red Team Report 1. Valuable to Insider Threats 2. Reputational Dmg to customer 1. Only share through proper channels 2. Use encrypted email to discuss details etc etc etc
OPSEC Guidelines Example: 1. Red Team will not share the engagement objective with Blue Team until the engagement is completed. 2. Specific command syntax will generally not be shared to the Blue Team. 3. Red and Blue teams will perform a Hotwash before a Final Report is issued. During this meeting, Blue Team will identify what activity they believed was Red Team. Red Team will share the objective, and the Techniques and Tactics, but not the targets, or specific command syntax. 4. After an engagement is completed, and after the Hotwash, Technical details including targets, and domains used will be shared with Defenders. 5. Please don’t ask red team members “Is this Red Team,” instead, follow an established Attribution process. 6. If either Red Team or Blue Team is unsure about what to share, ask your manager first. Its not rude to say “I think I can/can’t get you that information, but I have to ask”.
Pictures:
Screenshots and Tweets:
Documents: