Cloud Connectivity Resources

 

    via https://twitter.com/mindseyeccf

Talk slides here:

Recordings:

Video Coming Soon!

Further Reading:

https://sixthirty-ventures.medium.com/why-we-invested-neosec-1a01d44b12e2

https://www.wsj.com/articles/wells-fargo-embraces-multicloud-with-microsoft-google-deals-11631717100

Tools:

Coming Soon!

Related Talks:

Coming Soon!

For more information or to set up a consultation please reach out via

https://www.1pingsecurity.com

Cloud Pro Dev Resource - leveling-up

Further reading:

DevSecOps - http://iotiran.com/media/k2/attachments/devopssec.pdf

Encapsulation -
https://tools.ietf.org/html/rfc7348
https://en.wikipedia.org/wiki/Virtual_Extensible_LAN

Software Defined Networking (SDN)
https://www.cisco.com/c/en/us/solutions/software-defined-networking/overview.html

Software Defined - Wide Access Networking (SD-WAN)
https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/index.html#~resources

Reviews:

https://cloudsecurityalliance.org/blog/2018/04/24/ccsk-vs-ccsp-unbiased-comparison

https://www.cybersecurity-insiders.com/heres-the-list-of-the-top-cloud-security-certifications-for-it-professionals/

Certification Info:

https://cloudsecurityalliance.org/education/ccsk/

https://www.isc2.org/Certifications/CCSP

"Not Enough Experience? Start on a pathway to certification with the Associate of (ISC)²! You can take a certification exam without the work experience. If you pass, you simply work to get the experience needed for certification." -https://www.isc2.org/Certifications/CCSP/experience-requirements

https://aws.amazon.com/certification/faqs/

https://docs.microsoft.com/en-us/learn/certifications/posts/new-role-based-certification-and-training-is-here

https://www.sans.org/cyber-security-skills-roadmap

Training Resources:

https://app.cybrary.it/browse/refined?resultsView=list&q=cloud

Events:

https://www.sans.org/event/cloud-security-summit-2020

End of a theme: Sky-high IR

They say all good things must come to an end. If my talk Sky-high IR: IR at Cloud Scale has been a good thing (and I think it has for many) the saying applies here too. Triangle InfoSeCon tomorrow will be the last time I will be giving this one, at least for a while.

SANS GC-PT/EH

I am very excited to announce I completed my Graduate Certificate Studies in Penetration Testing and Ethical Hacking (GC-PT/EH) through the SANS Technology Institute (STI) this Month! 

"The SANS Technology Institute's post-baccalaureate certificate program in Penetration Testing & Ethical Hacking is based entirely upon four courses already available as an elective path through its graduate program leading to a Master of Science Degree in Information Security Engineering.

As an independent offering, the graduate certificate in Penetration Testing & Ethical Hacking is a highly technical, 13 credit hour program with a cohesive and progressive set of learning outcomes. These learning outcomes are focused on developing the student's capability to discover, analyze, and understand the implications of information security vulnerabilities in systems/networks/applications in order to identify solutions before others exploit these flaws.

Because the certificate program is based on the courses that may be chosen by a master's candidate during the normal course of studies, all credits earned while completing the Penetration Testing & Ethical Hacking certificate program may be applied directly in fulfillment of the master's degree requirements should the student matriculate in the master's program afterwards."

Continue reading at: 

https://www.sans.edu/academics/certificates/penetration-testing

Cloud IR Resources - Sky-hi IR: IR at cloud scale

Talk slides here:

Recording here: https://www.youtube.com/watch?v=Q8hfcBJVKq8&t=15s

Big "Thanks!" to BsidesRDU.org and Adrian Crenshaw (@irongeek_adc)

Data costs:

https://azure.microsoft.com/en-us/pricing/details/bandwidth/
https://aws.amazon.com/blogs/aws/estimate-your-c/

Tools:

SIFT Workstation
Getting Data from S3 via Python
AWS Montoring and Alerting 3-rd party tools:

• Cloud-Custodian
• Cloud-Inquisitor
• CloudTracker
• Security Money
• StreamAlert
• Wazuh

Related Talks:

Logging, Monitoring, and Alerting in AWS (The TL;DR) - SANS DFIR Summit 2018 - Jonathan Poling (@JPoForenso)

Automating Incident Response and Forensics in AWS - Ben Potter - AWS Security Lead


How-Tos:
How to copy a VMDK to image

SIFT Workstation How-Tos

Whitepapers

Incident Handler's Handbook by Patrick Kral - February 21, 2012

What I Hope to Get out of My Masters Degree in InfoSec Engineering

I have shared with some of you that I am continuing my graduate studies, which I began in the Graduate Certificate Program in Penetration Testing and Ethical Hacking, in the Masters of Science in Information Security Engineering. This is a transition I have been planning for a couple years and I'm excited to get started.

For the time, money, and effort I invest in this degree program I expect to obtain expert deep technical knowledge in information security and critical leadership tools. I will apply these elements as I acquire them, both on the job and within the community. Through this process, I hope to make a positive impact on the security industry through sharing knowledge, experience, and information.

From the government sector to private industry, to managed services my experiences in information security have been broad. Recognition of this has led me to pursue deep technical knowledge of information security topics. I began this journey by pursuing a Graduate Certificate in Penetration Testing and Ethical Hacking (GC-PT/EH) from the SANS Technology Institute and will continue that effort as a student of the Master's of Science in Information Security Engineering (MS-ISE) program. Finally, I am also very excited about preparing for and pursuing GIAC Security Expert (GSE) certification As a result of my desire for continual learning, I want deeper technical knowledge resulting in degree completion and GSE Certification.

I am excited that I will receive leadership development through the MS-ISE program. These skills are critical for influencing decision makers and colleagues in healthy and productive ways. I hope to gain greater planning, writing, and speaking skills. These will allow me to express the need for greater focus and support on security issues by making them continually more relevant to the business.

In conclusion, I expect to gain deep technical knowledge and leadership abilities through this program. I intend to apply these immediately as a practitioner in this industry. Finally, I intend to apply these by giving back to the community through mentoring and instructing.

Lastly, but perhaps most importantly, I want to do these things in order to give back to the community. There has never been a greater need for mentors and skilled instructors in this industry. Budding and neophyte professionals alike need more mature and experienced colleagues to step up and share their knowledge and lessons learned in order to be successful in continuing to shape the understanding of the risks and impacts related to security issues.

How to Get into Infosec: InfoSec Career Path Hacking

Maybe you've always dreamt of getting into the InfoSec field, and have been thinking about getting into information security for a while, or it's just coming to mind now. Regardless of where you are in your journey, welcome to the InfoSec community! In the words of the great Kung Fu Master, Shifu, “There is no level zero.”

If you’ve seen Kung Fu Panda, you may recall that Po is a panda who eats, sleeps, and breathes Kung Fu, yet finds himself outside that community. He dreams of being a warrior. One day, he sees an opportunity to witness a significant moment in Kung Fu history and so he sets out on his journey.  But first, he must climb to the temple. It would have been easy for him to zig-zag his way to the top of the mountain, though it might have taken longer. Instead, he started with the logical place... the stairs - a much shorter path. You too will have to choose your path... read more (external link to guest blog post) 

The Importance of Leadership in InfoSec

       Over the years I have had the privilege of being a member of many organizations that put a great emphasis on leadership. From those experiences, both educational and military, I have grown to appreciate several characteristics of a leader, whom I prefer to define as someone who uses influence to bring people together and contribute to a common goal. I have seen that leaders must be high-integrity, honest, relational, respectful, skilled communicators, and very competent.

Foremost among leadership traits, a leader is high-integrity. Leaders must be honest and do what is right without regard for personal expense, time or effort. They are honest. They must do so in order to garner and preserve the respect and credibility required to lead effectively. They must be accountable to high standards in this area. Flaws in this area quickly lead to a loss of influence for leaders.

Leaders are relational and place a high degree of value on people. They operate from a transformational perspective rather than a transactional one. They communicate and relate to others with respect and don’t lower their own standards for communication when others stoop low. They put others’ needs ahead of their own and treat them with dignity and kindness.

Finally, leaders are highly competent. They know how far their own abilities go and where to draw on the greater abilities of others. No one looks up to or is willing to follow someone who doesn’t know what he or she is doing or talking about. Conversely, someone who has a command of a body of technical knowledge quickly gains credibility as an expert. People come to them for advice, thought leadership, and critical task handling.

In working toward my goal of becoming a better leader through training, I have realized both some strengths and the need for further development of several competencies. I desire to give back to the community and industry at the highest quality level possible and believe an important part of having recognition and a platform to communicate from is using those as opportunities for positive effect. The SANS MS-ISE program will greatly enable and support these efforts, taking me beyond the scope of my current graduate certificate studies in penetration testing and ethical hacking.

I feel I have strong suits in being self-directed, developing teams, building relationships, coaching, and training. I take initiative in my own work efforts, professional development, and personal pursuits by looking for a need and then meeting that need. I also enjoy bringing others together to work on projects in a healthy, relational manner. I enjoy sharing ideas and experiences for the benefit of others. Finally, I seek to help others make sometimes difficult career decisions, identify areas to invest study time, and pass on knowledge through presentations.

       I am investing in developing my verbal communication skills further, including presenting and instructing. I have dabbled in this arena by seizing the opportunity to speak at SANS lightning talks, security bsides conferences, as well as participating in Toastmasters International. I am taking this to the next level and look forward to utilizing the SANS masters program to accomplish this through the coursework and practicums.

I am also developing my skills in setting and communicating vision effectively. I am being called upon more and more frequently to write or present on security topics in a way that decision-makers can easily digest, buy into, and implement. There is a clear gap between the language of these decision makers and that of the industry as a whole. I, as an information security leader, must be prepared to bridge this gap in addition to offering the expected engineering or management skills.

I am investing in greater project planning skills. This is a very important aspect of gaining the confidence of stakeholders toward project pick-off. No smart business owner is going to buy into a poorly planned project. They know all too well the consequences of doing so. I am working toward a greater grasp of project management fundamentals that will enable me to more accurately and efficiently estimate, plan, present, and manage projects in my day-to-day work.

I am also investing in developing skills in leading change. I have seen first-hand some big organizational changes go horribly wrong. I am excited about exploring this area and adding it to my toolkit for future use. By being as well prepared for this need as possible I hope to help bring about organizational change through individual interactions.

Leadership, rather than engineering or management skills, are needed more than ever because of the growing communication gap in the information security industry. As I mentioned earlier, this language gap creates a disconnect between the business and technical efforts. This is particularly important because the information security knowledge domain, like technology as a whole, is broadening and deepening rapidly. So, it’s likely that this communication gap is widening as well. CIOs and CISOs have never been more challenged to impress upon business owners the implications of technological decisions. This communication dynamic will surely shape the future of our world for decades as a result. Therefore, the onus is on us to pursue excellence in this area and to exercise it appropriately.

In summary, I am continuing graduate studies at the SANS Technology Institute as a student in the Masters of Science in Information Security Engineering program in order to further develop as a leader. Leaders are high-integrity, respectful and competent individuals who use their influence to better the world around them. I will use this program to build on my current strengths, strengthen weak areas, as well as discover other areas I was not yet aware of - for the benefit of myself, the community and industry.

Change the Way You Talk Change the Way You Think

Quick, think of a word that describes a combination of letters and numbers that can be used to login to your system...

What came to mind? Was it "password"?

One of the greatest problems in our industry may be the use of the word "password." The origination and proliferation of this word has led us to believe that we must construct this security device using such things as words rather than by some other means. 

If you really think about it the paradigm of a passphrase is better in almost every way. After all, many common passwords can be rapidly and effortlessly cracked with a simple dictionary. If we simply take the first letter of each word of a phrase and modify them slightly we have exponentially increased the difficulty of breaking that passphrase.

Having said this let's talk for a moment about how the words we say and what we do affect our thinking. Aristotle said this, "Excellence is an art won by training and habituation. We do not act rightly because we have virtue or excellence, but we rather have those because we have acted rightly. We are what we repeatedly do. Excellence, then, is not an act but a habit."

Whether you look for positive or negative occurrences of this, you don't have to look too far to see the practical examples of how this manifests itself. Self-realizations, self-fulfilling prophesies, and liars who believe what they have repeated so many times all attest to this. However, we have seen that the fact of the matter is that passphrases are without question more secure. So, why should we not reinforce this truth by using the appropriate term in our speech and login interfaces?

Stay Secure!

Not a conference conference

This week many people are at RSAC for the week gaining knowledge and a ton of vendor swag.

Believe me when I say I am not bitter about not being there. But watching from the sidelines got me thinking...    What if we took all the time and resources we spend on conferences and put them into security improvements? 

What would that look like? Well, surely you've been to working meetings where everyone brings their gear and talents and you collaborate on tasks. Sometimes this doesn't happen until a "crash team" is needed. Other times it more proactive. 

Food for thought.

Hacking the generation Gap - leading millennials in infosec

Millennials are the generation born from 1980 to 2000. Do you work with or lead millennials? The answer is likely yes. This group encompasses all workers between 18 and 37 years old!

Would you approach a problem in your job the same no matter the requirements, challenges or other considerations? Would you try to secure a cloud infrastructure the same way you would an on-premise infrastructure? Would those same controls work? Likewise, would you conduct a pentest the same without considering the environment? Fashion the payload without regard for the antivirus vendor? Deliver the same web app exploit without consideration for the use of a WAF? Attempt to bypass an nextgen firewall just as you would a traditional firewall? Obviously not, so why then are so many people trying approach leading the millennial generation using the same old tactics, techniques and procedures? Despite the stigmas and stereotypes this generation has differences that require a different approach.

I'd like to introduce you to four (4) ways you can (and perhaps must) change in order to effectively lead millennials - ABCs & Ds if you will.

1. Accept their differences
2. Bring the bigger picture into focus
3. Change our mindset
4. Develop their strengths; ignore their weaknesses

To further explain these areas I've recorded a short video. It's a first take but I hope it will help you greatly in your pursuit to lead millennials within your organization!

Why military members past present and future are more well equipped for Cyber Security than almost every other candidate

How many of your candidates have consistently received user awareness training in phishing, information security and operational security annually for the past 3 or more years?

I am guessing not many, which is precisely why military members are among the most well-trained candidates you will see. Military members receive world-class user awareness training that's application focused. Like all military training it is about meeting mission and nothing is more about application than mission!

Hire a vet.

An open letter from a Social Engineer

Hello! My name is social engineer. I like to use any and all information about you to gain access to your money, healthcare records and personal identity. It’s Halloween and it can be a scary time. Sometimes I’m scared by the amount of info people share about themselves and their loved-ones online.

A great way to wrap-up National Cyber Security Awareness Month is to limit the amount of info I have access-to by navigating to this page on facebook and clicking this button called, “Limit Old Posts.” This makes the amount of info available to me much more scarce! You can do this same thing on other social media sites too.

Of course if you need more scaring to be convinced, just sign-in to facebook and head over to http://www.takethislollipop.com for a close-to-home demo of how your own info might be used against you. IF YOU DARE!

Happy Halloween!

Free and reduced IT and Security Training for Vets

I have seen a lot of talk lately about Cyber Security training for Vets. So in observance of this upcoming Veterans Day I am publishing this list of free and reduced resources. Unlike a google search, I am sorting these by my percieved training value from a hiring manager's perspective as a seasoned InfoSec Practitioner.

But first an overview, employers are looking for people to work in InfoSec who have real skills, both hard and soft, many of which are acquired in military service. As always, OJT is what you make of the opportunity so YMMV.

Employers need people who have technical skills but in many cases those who solely have technical skills are less in demand than those who can also translate their technical knowledge into words, concepts and stories that business people can understand. The age-old paradigm of Knowledge, Skills and Abilities (like them or not) are hard at work here.

Much of security work is consulting. Consulting has been defined by some as the art of giving advice to those who haven't asked for it and may not want it, sometimes aggressively or violently so. This begs a focus on soft-skills, which is sure to be assessed as a part of any hiring process for an InfoSec gig. At least for the ones you want to have anyway. So each of us must work to find a balance between soft and hard skills. For these reasons, I am including both here.

Soft-skills Resources by Overall Value

     ISSA International - Dedicated to developing and connecting cybersecurity leaders globally. If you do nothing else join, attend and contribute. My first pure InfoSec role was a result of doing just this.

     ToastMasters International - a world leader in communication and leadership training. Enough said.

    BSides Security Conferences - Yes you can cite conference attendance as legit training on your resume and you should! It shows personal investment, current knowledge and industry involvement. Not to mention you might meet your next employer or recruiter there. Tickets can be had for 10's of dollars!  

     Selling Security to C-Level Executives - Tips on how to cut the hype and speak in terms business decision makers understand and relate to.

     The Challenger Sale Summary by HubSpot - A simple approach to selling just about anything in a way that makes an emotional connection.


Hard-skills Resources by Overall Value

     LinkedIn Premium for Vets - includes access to Lynda.com and ability to email outside of network! A tremendous gift from LinkedIn.

     Cybrary.it - Free IT and security training courses - many of these focus on basics or essentials which will be gauged in the interview process but also working toward certifications.

   Fortinet Veterans Program and launch of the Fortinet Network Security Academy (FNSA), designed to develop and train action-oriented cybersecurity experts to address the global skills shortage.

     DHS’s Federal Virtual Training Environment (Fed VTE) offers free online, on-demand cyber security training to government employees and Veterans. Veterans can sign up for an account through the Hire Our Heroes website and follow instructions through “ID me” to verify veteran status and register for a FedVTE account. - Includes just about every IT or security certification course you can think of! Course Catalog here.

     SANS CyberTalent VetSuccess Immersion Academy - FREE Industry-leading SANS training from world-class instructors in a hands-on immersion format, hyper current content, widely-recognized GIAC certifications, and a direct recruiting pipeline to top employers in cybersecurity.


Specific Conference Info:
FREE for Vets
     2016 Metro-Atlanta ISSA Conference, Building on the Foundations of Effective Security, Wednesday November 16th at the Loudermilk Center. This conference will focus on the basic building blocks of Process and Policy, Data Governance, Access Control, Encryption, Monitoring and Incident Response, and Continuity Planning. Seasoned veterans in the field will give presentations based on their experiences in one of these six areas. To view full conference agenda - http://www.gaissa.org/gaissa_conference_agenda_2016.html Veterans use code VETSISSA2015 at checkout for free admission.

CryptoMalware Resources

Some resources for CryptoMalware Detection, Prevention, and Remediation

Presy Slides (updated periodically): http://www.slideshare.net/AaronLancaster3/why-are-you-still-getting-cryptolocker

ISSA Journal April 2016 Feature Article - CryptoLocker by Carl Saiyed

http://c.ymcdn.com/sites/www.issa.org/resource/resmgr/JournalPDFs/feature0416.pdf

Prevention
J. Wolfgang Goerlich Preparing for malware - https://t.co/yn0CVpMtu6
FREE Training Course: https://info.varonis.com/introduction-to-ransomware

FBI IC3:
Ransomware Tri-fold: https://pdf.ic3.gov/Ransomware_Trifold_e-version.pdf
Sept. 2016 Advisory: https://www.ic3.gov/media/2016/160915.aspx

Microsoft Articles:
https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32/Crowti 
http://blogs.technet.com/b/mmpc/archive/2015/07/14/msrt-july-2015-crowti.aspx 
https://www.microsoft.com/security/portal/mmpc/shared/prevention.aspx

Expert Analysis:

http://krebsonsecurity.com/2013/11/how-to-avoid-cryptolocker-ransomware/
http://krebsonsecurity.com/2016/09/ransomware-getting-more-targeted-expensive/

http://www.cio.com/article/2448967/security0/6-ways-to-defend-against-drive-by-downloads.html

CryptoLocker Prevention Kit: http://www.thirdtier.net/2013/10/cryptolocker-prevention-kit-updates/
CryptoPrevent (workstations only): https://www.foolishit.com/cryptoprevent-malware-prevention/

BLADE (Block All Drive-by Download Exploits): www.blade-defender.org

Detection

Traffic Analysis:

https://isc.sans.edu/forums/diary/Traffic+Patterns+For+CryptoWall+30/19203/

Expert Analysis:

http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information

http://blogs.technet.com/b/mmpc/archive/2015/01/13/crowti-update-cryptowall-3-0.aspx

Microsoft Server Techniques:

https://gallery.technet.microsoft.com/scriptcenter/Cryptowall-active-file-ad91b701

http://technet.microsoft.com/en-us/library/cc732074.aspx

Remediation

https://www.nomoreransom.org/

•Utilities and regain access to your files:

–RakhniDecryptor - http://support.kaspersky.com/viruses/disinfection/10556

–XoristDecryptor - http://support.kaspersky.com/viruses/disinfection/2911

–RectorDecryptor - http://support.kaspersky.com/viruses/disinfection/4264

•Attempt to retrieve your keys from:

–FireEye’s website http://www.decryptcryptolocker.com/

–Kaspersky’s Website: https://noransom.kaspersky.com/

-Cybrary.it article: https://www.cybrary.it/0p3n/ransomware-decryption-keys-released/

Other References

•IOCs https://github.com/CyberThreatAlliance/cryptowall_v3

•CoinVault and Bitcryptor keys & app: https://noransom.kaspersky.com/

•CryptoWall Dashboard: http://cyberthreatalliance.org/cryptowall-dashboard.html

•Scripts and Files related to the CyyptoWall v.3 threat: https://github.com/CyberThreatAlliance/cryptowall_v3

•CryptoLocker Scan Tool by Omnispear: http://omnispear.com/cryptolocker-scan-tool/

•Using PowerShell to Combat CryptoLocker: http://blog.varonis.com/using-powershell-combat-cryptolocker/

Baking in security

There's a long-standing synicism around development not taking security into account and security picking up the pieces. In fact it's lead to memes like this:

Author Unknown

For many this cynicism may be hard to take seriously but in light of recent research below it takes on a different real-world perspective. Security is serious business and has serious real-world implications in safety, identity, finance and other areas. It pays to think through what and how you are doing day-to-day life and business. Invest early and enjoy the rewards of that investment for a long time to come!

FBI Asking for Ransomware Reports

In an FBI Public Service Announcement published today the Bureau is requesting that vicitims of ransomware report what hit them, the rootcause and even what they paid out in ransom.

NOTE: Please be advised that the FBI is not duty bound to protect your information and you should consider the effects to your company should the FBI choose to make that info public.

From the FBI PSA:

What to Report to Law Enforcement

The FBI is requesting victims reach out to their local FBI office and/or file a complaint with the Internet Crime Complaint Center, at www.IC3.gov, with the following ransomware infection details (as applicable):

1. Date of Infection
2. Ransomware Variant (identified on the ransom page or by the encrypted file extension)
3. Victim Company Information (industry type, business size, etc.)
4. How the Infection Occurred (link in e-mail, browsing the Internet, etc.)
5. Requested Ransom Amount
6. Actor’s Bitcoin Wallet Address (may be listed on the ransom page)
7. Ransom Amount Paid (if any)
8. Overall Losses Associated with a Ransomware Infection (including the ransom amount)
9. Victim Impact Statement

This is a lot of data considering the massive amount of data already available from the Cyber Threat Alliance's study and subsequent analysis report of CryptoWall v3 less than a year ago and their live dashboard.

Cyber Panel at Nashville Business Journal

A while back I participated in a Cyber panel with the Nashville Business Journal.

Read the article here.

July Threat Highlights

July was an interesting month from a threat landscape perspective.

We saw android security bulletins for RCE bugs as well as high-severity flaws, and the Jigsaw ransomware decrypted yet again. Perhaps the most dis-concerting is the newly reported use of Conficker in attacks against IoT devices.

InfoSec to Remote or Not? That is the question.

Lately, I've been hearing of more and more companies "reigning-in" their Cyber Security professionals. At first impression this may seem like a no-brainer. But may be more backlash against the casual and laze faire behavior of a small group of abusive remote workers than anything. This begs several questions:

1. Is it more efficient?

2. Are workers (especially of certain generations) more satisfied?

3. Does it provide companies access to better talent?

4. Do on-prem workers have the same access as remote SysAdmins in this de-perimeterized enterprise landscape?

5. Do today's modern collaboration tools enable all job functions of on-prem workers?

"Clients in this area don't grok telework.  They think it's evil." - Mark McCulough