Building a Cyber Fortress About the Author Most of my adult life is one way or another related with information security and this book is the result of my passion for this field. I dedicate it to all who see infosec as something more than just a job – especially those who see it as their calling and mission to protect information in all its forms and to master the art of defending against the ever changing threat environment. I have no degree to show off. Twitter: @xorred LinkedIn: https://linkedin.com/in/asverdlov Preface Cyber-crime changed the way businesses operate. A single breach can render a business bankrupt in a minute, millions of users can lose trust in your business in the least – and their money and identities – in the worst case scenario. The prospect of all of them filing lawsuits for their losses against your company is and should be – scary. CISOs are under constant pressure of maintaining secure business operations while at the same time being bombarded by sales pitches of ‘solutions’ to their problems. This book is going to equip you with the right knowledge and tools to build a real-life cyber fortress – one which will be incredibly difficult to penetrate and exploit. In order to make the most of its contents it is best to read it once and then apply the appropriate changes to your environment one by one, based on priority, risk and criticality – this way it might take you a year (or more) to go through the book, but it will result in measurable positive changes to the security posture of your organization. I am confident that if any entity chooses to apply most of the advice written here it will have a justifiable peace of mind when it comes to sustaining a longterm defense. The traditional ways of dealing with cyber threats – buying more security appliances and products – are not proving effective as cyber-crime seems to remain completely undeterred by them. This book takes a different approach. Even though there are products and solutions which will do a very good job if configured and maintained properly, the most effective measures to be taken are within the organization itself and within the configuration of all devices and systems a business operates with. This book aims to teach you real cyber warfare defense skills. It is tailored specifically towards defense and nothing else – not a word was written on attacking others or retaliating. Do your best in defending your own castle and your own people as one day they will need your expertise and you better have it. Some chapters will be short – some, even one page or less. In such cases usually I’ve included several links of directions to go to – I promise, as soon as you read the suggested materials you will see why the chapter was short – it is simply illogical to cover a complex topic in a single chapter, when a book has perfectly explain the topic and a link to that book is given. If you read the book as a book and don’t follow the links reading them – you will miss 90% of what it is about, guaranteed. Page 1 of 112 Disclaimer: All opinions in this book are strictly personal, derived from experience. Any advice you find in this book is to be taken into consideration only after careful testing and evaluation – after all, it is your network you are trying to secure – I am just trying to help and give you the right tools. What you do with these tools is your responsibility – even the decision which tool is the right one. Any products or solutions mentioned, recommended or dismissed in this book have been selected based on my personal preference and them being in this book only means their presence – your responsibility is to devise your own opinion based on your own testing and comparison. This book is technical. It will benefit non-technical users, but they will not be able to use or implement the advice given inside – and thus are recommended to provide the book to the heads of IT and IT Security. English: it is obviously not my native language and I beg your forgiveness for any spelling / other mistakes. URLs: It will be impractical to click on links on a Kindle, so I have created a PDF version of this book, which you can read and use on your computer, for free. You can download it from here: http://goo.gl/1pYBFJ Finally, this version of the book is distributed completely free of charge in HTML/PDF format. My aim with publishing it in this way is to help as many people as possible get their defenses into shape. If you like the book, you may as well get a copy on Amazon: Trademark Information This book has not been authorized, sponsored, or otherwise approved by Google Inc. or any other company or brand mentioned in it. All product names are registered trademarks or trademarks of their respective companies Copyright: Alexander Sverdlov No part of this publication can be reused commercially without an explicit permission from the author. Any use of material from this book should mention the author. If you liked the book, you can get in on your Kindle here: http://www.amazon.com/dp/B00YBX4Y9K Page 2 of 112 Table of Contents The Cyber Fortress, Redefined ................................................................................................................ 6 Prepare for WAR and the new realities................................................................................................. 11 Intelligence operations against technologies we use every day ........................................................... 14 APT or APA and can APDs counter their attacks? ................................................................................. 17 Becoming a knight: learn! ..................................................................................................................... 19 Recommended books to build a solid foundation ............................................................................ 19 Philosophy / Military Art ............................................................................................................... 19 Cyber Security History ................................................................................................................... 20 Novels ............................................................................................................................................ 20 Technical books ............................................................................................................................. 21 Standards and Best Practices ........................................................................................................ 21 Survey the security posture of your company ...................................................................................... 24 Know your enemy ............................................................................................................................. 29 External Network Monitoring Services ......................................................................................... 31 Getting to know the Cyber Underground ..................................................................................... 32 Building your own intelligence of the attackers going after your organization ............................ 36 Your role as the guardian and infosec mentor in your organization .................................................... 37 Communicating with senior executives ............................................................................................ 37 Communicating with IT ..................................................................................................................... 38 Communicating with everybody else ................................................................................................ 38 Building a squad of brave defenders ..................................................................................................... 39 Information Security Awareness ........................................................................................................... 43 On Enterprise Password / Credential management.......................................................................... 45 Building a secure operating environment ............................................................................................. 47 Removing perimeter security is safe for a cyber fortress ..................................................................... 48 Defending against web-based attacks .................................................................................................. 49 Choosing and properly configuring a Web Proxy / Web Filter.......................................................... 50 Evaluating a web filter before purchasing the product / service .................................................. 50 Protecting the endpoint from web-based attacks ............................................................................ 52 Block exploits and malware by blocking ad networks and ads ..................................................... 52 Deploying a secure browser in the enterprise .............................................................................. 54 Hardening Flash: mission (im)possible .......................................................................................... 56 Sandboxed Browsers / Alternatives for the enterprise ................................................................. 57 Selecting operating systems according to your business needs ....................................................... 58 How to properly harden your operating systems ............................................................................. 61 Page 3 of 112 SRGs and STIGs .............................................................................................................................. 61 Application Whitelisting - SRP and AppLocker .............................................................................. 66 2-factor authentication for servers ............................................................................................... 72 Maintaining the operating systems................................................................................................... 73 Raise the cost of malicious code execution in your environment .................................................... 74 Preventing Exploit Execution ......................................................................................................... 74 Other server / workstation hardening ideas ................................................................................. 78 Choosing secure networking components ............................................................................................ 80 DNS .................................................................................................................................................... 80 Routing .............................................................................................................................................. 81 Firewall alternatives .......................................................................................................................... 82 Port Knocking – NSA is using this for the past 10 years, are you? ................................................ 82 Network Segregation / Isolation ....................................................................................................... 83 Host-based Network Whitelisting ................................................................................................. 84 DoS / DDoS protection ...................................................................................................................... 85 Advice for Security Services/Products Vendor Selection ...................................................................... 86 Security Monitoring and Logging .......................................................................................................... 88 Using open source tools for centralized logging management ......................................................... 89 Logstash, ElasticSearch and Kibana ............................................................................................... 90 GrayLog2........................................................................................................................................ 90 Security Onion ............................................................................................................................... 90 Feeding your SIEM with external threat intelligence data ................................................................ 91 Control the Insider Threat ..................................................................................................................... 94 Cyber Incident Response ....................................................................................................................... 96 Smoke and Mirrors ................................................................................................................................ 98 Mobile Device Security ........................................................................................................................ 100 Creating a personal cyber fortress ...................................................................................................... 101 Various tools ........................................................................................................................................ 111 References: .......................................................................................................................................... 112 Page 4 of 112 “Being unconquerable lies with yourself; being conquerable lies with the enemy. Thus one who excels in warfare is able to make himself unconquerable, but cannot necessarily cause the enemy to be conquerable.” – Sun Tzu Page 5 of 112 The Cyber Fortress, Redefined To build a cyber fortress one must know what it is and how it is different from the conventional view of a fortress. In our mind a fortress is the fortification surrounding a town or a castle – or the fortified building itself. It has walls and towers allowing for passive and active defense. Image credit: Wikipedia (http://en.wikipedia.org/wiki/Fortification) A really good illustration is the image above. In traditional warfare it would be very difficult to get to its core without destroying a large portion of its defenses. The nature of such a fortification allows for concentration of resources from unaffected parts of it in case of a breach, giving the upper hand to its defenders. If the wall is breached its defenders can oppose incoming attackers from a small opening in the wall, where the attackers must push significant amount of firepower and human force through that small opening in order to overcome all the defenders concentrated to defend that small area. A ratio of 1 defender to 3 attackers is commonly accepted as enough to protect the fortress in such cases. The wall in this sense is a passive but effective protection mechanism. While I value and respect the “defense in depth” concept, if viewed from a single perspective it might be viewed wrong. There are multiple perspectives and multiple points of view – in reality no 2dimensional map of the Universe is right, as the Universe has many dimensions. The same applies to the security of an organization – defense in depth depicts a 2-dimensional view where attacks come ‘from the outside’ and must penetrate multiple layers of defense to get to the data or device, depending on the diagram you’re looking at. In this book I would like to ask you to look from the inside out – try to look from the attacker’s point of view. When planning their attack they will most likely focus on one thing – the end user device – and their initial weapon of choice will target that device specifically without putting much weight on attacking the other layers. The delivery mechanism and payload of their attack will be designed to compromise the device itself. One point of view in this case, a different point of view, would reverse the aforementioned diagrams and would place the data and the device as the outer layer of defense, just because it is most exposed to attacks. While it is still valid that awareness and policies are the first things guarding an organization, in reality both will be ineffective due to human nature and we Page 6 of 112 must focus on protecting the device, making it fool-proof and secure enough to maintain the security triad no matter who is working on that device, as much as possible. The Node Since the focus of this book is protecting ‘the node’ and by replicating this effort – protecting all nodes and as a result – the whole enterprise, let me explain what I mean by it. Usually when speaking about an endpoint or a node, I will imply the device operated by a user – be it a desktop, a laptop, a tablet or a smartphone. Consider it as the device used by a human to access and operate with information. Any node which could be hardened against attack and which can be used by an attacker is the focus of this book. Most defense in depth diagrams place the device at the center and every other layer surrounding it. And while the device usually is surrounded by multiple layers of defense, in a realistic attack scenario the device operated by the end-user, their desktop – is and should be at the outer layer of these diagrams, as the most likely attack will hit it first before hitting (from an attack / risk of penetration point of view) the other layers. In order to convey the concept of a Cyber Fortress, I will try to paint an image in your mind which is almost impossible to generate in graphical form. I had to hire an abstract artist to draw the picture below: Abstract art by: Viktor Mazhlekov What I am trying to convey through it: in this image there are no walls, no firewalls, all you have in a modern environment are endpoints of various value and protection levels. Some are well protected, Page 7 of 112 some are exposed or even compromised – all of them connected to the others in a 3-dimensional network, interlinked with the Internet. A cyber fortress is the conventional fortress turned inside-out – and as such, attacked from the inside-out. Not all cyber-attacks happen from inside-out, but many of them do. At the same time cyber assets are attacked from the outside – as external network elements do get attacked, there is no objection to that. You could view a cyber fortress as a set of fortified individual elements, rather than as a fortification with walls and towers. If you remove the walls and towers from the first image above, you are left with one or many core valuable points, which are unprotected and easily attacked. In a cyber fortress, such removal should be impossible. Shutting down your firewalls and intrusion detection systems should not render your defenses useless and your core digital assets should be almost as protected and difficult to compromise as before. And penetrating a cyber fortress means gaining access to one or more of its protected nodes. Ideally one breached node will trigger an ‘immune response’ (here Incident Response comes into play, but on that in a later chapter) and disconnect all communication with the other nodes in the network. Such a breach does not mean a breach of the whole organization and as a result would not mean losing the security of the whole fortress. Any attacks against a standard fortification can come from outside or using arrows and stones from above. The attacks against a cyber fortress are similar to a poisoned water well in the castle – they start from ‘within’ and attack from inside out. Another abstraction would be a disease spreading among the population of the castle – again, isolation and a good immune system is key. In a way attacks are being ‘pulled’ from outside – or ‘downloaded’ by your own defenders and fellow townsmen – onto their desktops, which is really close to where your most sensitive data resides. In order to build a cyber fortress you need to fortify its individual elements and the communication links between those elements. This is accomplished by centralized hardening according to standards set per equipment type and operating system, per software version, confidentiality level, etc. Or here is yet another analogy to differentiate the two concepts. In order to defend a cyber fortress, you need to build and improve the immune system of its habitants. That immune system though would need to include their mental and psychological power to sustain constant attacks against their alertness, will and ability to recognize friend from foe. The weight of defending shifts from shields to mind, from walls to immune reactions. The small mechanisms on which the life in a fortress (business) depends are now fully exposed to attack from outside. All the legitimate code which runs your processes today is vulnerable to potentially harmful code coming from outside with the data your employees consume on a daily basis – web sites, e-mails, exploits and exploit packs and attachments as well as exploits targeting your externally accessible systems. All communication happening inside the organization should be isolated from the outside via encrypted channels – and all incoming and outgoing communication should be checked for signs of data leakage or attack patterns. Page 8 of 112 There are hosts in your network, for which full isolation must exist between them and the Internet – and information to and from these nodes should be always moved manually and/or in a controlled manner. These are the nodes where ‘the keys to the kingdom’ are stored – encryption/decryption keys, the most critical company secrets, database backups, etc. These could be tapes, disks, storage arrays – just make sure they are not accessible online. For example, tapes which can be picked up by a robot controlled from outside are not ‘offline’, even though they are not physically connected to a network device. More and more organizations are migrating to the model of dual desktops per employee – one with access to the internet but no access to the internal network and one with access to all needed corporate resources, but without any access to the Internet. Information between the two should pass through rigorous checking for various signs of danger. Ideally any detected executable code should be stripped on the way in and any confidential information should be stripped on the way out. Decentralization, differentiation, hardening A distinctive quality of the cyber fortress, or the modern concept in the above definition would be decentralization. Or as Sun Tzu says: “The general who is skilled in defense hides in the most secret recesses of the earth” It is no longer necessary to keep all your eggs in one basket. You have hundreds of ‘cloud providers’ who will happily host your desktops and servers, who will host your databases and files – if properly protected and encrypted and with good access controls, they will be much better protected than if located in a single location. Think about the benefits for disaster recovery and business continuity – a single devastating geographically constrained event would be unable to cripple your operations as they would be distributed across the globe. A single government would not be able to take you down and a single attacker would definitely struggle to even find all your information strongholds, yet alone attack them. Decentralize everything you can as long as it does not threaten business operations and profitability: your software (use different vendors for different purposes), your desktops (use different operating systems and authentication schemes per function), your server operating systems (same), your workforce (all hail for freelancing!), your selling grounds (who says you should only sell your services on your website?), well… you get the point. Just make sure every decentralization step is well thought out and planned – and that every decentralized location / point is well protected, well connected (via an encrypted channel) and well concealed. When creating ‘impossible to break’ defenses we should remember that there are fights and adversaries against which we simply cannot win. Certain country states and threat actors possess technology which allows them to syphon information from your equipment from hundreds of meters away via the electromagnetic waves emanated from it – without utilizing any exploits or code-based attacks, without resorting to social engineering or getting near your premises. Another way would be to utilize the mic in your smartphone to decrypt the data passing through your laptop (http://arstechnica.com/security/2013/12/new-attack-steals-e-mail-decryption-keys-by-capturingcomputer-sounds/ ). One solution to fully isolate your environment even from these actors is to work from an underground facility – not impossible, especially if you only need to protect your most Page 9 of 112 critical assets only. Another is to utilize tempest-proof equipment. The downside of that is the low performance (it is updated much slower) and its price. Security is (almost) always a compromise with usability – depending on the threats and risks, but that probably is an overkill for most and there is no sense to go as deep in the defenses of a regular company, which will most likely never be of interest to such an adversary. Focus should be on the nodes, not on ‘protections’ and ‘appliances’. The nodes should be protected from human mistakes (well backed up data), internal threats (sabotage, leakage), external threats (random or advanced and targeting you adversaries) via rigorous planning and execution of hardening steps. This hardening should cover user awareness and education, OS settings, application settings, networking settings, network communications, encryption, backup, updates of the OS and application components, code execution control and lastly but maybe primary by importance – usability and efficiency. Without usability and efficiency you will lose any and all of the benefits of the above – as no matter how hard you try, if the measures you put in place are counterproductive and illogical from a business point of view – these measures will be bypassed by even the least qualified employees in the organization. Remember what Alfred Hitchcock said: “There is nothing more dangerous and effective than a motivated amateur” Page 10 of 112 Prepare for WAR and the new realities On Cyber War War is destruction and loss of lives. The term became powerless and meaningless with so much marketing hype from every vendor, blogger and their uncle’s dog. Throughout this book you will often read the term and such associated with it – just remember that things are really serious and if something bad hits the fan, it will really be devastating. We’ve seen examples of factories stopped, whole production lines destroyed, fuel pipes blown up, the electricity of entire countries disrupted (Pakistan and Turkey) – many of these were performed just as an exercise or as proving of a point between big players. The (western) media is portraying China and Russia as the most active players on the cybercrime / cyberwar scene – when in reality the most active and effective cyber warfare actors are the Five Eyes Alliance countries (FVEY - Australia, Canada, New Zealand, the United Kingdom, and the United States, ref.: http://en.wikipedia.org/wiki/Five_Eyes ). Following them are China, Russia, France, Germany, Japan, South / North Korea – and a countless number of other state and non-state sponsored malicious code writers. Just for a sense of scale – the largest private intelligence organization has almost 200 000 employees and private contractors under its belt. I would like to emphasize that being active in this field does not necessarily means being evil or dangerous – everyone has the right to pursue their business and state objectives, to defend and seek information which would improve their nation’s wealth and security. The only downside for regular organizations is being caught in the crossfire between two or more large actors as collateral damage. One of the strategies utilized by FVEY when a target is acquired is to exploit it via the already existing open links to the Internet. That includes any open website, primarily but not necessarily limited to sites based under their geographic control. Once the victim has an established session with said website (think social networks, e-mail) – FVEY inserts their traffic into the stream – such as an exploit – and compromises the target. Having this in mind – critical and sensitive systems should never open sessions outside of the fortress – and never establish sessions with the Internet unless inside an encrypted secure tunnel. You don’t have to be on their list of targets to get hit or fall victim as collateral damage – your company’s network can become just a temporary storage or a tunnel for their operations. Then the weight of proving you were not involved will be on you – can you deal with that? According to recently ‘leaked’ documents, the NSA considers using “fourth party” networks in their operations as normal and acceptable – that is, using your company or your network as a stepping stone during some operation, without your knowledge. The same policy most likely exists in other countries and although I can’t judge if it’s right or wrong – it can harm innocent parties. While I am fully supportive for any activity which preserves the lives and peace of any sovereign nation, there are limits which should not be crossed. Such a limit is allowing unknown activities with unknown motives and unknown consequences to the “fourth party”. Since there is nobody who could enforce such fair behavior the weight of enforcing it lies within every organization desiring safety and independence. Page 11 of 112 Your objective is guarding your castle – and it does not matter who is the attacker and which geographical border they belong to – your network is your territory. If it can fall victim to one player, it can certainly fall victim to any other, using the same or another vulnerability. Throughout this book I will mention quite a lot of techniques used by the NSA – not because they are necessarily evil, but because no other intelligence agency has been a victim of so many public leaks and as a result we have no other examples of how intelligence agencies work. Given the abundance of information about the NSA though, we can safely conclude others act in a similar way, as they all learn from each other on a constant basis. We could all be thankful to the multitude of initiatives the NSA has taken upon itself – including distributing free guides on cyber security – they could have kept these for themselves like most other governments. In fact, many of these guides will be mentioned and used in this book – along with leaked information, which can now be assumed public and no longer ‘top secret’. Private cyber-gangs and armies Organized crime has long ago switched to cyber-crime – the low risks and tremendous returns were a no-brainer. If the NSA spends upwards of $25 000 000 per year on 0-day exploits, the total spent for 0-day exploits underground is definitely more – factoring the number of sellers and buyers and the number of malicious specimens released every day. This underground market has existed since at least 20 years. Think about Amazon – now realize that there are people dealing with selling and buying malicious code for decades, long before Amazon was even conceived. The malicious software economy depends on a snowball effect: as users are being infected via various vectors (malicious ads on compromised ad networks, hacked websites, malicious software, viruses hidden in pirated software, etc), their data is being siphoned and sold and re-sold to multiple layers of buyers, who in turn monetize the information just to invest more money into more infections and more infection vectors and brand new exploits. Executing an exploit against your branded network router / switch / appliance became as easy as sending it an inconspicuous packet, undetected by any IDS/IPS. Executing code at any computer in your network became as easy as sending an e-mail with a PDF inside – followed by a tunnel leaking all confidential information from that computer across the globe. At this point it should be pretty obvious that your defense strategies need to change. It does not matter which political side you are at or which country you operate from – the threats became so mixed up and global that we must act as if we are attacked from multiple sides, multiple nation states, multiple criminal vectors – all at the same time. Is China your biggest enemy? Or maybe it is Russia? Or Iran? Really, the media hype is for the masses, we are supposed to be smarter than that. First, let’s remember the existence of the Five Eyes Alliance. Just the US cyber army counts above 20 000 soldiers, trained in offensive and defensive skills. Now let’s think, are they really the only ones with the capability of building a cyber army? Because what is a cyber army? Just a number of people trained in offensive security techniques with a set of really expensive software and hardware tools. Then anyone capable of shelling a considerable amount of money is also capable of assembling a considerable amount of cyber arsenal and cyber warriors. This multiplies our list to almost any nation in existence. Page 12 of 112 And let’s not forget, there are criminal syndicates in possession of incredible amounts of money. They are not even slightly behind technologically – I would say they were there a very long time ago, waiting for us. Then, there are the regular local gangs, dealing with power and information. The ones who would get orders from your competitors to infiltrate your organization and steal information for as little as 4-5 digit sums. In this environment it is no longer forgivable to hide your head in the sand and pretend you are small and nobody will come after you. It’s no longer about someone coming after you. It is about everyone going after everyone at the same time –either you fight and survive (if you do it well) or you fall as a victim – there is no other option. Page 13 of 112 Intelligence operations against technologies we use every day It is yet unknown which of these ‘leaks’ were planted as misinformation and which are real. From the technical details of them and trusting the collective intelligence of the global infosec community it can be concluded they are legitimate. From the German Spiegel, at http://www.spiegel.de/international/world/nsa-documents-attacks-onvpn-ssl-tls-ssh-tor-a-1010525.html we can see the following categorized attacks: Attacks against Crypto Guide for Analysts on how to use the PRISM Skype Collection GCHQ Briefing on the BULLRUN Program GCHQ Presentation on the BULLRUN Programs Decryption Capabilities NSA LONGHAUL program for end-to-end attack orchestration and key recovery service BLUESNORT program on "Net Defense" from Encrypted Communications Presentation from the SIGDEV Conference 2012 explaining which encryption protocols and techniques can be attacked and which not NSA program SCARLETFEVER explaining how attacks on encrypted connections are orchestrated Description of VOIP Telephony Encryption methods and cryptanalytic and other ways to attack Attacks on SSL/TLS NSA Experiment for massive SSL/TLS Decryption Canadian Document from CES on TLS Trends Details on how NSA uses the SCARLETFEVER program to attack Scure Sockets Layer (SSL)/Transport Layer Scurity (TLS) Analysis from SSL/TLS Connections through GCHQ in the flying pig database Attacks on VPN NSA High Level Description on TURMOIL / APEX Programs on Attacking VPN Explanation of the GALLANTWAVE that decrypts VPN Traffic within LONGHAUL Intro to the VPN Exploitation Process mentioning the protocols attacked - PPTP, IPSEC, SSL, SSH) Analytic Challenges from Active-Passive Integration when NSA attacks IPSEC VPNs Overview of the capabilities of the VALIANTSURF program MALIBU Architecture Overview to exploit VPN Communication POISENNUT Virtual Private Network Attack Orchestrator (VAO) NSA Presentation on the development of Attacks on VPN NSA Presentation on the Analysis and Contextualisation of data from VPN Description of existing projects on VPN decryption Explanation of the Transform Engine Emulator when attacking VPN Explanation of the POISENNUT Product and its role when attacking VPN Explanation of the TURMOIL GALLANTWAVE Program and its role when attacking VPN Processing of data from exploited VPN in the TURMOIL program Decryption of VPN Connections within the VALIANTSURF program Description on the processing of VPN data packets within the TURMOIL program Explanation on the SPIN9 program on end-to-end attacks on VPN Page 14 of 112 Deanonymizing 1. 2. 3. 4. 5. 6. Explanation of a potential technique to deanonymise users of the TOR network Analytics on security of TOR hidden services Overview on Internet Anonymization Services on how they work TOR deanonymisation research TOR Overview of Existing Techniques A potential technique to deanonymise users of the TOR network Cryptanalytics General Description how NSA handles encrypted traffic Intercept with PGP encrypted message Classification Guide for Cryptanalysis Procedural GCHQ Document on how analysts are to handle encrypted traffic NSA / GCHQ Crypt Discovery Joint Collaboration Activity NSA Cryptographic Modernization (CryptoMod) Classification Guide "National Information Assurance Research Laboratory (NIARL)": Newsletter, Keyword TUNDRA What Your Mother Never Told You About the development of Signal Intelligence Intercept with OTR encrypted chat We can also consider that every nation partnering or being part of NATO is using the same or similar techniques. Just as well they could be used by any other sufficiently advanced nation. But wait, there’s more. According to http://www.spiegel.de/international/world/ghcq-targetsengineers-with-fake-linkedin-pages-a-932821.html - intelligence agencies are planting malware into websites their victims are using without the need to compromise the actual website. All they need is a way to plug between the user and any point on the Internet on their path to the target site. Then a fake webpage, just as the one the user expects is being inserted into their browser – with a little ‘present’ inside in the form of an exploit. Going through the documents above leaves the impression no technology is spared and any technology capable of providing privacy and confidentiality to the people is being actively researched and attacked. To top that off, seems NSA has been planting backdoors even in hard drive firmware, for years. Nothing guarantees the same from not being valid for BIOS / other devices. More details here: http://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group All this leads to the conclusion that there are just a few methods we could employ to stay safe from exploitation. Some of them were mentioned above, but I will try to summarize them here and detail them in the chapters following this one. 1. Usage of common software which could be easily exploited should be avoided. That includes operating systems. 2. Usage of common network equipment should be avoided. Building your own router / firewall appliances has never been more justified, especially with the abundance of open source projects for that purpose 3. Mass distributed mobile phone (smartphone & tablets) usage should be careful and restricted to situations when it is ok to know your device is being fully monitored – content, location and code execution at will by an adversary. In all other cases tightly Page 15 of 112 controlled devices should be used – with enforced encryption, enforced browsing whitelisting by an external proxy, enforced application sandboxing and constant VPN networking turned on. Communication on non-encrypted channels (GSM/4G) in the clear (using only the encryption provided by the mobile operator) should be avoided where and when privacy is concerned. 4. VPN is to be trusted only when both endpoints can be trusted as well and when the protocol used is implemented properly. Some of the leaks mentioned above indicate that a simple misconfiguration on the part of a system admin can leave gaping holes in the security of a VPN connection. The definition of a proper VPN configuration can be found, luckily, in documents and configuration guides posted by IASE DISA (SRG/STIGs), mentioned later in this book. 5. Get your equipment only from trusted vendors. Remember that certain vendors were proven to have planted (willingly or unwillingly) hardware and software backdoors into their appliances. If you can’t find a trusted vendor, try to build the server/network service yourself. Buy from countries where the Five Eyes Alliance has no control over vendors – you could buy directly from China and deliver the equipment yourself from the factory, if the situation requires utmost certainty that nobody has tampered with it on its way to you. You could read even more and use a search engine to search through ‘leaked’ documents on https://www.eff.org/nsa-spying Please don’t get me wrong – I am all for the fight against terrorism and combating the criminal underground through legal surveillance. But this has already gone too far and we need to at least return the balance of power to the people – remembering that the government exists (by definition) to serve its people – it is not the opposite. In present times our communications and data must travel through de-facto compromised networks from source to destination – compromised by various actors for their own agenda. Sending data across the globe means it may be intercepted and possibly an attempt to decrypt it will be made. There is a solid chance that it may as well be modified and an exploit – inserted so that it compromises the target on arrival. Malware is no longer using files (the one written by APTs) – now it’s being stored in the BIOS, in GPUs (for a good example, check out https://github.com/x0r1/jellyfish), in RAM, in the registry, in HDD firmware… if you’re looking to detect malicious code planted in your system after an exploitation by an APT, you will fail. Malware written in 2008 was detected in the end of 2014 – we can expect malware written by intelligence agencies written in 2015 to be discovered in 2020 or later, if ever, following the same logic that their knowledge is X years ahead of the general public experts. So we must strive to harden our endpoints and de-centralize our infrastructure elements in order to prevent exploitation. We must also up our game – what was enough to maintain the security of our data 10 years ago is merely a speck of what is needed in terms of equipment, knowledge and experience today. This book will not provide them for you completely – but it will give you very good starting points in the various topics it touches. Page 16 of 112 APT or APA and can APDs counter their attacks? APT. Oh, how I love this term. It became the fashion among security vendors so much that they started including it in every single page of their marketing materials. Every single vendor out there will come to a sales meeting saying their appliance magically defends against “APTs”. Do they even know what that means? I would like to use an image to illustrate the idea: Image credit: https://www.flickr.com/photos/soldiersmediacenter/8144569645 APT is not a ‘threat’ by itself. It is not the danger of being shot, it is the sniper, patiently waiting for your head to align with the crosshair of their sniper optics. You can read the following book to thoroughly understand the meaning of it: Advanced Persistent Threat: Understanding the Danger and How to Protect Your Organization. I will just try to share my ideas below, to augment the rest of the content of my book with the term. After all, what good is a security book if it does not mention APTs? No vendor can prevent APT This is like saying that a band aid will prevent bullet wounds – when what you should really be focusing on is to avoid being in the way of a bullet in the first place, as in this analogy the APT is the shooter, not the bullet. No vendor or appliance can prevent motivated, well-funded and trained individuals from having an interest and motivation to attack you. What you can do though and what this book is about is to raise the adversary’s cost to attack you by focused, patient and persistent work on becoming an Advanced Persistent Defender. APT is a bad term. I would say a better term is Advanced Persistent Attacker (or Advanced Persistent Adversary). Detecting them has become much more difficult because they (since 2008) no Page 17 of 112 longer use files to store their backdoors on your systems – or at least avoid storing non-encrypted files. You cannot detect apt activities with your AV nor can you spot their running code with a task manager. A good idea would be to dig into a memory dump from a suspicious machine - but are you going to do that continuously for all your machines? What is left is network activity. But are you monitoring your power lines? Because APAs could be using your power lines to exfiltrate information - they will not (in many cases) use your networking equipment. Or they will install their own gateways inside your network and the traffic will never even touch your gateways. Motivation is what drives them and while that motivation is backed by enough resources to justify pushing until a successful breach – and while the reward from that breach for them is bigger than the expense of pushing through your defenses – they will push. Simple mathematics dictate that as long as your adversary’s resources and motivation are greater than your resources and motivation, they will prevail. That means one thing – use your resources wisely, stop spending humongous amounts of money on newer appliances and start thinking how to do more with less, as I am sure with proper configuration and hardening you can achieve more than if you buy and plug in all the security appliances on the market. Hopefully if you do your job in the best way possible you will raise the cost of breaching your defenses enough to deter as many adversaries as possible with the resources at hand. In my opinion spending time and effort on proper configuration results in a higher security yield than spending money on products. Being a persistent defender means creating invisible and difficult to penetrate data stores and user endpoints, hardening your servers and network devices according to military-grade best practices, controlling code and application execution, etc. The process of creating a single well hardened desktop could take up months of your time – the benefits though will be quickly visible when you start deploying it across the enterprise. It is faster and easier to buy somebody’s well sold promise, especially if it covers all your bases in terms of compliance to your favorite standards – but it has nothing to do with being a persistent defender and it will not help you keep your job when that promise fails to deliver. Being an Advanced Persistent Defender is yet another animal and requires a never-ending process of reading and learning, as your adversaries never stop advancing their skills to the next level – just please don’t mistake learning with obtaining certifications. Can you imagine an advanced cyber attacker boasting a certificate as their skill to penetrate your defenses? Then why would you feel more capable to defend by being certified? As one of my very good friends pointed recently – a certificate is a beautiful packaging, nothing else. Make sure you pack a punch in that packaging or don’t go to the fight in the first place. A bit part of being an APD is knowledge – that is why the next chapter will focus on obtaining the knowledge necessary to build a good foundation. Page 18 of 112 Becoming a knight: learn! Constant improvement is what your adversaries master at. Even though you might go for a new certificate from time to time – this is not the improvement I am talking about. Webinars are not improvement. Good, old-school reading and putting what you learned into practice is going to make you a master of your craft. Let the others go for the certificates – you will not be competing on their low level anyway. Your mastery of the Cyber Defense craft is imperative to your own success and the success of your organization. I cannot promise you many things – but I can promise you this: if you dedicate the time to read this list of books you will be on your way to becoming a Master among your peers. Just trust me on this one. Every book will move you forward, every book will build your mindset and every book will drive you to learn new things – even ones not mentioned inside. It does not matter which field are you trying to excel at – pentesting, auditing, managing a security team, secure programming, security monitoring, etc. – the books below will provide an incredibly solid foundation on which you can build further. Finally – please stop making blogs and blog posts your primary source of infosec news and start reading well written books and military-grade papers on security – they are not that difficult to find. Let the “certified professionals” post and read on blogs – this book is for the ones who want to go beyond a certification or a degree (if you hold any certificate please do not get offended – I’ve seen the good and the bad from people holding them and can say it only depends on the person – some people know what they’re doing, many don’t). Remember the golden rule of being an expert – read the books the authors of your bestseller books had to read to become good enough to write your bestseller books! Do you really think they would have written them by reading blog posts? Don’t think so. Recommended books to build a solid foundation The list is not comprehensive – and is a personal recommendation. Yet I still trust that after reading it you will be miles ahead of people who only study what they have/need to. Your understanding of the core concepts in this field will allow you to make much wiser decisions. Philosophy / Military Art There were times when warriors (and defenders) had to prove themselves in battle as opposed to paper degrees, certifications or LinkedIn profiles. And in order to become victorious in your daily battles, you need strategy – strategic thinking they do not teach you on the certifications tracks and in universities. Military insight collected over the centuries and distilled into books is invaluable for infosec professionals. The Art of War – Sun Tzu – let this be your foundation. Many know about this book – but not everyone knows that it has an amazing successor. Sun Tzu had a great-grandson (some say greatgreat-great grandson) – Sun Pin, and his book (Sun Pin: The Art of Warfare) is a must-read, too. There is actually one book on Amazon which has both in one. The best you could do is to buy the “The Complete Art Of War: Sun Tzu/sun Pin (History & Warfare)” – as it contains both books and a Page 19 of 112 very good commentary by people who have spent years in studying the books, as without them you would have a hard time understanding some of the specific ancient Chinese concepts. The Book of Five Rings If you liked “The Art of War” you will like this one. It is Japanese – and it is said that Yakudza are governed at large by the rules of this book. Please do not be alarmed by the large quantities of fighting techniques, sword and other weaponry usage guidelines – yes, there is a lot of that, but it is definitely not useless and can be applied to modern cyber attack / defense tools. Think of it in this way: both you and your attacker possess defensive and offensive capabilities. While many see cyber defense as their only legal option, cyber offense is possible and can be legal. Yes, you cannot hack back. But you can track down and capture with the help of any local police. You cannot steal their information, but you can provide local (to the attacker) law enforcement with ways to obtain that information, and so on. Just as the attackers can use strategy to break through your defenses, so can you. And they are not as scary as their tools are to your security vendors – in most cases hackers are much less protected than an enterprise. It is surprisingly easy to track them down and capture them if you have the right people, tools and resources at hand. The books above are the Foundation. Reading them once is a good start. Reading them for a second time after a year is necessary. You will understand, after time, that you cannot fully comprehend what a military master has accumulated over a lifetime and compressed into a book, over a single reading. And when you read them for the second/third time your brain will eventually start to build connection between the cyber world and the real world, between ancient fighting strategies and modern cyber war strategies. Diplomacy (Touchstone Book) - this book will give you many good examples on diplomacy, and this skill is critical in our daily work. Cyber Security History The Best of 2600: A Hacker Odyssey This one is a gem. Not actually a book – but a collection of quite a lot of issues of the 2600 magazine – starting from the earliest. The whole cyber security culture, a lot of its mindset are compressed inside. I can’t think of any other book which would give you such a good of a perspective on the history of our craft as it developed through the years. Novels Yes, you read that right. Novels. Severely underestimated in the benefits and knowledge they provide – the books below are a must-read. You are really lucky the series below are available as a single Kindle purchase for under $50. Back in the day, I had to order them book by book and ship them to Europe – the price was much higher. Stealing the Network: The Complete Series Collector’s Edition and Final Chapter Page 20 of 112 This is one of the most important readings one could have as an INFOSEC professional. It will open your eyes and mind to an incredible amount of real-life attacks. Through a captivating story the books will guide you through hundreds of techniques cyber criminals use to compromise their targets and stay undetected. Trojan Horse: A Novel A book by Mark Russinovich and Kevin Mitnick. And amazing combination. Rogue Code: A Jeff Aiken Novel (Jeff Aiken Series) is another one worth the read. You will have fun and keep learning – can it get any better? Hacking a Terror Network: The Silent Threat of Covert Channels – this book will open up a whole new world of data exfiltration / steganography in a very realistic way. The Art of Deception: Controlling the Human Element of Security – a classic by Kevin Mitnick. An absolute must when it comes to understanding social engineering. Followed by… The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers – another great read by Kevin Mitnick, this time on a more technical side. Very realistic – although slightly dated – exploitation today happens in a very different way. Still, very much worth a read. Technical books Just 2 titles here – we are laying the foundation. There are many ways to focus on a specific areas of expertise – but a certain foundational technical level is still needed to get started. Hacking Exposed, 7th edition – no doubt, you SHOULD read this book, if you haven’t already. It will build a solid foundation for whichever direction you decide to develop in. Security Intelligence: A Practitioner's Guide to Solving Enterprise Security Challenges – the second technical book you should get. Much deeper and tougher to digest. Note: not available in some countries, but guess what: you can buy it from O’Reilly directly as an e-book: http://shop.oreilly.com/product/9781118896693.do Standards and Best Practices Try and stay away from cyber security standards which are built around an auditing / compliance / security certification industry, same as ‘best practices’ being offered by educational entities for marketing purposes. I mean, surely you will not be able to if you work at a large organization, but you should definitely not rely on them for any practical usefulness beyond protection on paper. The ones which are focused on practical controls are tough to implement and really tough to control – that is why there are very few consultancies specializing on auditing non-US companies against NIST 800-53v4 or US DoD 8500 controls. Most focus on ISO standards – well, I personally dislike them for the damage inflicted on organizations believing to be secure after being declared “compliant” to some brand standard or the sorts of them. Not that ISO standards are bad – they are not. But the way they are being enforced and audited against is not right. There must be much stricter control over which proofs of compliance should be accepted, because a control on paper is not the same as an effective practical control Page 21 of 112 which is tested and working against real threats. Often the auditors themselves lack basic infosec knowledge and can’t see beyond their checklist. Then again, there is nothing wrong with checklists. Take this one for example http://www.klcconsulting.net/diacap/DoDI_8500-2_IA_Control_Checklist_-_MAC_2-Sensitive__28_March_2008.pdf - as long as the controls and the proofs of their existence are checked properly. “Is a port closed?” – run nmap and check. Don’t just accept ‘yes’ as an answer from the network engineer. “Do you perform information security awareness trainings” – interview several employees from multiple departments, check their knowledge, test them with a fake phishing page, see how many report it and how many submit their domain credentials… Do you see now, how different that is from the audits most organizations are used to? And then they wonder why their compliance does little for their real-life security. It’s all about proper verification. Now, if you really want the “big guns” – review the US DAG (Defense Acquisition Guidebook, all 1248 pages of it) which defines in great detail the requirements towards systems and processes, before being accepted to service. https://acc.dau.mil/docs/dag_pdf/dag_complete.pdf (I hope it stays online longer, if not – well, all PDFs mentioned in this book will be available on request, too). After you go through it you will see the difference with popular standards and requirements for yourself. There is no way to catalogue all best practices worth reading here – but I am making a point. There are ones built by commercial organizations and ones built by defense engineers. Choose the latter every time you have the opportunity. One good starting point to refer to cyber security standards and best practices is the CyberSecurity Reference Tool, developed by NIST, located here: http://www.nist.gov/cyberframework/csf_reference_tool.cfm – which can be used not only to refer controls to their respective standards / best practice references, but also when needing to explain why a certain control needs to be implemented to higher management. Backing your words with control details, names and referencing best practices and standards linked to these controls you have a stronger convincing power. It provides you with a really handy XLS file, listing all relevant references per category and subcategory: http://www.nist.gov/cyberframework/upload/framework-for-improving-critical-infrastructurecybersecurity-core.xlsx For example, for the Asset Management category, it lists the subcategory of “ID.AM-1: Physical devices and systems within the organization are inventoried” and the references for this subcategory: · CCS CSC 1 · COBIT 5 BAI09.01, BAI09.02 · ISA 62443-2-1:2009 4.2.3.4 · ISA 62443-3-3:2013 SR 7.8 · ISO/IEC 27001:2013 A.8.1.1, A.8.1.2 · NIST SP 800-53 Rev. 4 CM-8 You can also use Google to find valuable guides and information. Page 22 of 112 For example: a simple google search “Information security New Zealand filetype:pdf” returns the following document: http://www.gcsb.govt.nz/assets/GCSB-Documents/NZISM-2011-Version1.01.pdf - “New Zealand Information Security Manual” - all 297 pages of it. The Australian Government Information Security manual page is an incredibly good resource, too: http://www.asd.gov.au/infosec/ism/index.htm - and the 3 documents – Executive, Principles and Controls – are incredibly well written. Even though most of this book is focused on what the US government infosec teams have provided to the world for free, the Australian teams are breathing in their necks in terms of quality and usefulness. Strive to read the best information possible. And since the following is totally free, you could attend and pass every single training which matches with your interests from the list here: http://iase.disa.mil/eta/Pages/online-catalog.aspx These are web-based training materials (WBT), containing hundreds upon hundreds of the highestquality security training you could ever find for free online. These are not vendor-based, not created for profit, but created with the sole purpose of efficiency. I could not recommend them high enough. Some of them might be applicable to all your colleagues (like the Phishing or Cyber Awareness Challenge), others might be relevant to your IT team. The second course you can see on the screenshot above – “Mission Assurance for Senior Leaders” is also an excellent materials for you as the reader of this book. Page 23 of 112 Survey the security posture of your company Knowing the strengths and weaknesses in the defenses of your organization is crucial to its survival. There is a solid reason for quoting Sun Tzu when it comes to knowing yourself. The actual quote is: “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” ― Sun Tzu, The Art of War In the beginning of my career I hated audits – all of them. IT audits, IT Security audits, compliance audits – they seemed like a waste of time. They seemed to get in the way of my “work”, stopping my “productivity” and waste everybody’s time just to produce spreadsheet reports. I am sure a huge percentage of IT personnel today and tomorrow will continue seeing them that way. In reality they are an excellent and probably the best way of ‘knowing yourself’. Every audit can provide you with a ton of information and if you look at it from different angles you will see the bigger picture. Instead of forcing them on your fellow colleagues it is a good idea to spend some time and explain their value once and for all – you will get better data and better results if you do it. Situational awareness Knowing by heart the exposure of your organization to external and internal threats is crucial. At any point in time your officers need to know the currently open vulnerabilities for any system under their command – that includes public exploits as well as configuration weaknesses which would make lateral movement or data exfiltration easier once a breach occurs. Maintaining an internal, well-protected database of all systems and their current state of exposure is critical. This would be done best by integrating a 3rd party system with a CMDB (configuration management database) containing all of your equipment and all of your logical business systems and software systems, database systems and file storage systems, automatically updated over time when new equipment is added. Information on current exposure is best gained from manual and automated audits. Larger organizations are usually forced to pass yearly audits to maintain compliance and can audit each other before establishing trust. If you are part of such an organization then this chapter will help you find alternatives to what you use today and who knows, maybe you will find the alternatives more effective than what you use today? The reason I somewhat lack trust in the popular standards – such as ISO/IEC 27001, is that many times the auditors try to ‘help you pass’ – they accept paper proof without validation or sometimes themselves do not see the difference between a realistic control and the control they see on paper. If a control is ‘there’ it is not necessarily effective – but they will write a “yes” on their checklist and move on. They will not discuss with you the effectiveness of said control – as a result you will have a false sense of security after ‘passing’. This is risky. Besides the most popular information security audit standards there are ones which are less popular and in a way more powerful. I don’t know how they didn’t get to the market and why aren’t they accepted by the majority as primary information security assessment methods – but I personally Page 24 of 112 strongly recommend them. A likely reason is the lack of a significant marketing and sales effort – not their value or effectiveness. NSA-ISAM The first in my list by importance is NSA-ISAM, which is short for NSA Information Security Assessment Methodology. If you read the book, you might just be able to perform it yourself, following the book, granted you have the manpower and expertise necessary. You can find the book on Amazon: http://www.amazon.com/Security-Assessment-Case-StudiesImplementing/dp/1932266968 This book goes hand to hand with http://www.amazon.com/Network-Security-Evaluation-UsingNSA/dp/1597490350/ - “Network Security Evaluation Using the NSA IEM” Having been developed by the NSA with the purpose of protecting the US Government networks and contractors I can assure you it is less full of BS than other auditing standards out there. The reason this information security assessment methodology is so powerful is that it covers everything – including blue and red teaming assessments. Real assessments and not just a checkbox “do you perform pentests – yes / no”, like in other ‘standards’. Having risk-based approach rather than a checkbox-based approach is yet another benefit of passing through NSA-ISAM. Since this methodology is not mandatory and is almost unknown outside the USA it has made little commercial impact and had no chance of becoming the pillar of information security assessment it deserves. There are, however, multiple organizations and individuals capable of getting our organization audited according to NSA-ISAM. The price for such an audit can begin in the range of $20 000 – but that figure can be significantly lower or higher based on the size of your organization or its complexity / perceived risk. Most experts in the field have heard or used to some degree the NIST 800 series of standards and best practices. Not many have performed audits based on them, though – and that is a really big miss. You will rarely see auditors with experience in NIST 800-53 v4 as one of their areas of expertise – meaning you might have to organize the workforce to deal with this task yourself. Luckily, there are tools to help you with that. TOOLS There are tools which might help you perform complex assessments without having to pay auditors who would basically do the same thing – asking you questions and marking down check-boxes in their notebooks. You can easily ask the same questions to your IT team and fellow colleagues. Page 25 of 112 CSET This actually is a set of usable assessment programs generating very useful, readable and actionable reports. It is called CSET (Cyber Security Evaluation Toolkit), and can be found at https://ics-cert.uscert.gov/Downloading-and-Installing-CSET Mounting and installing from the ISO file leaves you with the most powerful free infosec assessment manual audit tool ever created. My recommendation: install it on a secured laptop, the auditor can pass through the various departments of your company – the program is designed to collect verbal answers (with the option to attach evidence) and produce reports based on checklists and questions. CSET allows for a full audit of your company’s practices against NIST 800-53 or DoD 8500, as well as several other standards: You and your team can have weeks of fun with this tool! I would like to reiterate: it’s FREE. It would be a sin not to use it. Note: this is NOT a scanner. It is meant to manually (questions and answers, collecting evidence to support these answers) audit your company’s cyber security posture. Page 26 of 112 Please remember: an audit is useless without validation. For every answer you get require proof – in the best case scenario, the person answering the question should be able to show you the exact setting / control in place, not just on paper. In the worst case scenario, accept documents – but never accept an answer as “yes” without evidence. I am oversimplifying the complexity of this application – its user manual is 250 pages long and is worth reading. Automated scanners and penetration testing Now that is an entirely different field. I would like to avoid turning this book into a catalogue of links and tool names - just remember, that a free tool is as effective as its price – for example, HP’s WebInspect is much more powerful than most freely available web vulnerability scanners, but its price will likely mean it will be cheaper for you to hire a professional services firm to run it for you rather than buy the license, unless you are on the Fortune 500 list. Important: When purchasing / leasing an automated scanner to assess your environment, check if it supports STIG compliance checking. You will learn why later on in the book. Another very important feature you should be looking for is vulnerability remediation tracking, unless you want to do all that work in Excel. Automated scanners are the most basic level of assessment you could run in your environment. A manual assessment by a professional penetration testing team will uncover logical errors and weaknesses which a tool can never find. But there is also a caveat to penetration testing: the technology I mention again and again and again throughout this book – STIG/SRG – is unknown to most penetration testers. That means that the intricate details of system hardening up to the deepest configuration settings are also not well known to them. Penetration testers focus on finding the weakest link or the easiest exploitable hole in your defenses – their target is not finding ALL of them. So even after a pentest uncovers tremendous weaknesses in your defenses and you fix all of them – remember, 90% of the remaining vulnerabilities are still there. Please remember that and work on hardening as many devices as deeper as possible. If you can afford a team of a few penetration testers who will find 10% of the existing vulnerabilities in your defenses there are countless others working individually and in teams doing the same and looking to break the other 90% around the clock, if left unchecked. How to choose a penetration testing company Disregard the brochures and sales presentations given by big name organizations. I have seen very, very big names deliver ‘penetration testing’ in the form of heavily branded vulnerability scan reports and a couple sql injections. Same organizations charge in the range of $1000 per day for their services. Try and find the company employing infosec professionals with a different set of skills. They don’t like wearing suits and you could see them in jeans and black T-shirts, covered in tattoos – but what differentiates them from ‘suited pentesters’ is they know what they’re doing. They present regularly at security conferences because they have something to say – and people listen to them time and time again. The same people often create open-source security tools – tools which then are used by everyone, even by the ‘suited pentesters’. This is the one solid sign your potential vendor can deliver on a penetration testing engagement – involvement and usefulness to the infosec community, as well as name recognition of their Page 27 of 112 employees in the same. And just because I love examples, I will allow myself to gift some shameless advertising to my friends from TrustedSec - https://www.trustedsec.com/may-2015/egressbuster-v02-and-github-goodies/ They are just one of the hundreds of properly trained teams around the world – but looking for the right ones just got easier for you. Page 28 of 112 Know your enemy Knowing your environment (yourself) is half the way. You should know your enemy as well. One way of keeping in touch with what is happening on the Dark Side is keeping updated with information security news. And keeping a list of RSS feeds is no longer relevant – where keeping yourself updated once or twice per day was OK in 1999, it is no longer acceptable. News dashboards updated in real time from Twitter and CERT teams around the world are a must. Missing security news even for an hour could have devastating consequences for your and your organization (well, the company will survive, but will you keep your job for letting the bad guys in because you missed a critical exploit in the wild?) Doing your due diligence is your and your company’s insurance. Twitter You might get away with just following popular infosec people, but how are you going to know which ones to follow? Hashtags (##) to the rescue! In the Twitter search box, type #infosec, #InformationSecurity, #Malware, #Vulnerability (many emotional tweets might sneak into this search, but still), #dfir (Digital Forensics and Incident Response related tweets). The users I highly recommend following: @USCERT_gov, @QatarCERT, @enisa_eu, @xorred (me, of course!) –you can find the others while browsing tweets from the aforementioned hashtag searches. Twitter on Steroids – TweetDeck! Now comes the interesting part. After you’ve mastered Twitter, you should create your first real-time infosec news dashboard, and I will show you how. Go to https://tweetdeck.twitter.com/ - sign up if you have to, authorize the app – and click on the big Plus (+) sign, which says “Add column” when hovering over it. From there, click on “Search”: Then enter the following settings: In the Engagement settings, enter at least 1 retweets and at least 1 favorite. This way you will get rid of most of the spam on these hashtags. Additional blocking / muting on TweetDeck of spammy users is necessary, even after these tweaks – but you will get much less spam that way. Tweak to your liking. You can rinse and repeat the same for hashtags or usernames – US Cert is one which I always keep on there. The end result should look something like this: Page 29 of 112 You don’t need to refresh the page – it auto-scrolls newer entries for you. It can’t get more userfriendly and optimized than that. Note: be careful to spot the twitter and other social accounts of people and ‘organizations’ which might become or are your cyber enemies and devise a way to monitor them anonymously, with a set of separate, unrelated social accounts. Websites with cyber security news you can add to your refresh list: • http://www.rootsecure.net/?p=secnews_rss_feeds – if you still are into RSS, this is your website, dinosaurs! • http://www.reddit.com/r/netsec - Reddit is an awesome community of like-minded people. You can also find a job or hire the right person (really, cool people gather around cool people) in the infosec hiring threads there. The power of this platform is the voting mechanism, instantly pushing important and valuable material to the top – a very democratic society which optimizes your reading experience if you value your time. • https://www.us-cert.gov/ncas/current-activity - one of the most advanced CERT teams in the world. Certainly worth to monitor the whole website, not just that link. • http://cert.europa.eu/cert/filteredition/en/CERT-LatestNews.html - similar, but European. You will often find mentions of new open-source tools to optimize your infosec work on the aforementioned twitter feeds and on reddit, too. As soon as an author releases a new tool they usually post it with the right hashtag (#infosec, for example). By following the right people and reviewing the suggestions by Twitter you will never be behind in your situational awareness. Page 30 of 112 External Network Monitoring Services Sometimes you cannot trust your own defenses, especially if you properly assume that your network has been compromised. All IDS/IPS appliances have the same weakness: they rely on what is known and rarely on some basic behavior analysis. But when an attacker uses a new technique (which happens quite often) it will pass as a legitimate traffic. In such cases you need to rely on someone with an eye on the criminal networks, someone, who sees malicious traffic from the attackers end. In such cases you should use services such as ShadowServer https://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork They monitor malicious networks from multiple locations and can alert you if they see traffic from your network leaving towards a botnet command & control server, for example. Some security software vendors will charge you 5-digit prices per year for “appliances” which basically do the same thing – ShadowServer does it for free as a community service. As per their website: The reporting service monitors and alerts the following activity: Detected Botnet Command and Control servers Infected systems (drones) DDoS attacks (source and victim) Scans Clickfraud Compromised hosts Compromised websites Proxies Spam relays Open DNS Resolvers Malicious software droppers and other related information. Setting up an arrangement with this non-profit organization is really simple. All you need to do is get your ASN from your network administrator and send them an email, as per the above link’s instruction (hopefully by the time you read this book the service is still available). If you find this service useful, please consider donating. They’re not even asking for it – which is an even better incentive for you to be generous to such a good service. Another useful service is Have I been Pwned: https://haveibeenpwned.com/ As the name implies, this service monitors sites such as PasteBin for information containing your domain, e-mail addresses, etc. – and as soon as it detects a ‘leak’ you will get notified via e-mail. When signing up, you will need to confirm your domain ownership – so coordinate on that with your IT team. Page 31 of 112 Other external monitoring services: http://www.google.com/safebrowsing/alerts/ (need your own AS)Safe Browsing Alerts for Network Administrators allows autonomous system (AS) administrators to register to receive Google Safe Browsing notifications. The goal is to provide network administrators with information of malicious content that is being hosted on their networks. •Team CymruTC Console - https://www.team-cymru.org/Services/TCConsole - no cost, *in most cases* (more info: https://www.team-cymru.org/Services/TCConsole/tcconsole_trifold.pdf ) It is a good collaboration platform, if you collaborate it will be free for you. • https://postmaster.live.com/snds/index.aspx - detect data coming from their network towards your network after verifying your AS. “By providing data such as mail traffic statistics seen by Windows Live Hotmail to IP block owners (ISPs, in a broad sense), organizations are empowered to prevent spam, viruses, and other malicious activity from originating from their IP space.” • https://spyeyetracker.abuse.ch/index.php - mostly check your IP addresses / domains for c&ctraffic towards c&cservers. Interesting statistic: Average SpyEyebinary Antivirus detection: 27.94% • https://www.team-cymru.org/Services/BINFeed/ -for banks and financial institutions, showing if malicious traffic or leaked data on the Dark Nets contains any data related to that specific bank (must be your bank, you cannot monitor 3rd party organizations). Getting to know the Cyber Underground Being updated on recent news is just one piece of the puzzle. You should at least know how the underground world looks like, how the underground economy operates, what kind of information they buy/sell, what is the price of the ‘services’ being sold, among many others. As soon as you understand all of the above you might get a little bit scared – but this is an important part of your knowledge of your enemy and one of the first steps in building adequate defenses. Rule: never visit underground cyber-crime websites / communities from work. Never do it using an unprotected desktop or via an unprotected network – a VPN service is a must and a minimum. Use hardened sandboxed browsers and / or virtualized operating systems. Most of the underground communities operate in closed forums and in the Tor network under domains ending with .onion – which are only accessible if you are on the Tor network as well. There are TOR search engines and other sites – if you get creative with your searches you will surely find what you’re looking for. Hint: criminals operate with digital and non-digital goods – finding a digital marketplace for one usually leads to a seller selling the other. Below you will find an excerpt from such an online forum, where a ‘seller’ is offering their ‘goods’ in the open. The excerpt is provided so you would get a glimpse of the prices and products being offered and the way they’re being offered. - I'm is Professional seller,more than 5 and half years experience,i have sold cvv credit card to many customers all over the world. Selling cvv, fullz many country as: Canada,USA,Australia,UK...all And many country in Europe: Fr,Ger,Spain,Ita...I hope we will work together for a long time. - Always sell cvv quality with high balance. I have a website but if you want buy cvv good price please contact me. Contact me: number: xxxredactedxx {pls just text,dont want my phone ringing everywhere} - Mail: xxxredactedxx@gmail.com Page 32 of 112 ________ CCV !! CCN _______ - Ireland = 20$ per 1 (fullz info = 35$) List cc and my price.. - Mexico = 15$ per 1 (fullz info = 30$) - Us (Visa,Master) = 5$ per 1 - Asia = 15$ per 1 (fullz info = 30$) - Us (Amex,Dis) = 6$ per 1 __i Only Exchange WU to PM , WU to WMZ__ - Us Bin 10$ , US Dob 15$ - Us fullz info = 25$ per 1 -------------------------------- Uk (Visa,Master) = 10$ per 1 - Uk (Amex,Dis) = 15$ per 1 - Uk Bin 15$ , UK Dob 20$ - Uk fullz info = 30$ per 1 -------------------------------- Ca (Visa,Master) = 15$ per 1 - Ca (Amex,Dis) = 20$ per 1 - Ca Bin 15$ , CA Dob 20$ - Ca fullz info = 30$ per 1 - 100$ WU = 100$ PM - 200$ WU = 200$ PM - 100$ WU = 110$ WMZ - 200$ WU = 210$ WMZ ____ Do WU transfer ___ - 700$ for MTCN 8000$ - 550$ for MTCN 6000$ - 400$ for MTCN 4000$ - 200$ for MTCN 1500$ __ Bank Logins Prices US UK CA AU EU _____ -------------------------------- . Bank Us : ( Bank america,HALIFAX,BOA,CHASE,Wells - Au (Visa,Master) = 15$ per 1 Fargo...) - Au (Amex,Dis) = 20$ per 1 . Balance 3000$ = 150$ - Au Bin 17$ , AU Dob 25$ . Balance 5000$ = 250$ - Au fullz info = 30$ per 1 . Balance 8000$ = 400$ -------------------------------- . Balance 12000$ = 600$ - Eu (Visa,Master) = 20$ per 1 . Balance 15000$ = 800$ - Eu (Amex,Dis) = 23$ per 1 . Balance 20000$ = 1000$ - Eu Bin 25$ , AU Dob 30$ Bank UK : TSB,BARCLAYS,Standard - Eu fullz info = 40$ per 1 -------------------------------- RDP = 20$ - SMTP = 25$ ( All Country ) - Italy = 20$ per 1 (fullz info = 35$) - Spain = 20$ per 1 (fullz info = 35$) - Denmark = 25$ per1 (fullz info = 35$) ( of LLOYDS Chartered,HSBC...) . Balance 5000 GBP = 300$ . Balance 12000 GBP = 600$ . Balance 16000 GBP = 700$ . Balance 20000 GBP = 1000$ . Balance 30000 GBP = 1200$ - Sweden = 20$ per 1 (fullz info = 35$) __________________ PayPal _______________________ - France = 20$ per 1 (fullz info = 35$) = Account Paypal 1500$ = 200$ - Germany = 20$ per 1 (fullz info = 35$) = Account Paypal 2500$ = 250$ account = Account Paypal 4000$ = 350$ - Dumps,Tracks 1&2 Eu = 110$ per 1 = Account Paypal 7000$ = 550$ -Sample Dump + Pin: _____________ Dumps track 1 track 2 with pin _____________ Track1 B4096663104697113^FORANTO/CHRI STOPHER - Dumps,Tracks 1&2 Us = 70$ per 1 - Dumps,Tracks 1&2 Uk = 80$ per 1 : M^09061012735200521000000 , - Dumps,Tracks 1&2 Ca = 100$ per 1 Track2 : 4096663104697113=0906101273525 21 - Dumps,Tracks 1&2 Au = 100$ per 1 Pin : 1783 ___________________________________________________________ -WARRANTY time is 10 HOURS. Any cvv purchase over 10 hours can not warranty. If you buy over 30 cvvs, i will sell for you best price. I will discount for you if you are reseller or you order everyday many on the next day. I will prove to you that I am the best sellers. And make sure you will enjoy doing business with me. I accept PM (Perfect money) ,WU (western union) , WMZ (webmoney) orMoneyGram... You can see everything being sold underground. For example, this recent 0-day exploit: If it’s not clearly visible on the image above: this is the MS15-034 Microsoft IIS Remote code execution exploit, sold for 517 Bitcoins, or roughly $121 000 at the time of this writing. On the side-bar of the image you could see 4 other 0-day exploits being sold, along with 1 1Day private exploit. Page 34 of 112 Considering the money which could be made having this exploit and being able to remotely execute code on almost all IIS installations globally this price is peanuts compared with the return on investment for whoever buys it. To gain a glimpse into this world, just download the Tor browser from here: https://www.torproject.org/projects/torbrowser.html.en Once done, you will be able to access all Tor resources and browse privately and of course, will be able to see all Tor hidden service websites, such as this underground search engine: http://grams7enufi7jmdl.onion If you search for “private exploit” the search engine returns 417 results at the time of this writing. This is no Google and the results are not as reliable – some are for underground guides on hacking ATMs, others on cashing out stolen credit cards, selling guns, drugs and all the likes you would see on a criminal market place. Recently (well, more than 2 years ago) criminals started using the I2P (https://geti2p.net/en/) network for their operations as well. Installing the client and getting around in the network gill give you some idea of what to expect – data from your organization may be extracted towards tor or i2p networks – you must be prepared, recognize and control this traffic coming in/out of your network. The closed communities are usually forums with a pre-approved list of members – you could only enter if you are invited by a member. Some of them offer paid membership. Just remember that in some countries even accessing such a forum might get you in trouble with the law and be informed of the local laws before even attempting to visit them. Some underground communities operate using the SILC protocol – which is similar to IRC in operation but much better protected from snooping. Some still operate on IRC though – and you will still find plenty of criminals communicating via IRC. If you are not new in this field you should have plenty of experience in communicating this way. If you are new – and we should accept the fact that there are youngsters who have never even used this protocol – start with the program called NetTalk - http://www.ntalk.de/Nettalk/en/ - as it is one of the few free and feature rich applications for Windows for that purpose – and work your way through it. Useful channels to join on the FreeNode network are ##security and #linux. A word of advice: do NOT start talking when you join an IRC channel. Spend a few hours reading how others communicate and follow their example. Do not start messaging random people. Be polite and people will help you with your questions. Once you get used to the IRC channels on FreeNode you will be able to explore the deeper web and join other networks and other channels – just keep quiet and listen as a rule – criminals will sniff you in a second as soon as you start talking and you will be kicked out and banned in no time. Knowing foreign languages or using Google Translate efficiently will help as well. I am not willing to share links to underground criminal sites here for various reasons – but simple searches should serve you well, just imagine what would they be willing to sell and how would they “market” their services online – it’s easy. Note: it is a good idea to block unauthorized VPNs, encrypted channels, IRC/SILC and / or TOR at the firewall level, both egress and ingress. Page 35 of 112 Encrypted connections originating inside your network and connecting to the outside must exist only on a whitelist basis and preferably connect only to whitelisted addresses. Building your own intelligence of the attackers going after your organization Here’s a working idea. Set up a set of fake personas supposedly working for your company. Do it with all the social indicators – Facebook, Twitter, LinkedIn profiles, e-mail addresses and active e-mail boxes, presentations containing their names and e-mails, comments – the whole thing. Once ready, set up a set of physical boxes (so malware would not distinguish them as honeypots or virtual boxes) utilizing the corporate image used for all other computers – but do NOT connect them to the corporate network. Instead, connect them to a honeynet – where your honeypots will capture any additional malicious activity. Note: don’t focus on VIP only. Attackers often target their personal assistants / team members – as such, you would benefit greatly if you create such accounts and such boxes, containing the appropriate fake documents, fake e-mails, etc. Create a set of pages on your website accessible only in the case of an attacker profiling your organization – not linked from anywhere else but from the set of fake documents you have published for your fake personas. Carefully log all accesses to these web pages and act immediately on containing the treat from these adversaries – or to begin monitoring closely any related activity. Make sure Google and other search engines are forbidden access to these pages based on user agent / other indicators – think about blocking crawling in robots.txt but keep in mind this measure is a double-edged sword – it makes it too easy to spot your fake pages and their purpose and you will have lots of fake positives if non-compliant search engine start crawling based on your robots.txt file. On the fake boxes themselves, regularly open the arriving e-mails and their attachments in a controlled manner. Establish complex sandboxes and monitoring solutions to capture every kind of system and network activity. Have swift roll-back systems in place (system image restoration or freeze/unfreeze time-machine like solutions). Have all attachments sent analyzed by a malware analyst / reverse engineer – or at least do basic static analysis if you don’t have the personnel. NEVER! run any of the attachments / executables in Virustotal or other public sandboxes – if the attacker is half-advanced they will immediately spot that they’ve been detected – and will make your life much more difficult by changing / improving their behavior. Documenting your findings I highly recommend using tools such as Maltego (and / or CaseFile) and CherryTree https://www.paterva.com/web6/products/download.php and http://www.giuspen.com/cherrytree/ These tools allow for the creation of structured information lists and it is tremendously helpful in visualizing links between elements and their meaning and preparing a final report based on your findings. Page 36 of 112 Your role as the guardian and infosec mentor in your organization Your role as CISO (or whatever the title is, the infosec officer of your company) in every security project is to ensure a constant, smooth transition to a more secure state, maintaining the usability and effectiveness of all business processes. It is not that of an enforcer or a policeman – but rather that of a mentor and correction guide when such is needed. Forget about mail and spreadsheets when it comes to convincing people and executives about what is better for the organization. Forget about FUD (fear, uncertainty and doubt) methods – they usually create more resistance than you need and are really negative in the long term. A positive note with a clear visibility of the benefits and decreased risks along with a solid evidence of the necessity of any measure you propose will always win against a “the sky is falling” approach. Communicating with senior executives Every idea you have which has the potential to impact the whole organization (in any way – positive or negative on success or failure) will have to be discussed with your boss and other senior executives in the organization. Make sure you do your homework before speaking with them. Have with you examples of successful implementations of the same or similar ideas in the companies of your competitors (not necessarily in the same country). Prepare the list of people who will need to be involved, the amount of time your project is going to take from their working hours and the list of other resources needed – keep in mind the license cost is not always the highest cost a project can incur on your company. Have a list of alternatives, with the respective cost and consequences of each choice. Make sure what you say and explain is done in their language – that of investment and return on investment. Remember, your company exists to create profits, not to implement all the new security technologies in town. Make sure to discuss your ideas with your direct manager and your team before presenting them to senior execs. Have a good vision of the threats (current and incoming) to your business and the benefits to mitigate those threats and risks with the suggestion / idea / product you have in mind. Once you are ready with all of the above, comes the difficult part: create a one or maximum two page summary of everything, explained in a clear way. These 2 pages of text are sometimes your only chance of making a positive security change in your organization, so use them wisely and show them to your direct manager before speaking with higher levels. Page 37 of 112 Once in the meeting, speak clearly, calmly and let them ask their questions – if your homework is done properly, you will be prepared for all of them and will walk out of the meeting with the feeling you have left your management calm and confident in your ability to protect their business. You are not there to cause panic – you are there to guard and protect. Communicating with IT Now… that is a whole different animal to deal with. People in IT often have the mindset of “this cannot be done” – think of it as their defense from accepting more work in their already way too busy schedules. Always try to walk in their shoes before suggesting new things and always try discussing it with several people in the IT team (including their management) over a cup of coffee or during a lunch break. It is much better to hear their side of the story before presenting yours – besides, it is a psychological thing – you need to work with them, not pour work on them and expect them to just deal with it. You will be surprised how much helpful advice you will get from your IT team and how much easier it will become working with them the moment you start collaborating with them in the above way. Instead of “you have to do this task” you could approach them with “can you help me with ideas how to properly implement this task?” See? Much better! Creating a step-by-step plan You don’t have to create it alone – you can even engage one of the IT team members to help you, with the approval of their manager – in that case you get even more bonus points and an even greater chance of success. Every security change in the IT environment needs to be properly tested on small scale. The results of this test will help in the implementation of a larger test. Rinse and repeat until the whole company is transitioned to the new product, technology, configuration change or whatever else you’re implementing. Hint: it is a good idea to start any configuration change tests in the IT team – that way you can easily tweak settings and discuss them directly with the implementers who will also be the people affected – much more effective. Communicating with everybody else There are two ways you can be seen in your organization. The first is the one who always enforces unbearable burden upon people, and the second is the one who does their best in order to help people do their job safely and effectively. Which one do you choose? Now think about this every time you write an awareness e-mail or choose an awareness poster. Positive is better than negative – remember it. There have been multiple psychological studies proving the effectiveness of a positive message over a negative one. Page 38 of 112 I highly recommend reading the following book: “Usable Security: History, Themes, and Challenges” – as it will forever change the way you try to get your message across. Not only that – it will teach you that complex and difficult is usually less secure than simple and easy to use. It will change the way you approach security forever. Building a squad of brave defenders 2 quotes from Sun Tzu: “Attack is the secret of defense; defense is the planning of an attack.” “Invincibility lies in the defense; the possibility of victory in the attack” You need a team built at least partially of people who have had cyber-attack experience, preferably penetration testing and / or a past in the criminal underground. Degrees and certifications have little to no value whatsoever when your opponents play on a different level. While your ‘educated’ paper tigers build diagrams and battle with excel, your attackers are mapping your entire infrastructure and human workforce, trying to find the easiest way in. You need at least someone on your team who would have an idea who is out there and how your organization could try and stop them. Building a team starts with finding the right individual elements for it and if I could sum up the whole chapter into one sentence, it would be “Hire for passion”, adding one more word: discipline. The kind of passion which is visible throughout the career or personal development path of an individual – in their favorite projects, tools, participation in events, courses taken, projects completed, achievements, favorite books, the focus of their studies. Any skill for any job can be learned and trained within reasonable amounts of time, granted the person is smart and motivated. But passion for a specific field is hardly learned – it is either there or it isn’t. Coupled with discipline, passion generates tremendous results in the mind of an individual and as a result in their professional and personal life. How do you recognize passion? Look beyond the recognizable certifications on their resume. Ask them when they’ve first gotten interested in security, what has drawn them towards it, what keeps them interested and how do they see the state of information security in the world in 5 years. Look for understanding beyond mere knowledge of facts. Recognizing discipline Discipline is easy to notice. From the first glance at someone you could see if they’re disciplined or not – their dress code, haircut, hygiene, manner of communication, to their resume, their past life experiences, education (where self-motivated learning gains more points than a degree). Give them a practical task to complete Always give tasks right there during the first conversation with the candidate. You don’t have to waste your and their time in asking about their greatest weaknesses or their hobbies – going straight to the point first will allow you to filter out quicker and help unfit candidates find their matching job faster. Page 39 of 112 Don’t just focus on technical or programming tasks – try and give them real life business problems to solve. Look for the way they solve problems – do they introduce even more business obstacles by suggesting impractical and difficult, exotic solutions? This way of thinking is very difficult to change and you should avoid people who behave in this way. Even if they don’t have the answer or solution it is very important how they will approach solving the problem. Being startled and puzzled is one thing, starting thinking logically and seeking multiple solutions is better. If the candidate puts business first and builds their secure solution around that, you’ve got a hit. Have a baseline Have a list of questions, defining the baseline which would eliminate those who are unable to answer them. For example, not being able to differentiate between a hash and an encoded string or explain the difference would mean the interview stops then and there with no further questions, no matter what level you’re hiring for. Have a list of funny questions Why not ask what is the difference between Chuck Norris and Bruce Schneier? If they laugh, you’ve got a hit. If they look puzzled and don’t recognize the second name, it is probably a good time to ring someone else. Their favorite books Any professional who is serious about their job reads books on the topic all the time. Their complete infosec reading list should be huge if they’re over 30 – and if they’re 20-something, it should be at least 10 books long with at least 2-3 favorite classics, one of which should definitely be “The Art of War”. Generally I would not hire anyone who does not read – not necessarily only security-related books, but books in general are incredibly important. I’ve heard people saying that books are overrated and they get all their information from blogs – no comment on that. Building the team itself This is probably the most difficult task – as interpersonal relationships are sometimes very tricky and seemingly perfect candidates for different job roles might be completely personally incompatible. Mature people work together ignoring their personal differences, while the young and inexperienced generally tend to participate in conflicts. Having this in mind, look for team members with life experience – even though the term is hard to define, you most likely understand what I mean. People who are able to express themselves well also tend to be good team players, but don’t forget that sometimes introverts who prefer being left alone can be extremely productive, too. Team building events are extremely important – not just going out, but giving the whole team tasks such as working on the new firewall design every day of a week for an hour builds a collaboration environment, at the same time showing weak spots and opportunities for improvement in the team relationships. The checklist Years ago I created a ‘checklist’ for hiring infosec professionals – which does just that. It checks for specific signs of passion for the infosec field. Yes, it does not apply to everybody and yes, it is not a measuring stick to compare against every single hire you are going to make – but you could use at least some of the questions in it to gauge someone’s involvement in the field. Page 40 of 112 Some points in the checklist might seem very irrelevant or silly – but please remember they are there for a reason. For example, the nickname ‘muts’ would be recognizable to anyone who has worked with the Auditor, later BackTrack, later Kali – linux distribution for a number of years. Recognizing this nickname means that the person has been active on IRC in those early years – and participating in IRC while working with security tools at the same time means being a part of the community, knowing people in that community on a level which is beyond ‘connecting on LinkedIn’ and reading blog posts of famous authors. That is why this point is there – the same applies to the other points in this checklist. This specific point is applicable for penetration testers and security auditors and is not applicable for forensic specialists, for example. That is why you should only apply the questions which are relevant to the position you’re hiring for and for which you understand the underlying reasons. It is a very tricky checklist, I understand that – but it is at the same time valuable in finding people passionate for the infosec field. INFORMATION SECURITY PROFESSIONAL HIRING CHECKLIST AND SCORES This checklist can successfully determine the real-life applied skills of an information security professional beyond the regular, standard questions asked at an interview. This checklist is “cheat-proof” as there are no online interview questionnaires containing any of these questions. The value of each question is in the meta-knowledge supposedly existing if answered positively. You can use it as a pre-screening tool – anyone who cannot get to the passing score (which is 50%) should never be hired in the Information Security Field. Any technical skill can be learned in a limited amount of time – becoming a part of the infosec community and breathing security is not learnable – this is what this checklist “checks” for. NAME RECOGNITION AND COMMUNITY COLLABORATION 1. 2. 3. 4. 5. 6. Bruce Schneier 1.1. Knows who he is – 1 point (famous cryptographer, security and privacy expert, security author) 1.2. Knows the title of at least one book written by him – 1 point 1.3. Has read at least one book by him – 3 points 1.4. Can name at least one “Bruce Schneier Fact”, or at least the meaning of the phrase – 3 points (http://www.schneierfacts.com/, a humorous fan site dedicated to Bruce depicting him as Chuck Norris – an example is “Bruce Schneier's secure handshake is so strong, you won't be able to exchange keys with anyone else for days.”) HDM (H.D. Moore) 2.1. Knows who he is – 1 point 2.2. Has spoken / interacted with HDM at least once in his life (virtually or live) – 1 point 2.3. Has used Metasploit and can describe how Metasploit works – 3 points Knows who is the author of S.E.T., Social Engineering Toolkit – 3 points Knows who Joanna Rutkowska is – 3 points Knows which IRC channels to use to reach the infosec professionals who present regularly at DefCon, BlackHat, BruCon, CCC, etc. conferences – 5 points Recognizes the company “Offensive Security” and knows what it does (created the Kali (BackTrack) distribution, runs the Offensive Security training courses” – 3 points 7. Knows who “muts” is (Mati Aharoni) and where to find him (creator of Offensive Security, can find him on IRC) – 3 points BOOKS 1. 2. Has read 2600 – 3 points Has read “Stealing the network…” series of 3 books – 3 points Page 41 of 112 3. 4. Has read “Aggressive Network Self-Defense” – 6 points Has read at least one book by Kevin Mitnick – 1 point 5. Has read “The Art of War” by Sun Tzu – 6 points PRACTICAL SECURITY SKILLS 1. 2. 3. Has ever penetrated (or “knows a friend who did it”) a network / computer system – 10 points Has helped a company suffering from an ongoing attack, securing it from further hacking attempts – 10 points Has collaborated in the international infosec scene, creating tools, helping with bug hunting, overall helping the community – 5 points 4. Has created and / or analyzed viruses / malware / exploits – depending on the motivation – 25 points if done for educational purposes or -25 points (minus 25 points) if creating exploits irresponsibly, publishing them before they get patched (be careful not to disclose the purpose of the question during the interview). PRACTICAL KNOWLEDGE 1. Knows the difference between BIND and DJBDNS – can name which one is more secure and why – 10 points (The answer is DJBDNS – if he/she knows which one, they will know why, as well) 2. Can name the most secure Operating System (Integrity OS), can name the open-source alternative by level of security (The O.S. created by Joanna Rutkowska – Qubes OS) – 10 points 3. Can name at least one sandboxing application (Sandboxie, Invincea or Bufferzone Pro, etc) – 10 points MINIMUM PASSING SCORES Name recognition and community collaboration – 15 points Books – 10 points Practical Security Skills – 25 points Practical Knowledge – 10 points Total minimum passing score: 60 points Page 42 of 112 Information Security Awareness Learning the art of communicating your message across is very important before you begin distributing your information security awareness ideas. Image credit: this image was found on a social media, I’m glad there is a signature, but the author is unknown to me The image above is an excellent illustration of why information security awareness training is important. But not trying to shove EVERYTHING in one go of 1-2 hours or even a full day – but constant and frequent small doses of information delivered in a way similar to the image above. It is a good idea to not embark training anyone before reading at least 2 books on social engineering (plus all of the novels mentioned in an earlier chapter) and a couple of books by Dale Carnegie (for example, “How to Win Friends & Influence People”). Then just search Amazon (or your favorite bookstore) for “Security Awareness” – and with that combination of knowledge go and create the security awareness program in your company – it will be successful. It is easier to purchase posters and training materials from vendors, but their effectiveness if you’re not well prepared to deliver the message properly will be close to zero. The investment will not be worth it – unless all you’re after is a checkbox in an audit report. But if you do read the books and learn how to positively influence people – things will dramatically change for the better for you and your organization. Page 43 of 112 Then the posters and e-mails you use, the meetings and every conversation you have with every employee who has accidentally slipped for a phishing message will deliver an effective result. When you actually know what you’re talking about you can give very good examples and people will believe you and will understand you. Remember: if you don’t believe and deeply understand your message nobody else will. When ready, you could search for online / offline video courses for your colleagues. So far the best one I’ve found is developed by IASE DISA (Defense Information Systems Agency), located here: http://iatraining.disa.mil/eta/cyberchallenge/launchpage.htm This is the standard you should be aiming for and I sincerely hope it stays online and accessible for everyone for longer. At one of the companies I worked for, the Security Awareness training was mandatory for all new hires. It was almost 2 hours long, very detailed, very… boring. Guess what people did? They clicked the Next button on every slide without even listening to what the videos had to say. At the end, they got a “passed” grade. Please don’t do this, it’s utterly useless. It is not only useless – it is dangerous. If your security awareness program is as boring or passing it is as easily fake-able, you are in a situation worse than if you had no security awareness training at all. Conducting interviews in person with random difficult questions about the material they just watched is one good control – asking them to write 30-60 word descriptions of every topic they just ‘passed’ on the training instead of giving them a-b-c-d style questions is another good control. That means you would have to review the answers – but consider this as your own visibility into the infosec awareness of your colleagues. If you’re a techie, you could even go to lengths of developing your own ‘challenges’. Here is a nice exercise you can perform once in a while. Prepare a .bat file with scary colors and blinking “You have been hacked” or something of the sort. Compile it to .exe. With a resource editor, add a Word or PDF icon to it. Give it a believable (very long, to hide the extension) name. Zip it and send it in a business-style e-mail. Then explain to the victims specifically and to everyone else how to check for viruses in e-mail attachments, how to check file extensions prior to opening, how to upload to virustotal, etc. It is very important for you to explain to your fellow coworkers how to recognize suspicious e-mails, how to recognize suspicious links, websites, how to check a link without opening it (for example by pasting it on VirusTotal), etc. They should know how to check the real extension of a file and why a file with a double extension malicious in 99.999% of the cases. These are simple and essential skills which are easy to show, teach and remember. Users should also remember to send any suspicious files to the IT Security / Incident Response team for analysis instead of just deleting them. You should be able to build the infrastructure to support these activities – as moving files via e-mail is dangerous, a simple web form with a file upload box will do an excellent job. Page 44 of 112 On Enterprise Password / Credential management Credential management is a mess at many organizations. Even though password changes are (in the best case scenario) enforced, this is done without understanding of the underlying risks and concepts. Password complexity is being set without understanding or taking into account the psychological constraints preventing people from remembering such passwords – which automatically leads to people writing them down or otherwise bypassing the purpose of setting complex, frequently changed passwords. In relation to the above, I just love this XKCD comic: https://xkcd.com/936/ It explains the idea pretty well: people don’t understand complex passwords and complex passwords are not necessarily more secure. INFOSEC professionals need to understand that more complex does not equal more secure. More usable and reasonably secure is much better. Helping people remember passwords or providing them with additional usable forms of authentication is important. This is especially valid for system administration personnel, who need to remember dozens if not hundreds of passwords for all kinds of enterprise systems. Page 45 of 112 If you do not provide them with a well maintained, usable and secure system to manage the different passwords for all the servers and devices they manage – people will always reuse passwords. It is inevitable. The idea of using a sentence (with the spaces) has surprised many of my non-technical friends in its effectiveness in terms of memorization and security. Also… why do you really need to change a password every month / 3? Do you really think that forcing people to change their passwords every one or three months is making their passwords more secure? It is the opposite. At some point people start writing them down or using very insecure and easy to guess changing patterns, such as adding a digit and rotating from 1 to 12 through each month of the year… please stop this practice, it’s dangerous. A well-chosen password changed every 6 to 12 months is more secure than an easy to guess pattern changed every month. That is why using an enterprise-level password management application essential. One example of such software is PasswordState - http://www.clickstudios.com.au/ Web-based, well integrating with Active Directory – one could not ask for much more. Look for wellmaintained and frequently updated password management systems, evaluate, test – you know how the process works. Page 46 of 112 Building a secure operating environment In a recent report, the Australian Department of Defense states that 85% of the targeted breaches could have been prevented by implementing just 4 controls (http://www.asd.gov.au/infosec/mitigationstrategies.htm). Quoting the report: At least 85% of the targeted cyber intrusions that the Australian Signals Directorate (ASD) responds to could be prevented by following the Top 4 mitigation strategies listed in our Strategies to Mitigate Targeted Cyber Intrusions: use application whitelisting to help prevent malicious software and unapproved programs from running patch applications such as Java, PDF viewers, Flash, web browsers and Microsoft Office patch operating system vulnerabilities restrict administrative privileges to operating systems and applications based on user duties. And that is exactly what this book is focused on, with some additional measures, which should help you mitigate up to … I will be bold and say 98% of the attacks you might encounter. It is essential to properly harden the nodes in your network – servers and endpoints. The stricter the policies on what can be used, how and where – the more difficult would it be to introduce a malicious element and disrupt your operations security. Establish some ground rules, the first and foremost of which should be performing everyday tasks on any OS as a limited account. This applies to all users but especially and primarily for IT administrators. Policies should be set to prevent the execution and installation of unknown executables / software when running with a limited account. And when running as an admin, the administrative user should be barred from accessing the Internet on the proxy level. There should be NO EXCEPTIONS to the above rule, no matter how much riots and complaints you receive – I can confirm from experience that IT Admins can used to working this way and they do used to it – after time, they not only accept it – but if you do your job and explain the reasons properly, they will enforce it upon their non-compliant and rebellious peers. The reason for this is contradictory, but nevertheless real. The users with admin power are considered knowledgeable and experienced – that is why they got administrative rights in the first place, right? Wrong. Often administrators are overconfident and browse the internet as admins with no clue of the risks in the simple act of browsing. Then some of them download applications ‘to make their life easier’, as a result introducing malicious software into the company. Hence, the need to restrict internet access for administrative accounts and the need for administrators to work as limited users. If they need to download and execute something, they can download it as a limited account and execute as administrator. Rule number two: no external devices allowed whatsoever, except company-issued ones, encrypted and allowed by Device ID, mapped to a user ID. Connecting a smartphone or tablet to a corporate laptop for file transfer should be impossible. Page 47 of 112 Code execution from external devices should be forbidden by policy. Copying executable files from an external device to the local drive should be immediately detected, if allowed at all – and an alert should be sent to the IT administrative team if that happens, followed by the creation of a security incident. Disabling AutoPlay/AutoRun should be a no-brainer and supposedly implemented a long time ago. Rule Number 3: every user’s “My Documents” folder should be located on a network share, if possible. The purpose of this effort is to enable centralized backup (unless you have other solutions in place) and prevent the “Sony Disaster”, in case your organization is attacked by destructive / encrypting malware. If this happens, you should have a backup to quickly restore the encrypted files to their original versions. Rule Number 4: backup *everything* you can, as often as you can. Rule Number 5: This one is more of a recommendation – but if you can, build a clone of a standard desktop machine, ready to be logged on to and having auto-configuring mail client, etc – based on the user account logged on. Have that one deployed on Amazon or another cloud vendor – ready to be cloned to as many copies as you need in the event of a disaster. Do the same for critical servers. If your organization is hit by a disaster, you will be able to quickly power on and run from the cloud. Having powered-down copies of virtual machines in the cloud, ready to be cloned and powered on is extremely cheap compared to maintaining a cold, warm or hot site with physical machines. Removing perimeter security is safe for a cyber fortress In December 2014 Google published a paper titled “BeyondCorp: A New Approach to Enterprise Security”. This paper put in words what the community has been saying for years – namely, that perimeter security is obsolete. Endpoints should not depend on an external entity for their protection – nor should enterprise applications and services. Each one of them should behave and be protected as if connected directly to the Internet – and their underlying security principles should reflect that. The paper is located here http://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/43231.pdf and it has an accompanying video description (a must: https://www.usenix.org/conference/lisa13/enterprise-architecture-beyond-perimeter plus https://www.usenix.org/conference/lisa13/managing-macs-google-scale) Google, being a pioneer in security, made a huge step forward towards this concept and made their enterprise applications public. But do not get confused – they made it right. Their act of removing the perimeter defenses was preceded by carefully planning and turning the infrastructure inside out – protecting the applications and users from external threats by limiting access to the applications and services only to authorized users and devices. An interesting consequence is the lack of a need to use a VPN when accessing corporate resources – if the request to access a resource can be identified to belong to an active employee and is performed from a secured, corporate device – the connection established will be encrypted by default and the need for VPNs disappears. This is one of the most important and at the same time, the shortest chapter in this book – simply because all I would like to share with you on this topic is in the link to the Google paper. Page 48 of 112 Defending against web-based attacks The most widely used vector of attack against your endpoints is and in the near future will continue to be the World Wide Web. Attacks might come from a compromised advertisement provider (malvertising), from a compromised website (as in the case of forbes.com), from a website created specifically for that purpose (on a fast-flux domain algo or manually) – in any case you will need solid defense. It is especially challenging to defend against these attacks as they are in essence generated and initiated by your own users – an actor located on the web cannot act unless in response to an action of an internal user (or in other words, there has to be a GET or POST request originating on the inside of your network for the attack to be successful). There are 2 objectives to pursue in order to achieve solid defense: 1. 2. Protecting from malicious traffic before it reaches the endpoint Protecting the Endpoint Objective N1 is achieved by the proper choice of a web filtering (proxy) solution, its proper configuration and maintenance. There must be a dashboard (or several rotating ones) displaying the web filter statistics in the IT / IT Security team room, showing traffic spikes, traffic anomalies, number of blocked sites per host/total, egress/ingress traffic, etc. The following chapter will be focused on choosing and setting up a web filter properly, as well as configuring and maintaining it. Your web filter appliance is a crucial point in the security posture of the organization and it might become an invaluable tool if used optimally. The chapter following the web filter will focus on Objective N2 – protecting the endpoint from webbased attacks, specifically choosing and configuring a browser, hardening it and preventing common exploitation techniques. These 2 chapters should become the foundation of your defense mechanisms, building upon them will be essential. For example, you could improve the web filter chapter in your own organization by adding additional layers of defense – integrating the web filter with an advanced threat intelligence solution such as FireEye or TrendMicro – especially if the solutions of these companies are placed in front and block / prevent any malicious traffic before it reaches your proxy and your end users. When configuring your web proxy remember that a large amount of incidents come from insiders sending documents to their own mailboxes and web-based file hosting services such as Mega, Google Drive, Dropbox, Box.net, etc. That is why the option to block POST requests unless pre-approved per user / website is so important (will be explained later). Setting up and configuring a DLP (data leakage prevention) solution is outside the scope of this book – but is surely an important point to consider. Page 49 of 112 Choosing and properly configuring a Web Proxy / Web Filter The WWW (Word Wide Web), or the Internet, is the most widely used vector of attack targeting your users directly, in a way opening a tunnel from the attacker to your endpoints through all your defenses. That is why choosing your web-filter wisely is of utmost importance. The presentations which sales engineers perform are attractive and interesting but most times they don’t understand the threats you are facing and rarely can offer a complete solution – very few are the vendors which can cover most bases in the checklist below. Whitelisting is no longer the ‘too difficult to achieve’ methodology of keeping your users secure. It is not even the high target – it has become the minimum norm, as even whitelisted sites get compromised and you have to think how to defend against that, focus on this, rather than spread your attention on defending your users from millions of potential attack vectors by blacklisting known bad sites. Actually it is much tougher to deal with the consequences of constant breaches and exploitation due to malvertising / exploit packs on hacked sites / phishing sites than maintaining a whitelist. Please don’t hide your head in the sand and implement a whitelisting policy – it is very difficult initially but it does pay off tremendously in terms of protection. A simple ‘statistical run’, building a baseline of the most visited sites in a month, followed by an assessment which ones are safe and business-focused will give you a good list of sites to whitelist. Then just move further down the funnel, reviewing requests to add sites as they come in. Evaluating a web filter before purchasing the product / service Out of the hundreds of features / capabilities you could look for in a web filtering appliance you should focus on the following: 1. Support – when you attend the first technical sales presentation have a list of difficult questions based on your past experience / needs. Look for the confidence and speed you receive answers with – if you keep getting the ‘we will get back to you on that’ – expect worse support in the future. Actually, always expect worse support than what you’ll get during the technical sales meetings – and base your assessment on that. Support should be able to modify settings on the fly and when needed, even tweak undocumented features. When you get promised a feature ‘which is being worked on’ – demand the exact stage at which the feature development is and demand hard dates for implementation with financial penalties if the promise is broken – if they were honest when promising it, it would not be a problem for them. 2. The ability for users to request the unblocking of a web resource right on the page where it says “blocked”, which would then be entered in a database allowing the admin to quickly and easily check / uncheck requests. It is very important to avoid e-mail notifications on a blocked site unblock request and only focus on products which offer seamless integration of that page with the back-end administrative system. 3. Demand a demonstration of the web filter ability to filter malicious pages – with malicious javascript on them, for example. Find new malicious URLs – for example, from http://www.malwaredomainlist.com/mdl.php - and TEST the newest entries there right during the sales demonstration to test the ability of the solution to ‘think on the fly’ without relying on a database of known bad hosts. This is very, very important. Page 50 of 112 4. The ability to block executables within archives for certain users / groups - The reason behind this requirement: only system admins / designated personnel should be able to download executables or executables within archives. All other users should be denied this right – and you should have a formal process to allow employees to request a download of a certain executable, for which a request should be filed and which request should go through a security review process. No executable should enter your network without proper authorization and risk assessment. 5. The ability to detect mismatching MIME types and block them (executable with a .jpg extension, for example). 6. Ability to block downloads from untrusted (non-whitelisted sites). 7. Ability to block advertisement networks and ads. Very important. 8. Ability to block POST requests larger than X bytes for all sites except a list of users, accessing a list (whitelist) of allowed websites. - this requirement effectively prevents data exfiltration and / or phishing. If you block ALL post requests except a list of whitelisted sites for a list of users (a user should request access to submit POST requests to a specific site and every request should be pre-approved). 9. Ability to block websites based on reputation and age. You should NOT!!!! Allow access to any website younger than 1 month and having no reputation or classification in the web filter database. 10. Ability to block encrypted sessions to IP addresses and URLs not present on a pre-approved list. This is obvious – only pre-approved sites and hosts should be able to establish encrypted sessions with your endpoints. 11. Ability to block based on regular expressions 12. Ability to integrate 3rd party AV engines - this requirement allows for the use of multiple AV engines at once, as opposed to a single AV engine. 13. Ability to integrate with the mobile devices managed by your company. 14. SSL inspection should be on by default. There should be a capability of raising an alert on first SSL connection to a non-SSL whitelisted (allowed) host. SSL whitelisting should be possible. This is a very short list – but a very important one. The final list you should be going to vendors with should include several times as big a list – just remember that many vendors might not have all of the features you request. But the above are almost mandatory. Generally no proxy connection should be possible in a ‘transparent’ mode. All devices wanting to connect through the proxy should have it manually configured, explicitly. No server or workstation on the internal network should be able to bypass the proxy and connect directly to the Internet. One additional note… ask your web proxy vendor if they can prevent data exfiltration over encrypted channels and how. If their answer is unsatisfactory, you could implement your own box for that purpose following the guide here: http://resources.sei.cmu.edu/asset_files/TechnicalNote/2013_004_001_40234.pdf Page 51 of 112 Protecting the endpoint from web-based attacks In this chapter we will focus on making it extremely difficult to deliver malicious payloads to your endpoints (focusing on workstations) from the Web. Our first priority is to block *all* ads regardless of their source (if the ad network is considered safe or not) – hopefully you have followed the previous chapter and ads are already blocked to a large degree on the web proxy level. Now is the time to block them on the endpoint level, in the browser. Block exploits and malware by blocking ad networks and ads Exploits and malware – sometimes even highly advanced ones - are distributed via ad networks and hacked websites. And while you can't control the latter even if you have a whitelist policy on your web proxy, you can control which ads are seen in your network. Malvertising The term means serving malware via ad networks. Recent news reports have proof of malware being served even on Youtube via AdSense (Google). If even Google can't control what its ad network is showing to your employees, isn't it time to do something about it yourself? From my experience at least 30% of all malware incidents in a company are generated from malicious ads. If you can decrease the malicious incidents at your company by 30% just via blocking ad networks you should. Not to mention an added benefit: better browsing experience, less tracking for your users, better privacy and last but not least – less bandwidth utilization, by as much as 5-10%! Blocking ads via browser extensions Browsers cannot block ads on their own as they can’t distinguish advertising from non-advertising elements and in order to block ads in your browser you will need an extension (which should also be easy to distribute in corporate environments, just follow your browsers manual). Many are already using ad blocking extensions on personal devices - it is time to convince management and IT to start adopting it across the board. https://adblockplus.org is readily available for most browsers out there. So far it has been the most widely adopted and the most effective measure against ads and malvertising. AdBlock, however, has a little ‘issue’ – some people say it has signed contracts with major advertising networks in order to ‘whitelist’ their ads for a certain payment… They don’t advertise this fact on their project’s website, but for me personally that means a red sign. Even though AdBlock is effective, I would use uBlock. As an alternative (some say it is much better) - you could try out https://github.com/gorhill/uBlock/wiki/%C2%B5Block-vs.-ABP:-efficiency-compared uBlock for Firefox can be found here: https://addons.mozilla.org/firefox/addon/ublock-origin/ uBlock for Chrome can be found here: https://chrome.google.com/webstore/detail/ublockorigin/cjpalhdlnbpafiamejdnhcphjbkeiagm An un-official port for the Safari browser can be found here: https://chrismatic.io/ublock/ Page 52 of 112 Advertising networks are getting smarter, just as malware writers got smarter with time – and the blacklist approach really starts to lag behind, but we should continue doing our best. Even though AV detection rates are diminishing we must use antiviruses at work. The same applies to blocking ads – even though there might be new and unknown delivery hosts every day, we should and must use ad blocking techniques all the time to prevent at least the most widely used ad distribution networks and prevent malicious code distribution in this way. Blocking ads via a HOSTS file On Linux and Windows (as well as FeeBSD, Mac OS and other operating systems) you can block ads by redirecting ad network domains to localhost. You can read more about this extremely effective technique at https://github.com/StevenBlack/hosts Use a different browser? Many of you have not heard of it, because it is produced by a Chinese company - the 360 Safe Browser. It has ad blocking built-in, besides having 3 browsing engines inside and full compatibility with Chrome extensions. One added benefit is the usage of their intelligence network and blocking known phishing / malicious websites. With 500+ million hosts as their client base the detection rate is not bad. Block redirects Often malicious scripts redirect the user from a legitimate website (hacked or not) to malicious websites using 302 redirects. This type of a redirect is crucial to the operation of the Web, but since it is not always critical to your users, I would say go ahead and disable them. I have not yet found a way to block redirects in the Chrome browser, but on my Firefox browser I use the following extension: https://addons.mozilla.org/en-US/firefox/addon/noredirect/ It works well, I am happy with it and recommend it. If you must deploy a solution for this across the enterprise, just block 302 redirects on your web proxy appliance, as that would take care of the problem company-wide. Talk to your corporate proxy administrator Your web proxy appliance (or your handy proxy admin) can should be able to block ad networks without you having to modify yours or every computer on the network. This has the added benefit of centralized management and easy troubleshooting, in case some domain needs to be unblocked. Block ads at the gateway level There is a really nice tutorial on http://www.bsdnow.tv/tutorials/dnsmasq on blocking ads using DNSMasq & Pixelserv. The setup takes less than 30 minutes and can be performed on any gateway provided they run an OS capable of running these packages. Pixelserv is used to serve 1x1 gif pixels to prevent 404 errors from the blocked ads and to enhance the user experience – otherwise you will see all kinds of nasty rendering bugs on your web pages. Note: this method does not block text ads and it is still recommended that you use some of the browser add-ons mentioned above. Besides blocking malware there are other benefits to blocking ads - less traffic and faster, safer browsing experience. After all, why would you want to load a 10 second clip of someone selling you stuff you don't want, thousands of times per day for every single employee of your company? Page 53 of 112 Deploying a secure browser in the enterprise While we are on the topic of WWW, let’s talk about a very important topic – the browser your employees are using to access the Web (and your own Intranet). It is a sad fact that many organizations are still using IE (some even avoid updating to the newer versions of it for ‘compatibility reasons’). While IE can be kept relatively secure (with ad blocking at the gateway level, emet, removing Flash, switching to a different PDF reader, implementing the proper STIG and securing its settings to the maximum level possible), it is still a good idea to replace it with something modern. Microsoft Edge is coming out with Windows 10 – but until then I recommend switching to Google Chrome. You don’t even have to re-invent the wheel for the deployment phase – NSA has already written the most comprehensive guide on a secure deployment of Google Chrome here: https://www.nsa.gov/ia/_files/app/deploying_and_securing_google_chrome_in_a_windows_enterp rise.pdf It is from 2012 and a bit outdated but the basic principles are still valid. The policy templates for deployment can be found here: https://www.chromium.org/administrators/policy-templates - specifically, https://dl.google.com/dl/edgedl/chrome/policy/policy_templates.zip If you need a detailed description of any policy mentioned in the guide or in Chrome’s about:policy, the folder above contains a help html file: policy templates\common\html\enUS\chrome_policy_list.html The ADM policy template can be imported to your domain controller or to a workstation locally. It is a very good idea to combine the NSA manual with the IASE DISA Google Chrome STIG: http://www.stigviewer.com/stig/google_chrome_current_windows/ by generating a matrix in Excel or your favorite spreadsheet application where you could map the matching / overlapping / unique configuration settings per guide and decide which ones to test and implement. Focus on the red and yellow findings in the STIG. Implementing a blacklisting/whitelisting policy in Chrome I’ll show you a very clever trick. It is recommended that you implement a whitelisting policy, which will greatly improve your security – but if that is not possible a blacklist is an option, too. Navigate to the Google section in the policy editor, find Google Chrome, in the right pane you should see a list of policy settings. Find the following 2 settings: (Block access to a list of URLs and Allow access to a list of URLs) To enable a whitelisting (only specific hosts can be reached) policy, enable both. In the Block access setting, you will see an option to show the editor box for entering new URLs to block: Page 54 of 112 For a Whitelist, block ALL websites (careful, settings apply immediately) here by entering an asterisk character and saving: * Then in the “Allow access to a list of URLs”, enter the list of URLs you want to allow (up to 1000, the rest will be ignored): In the above example, the website and all sub-domains and folders – coursera.org – will be allowed. The about:* and chrome://policy/ need to be whitelisted if you want to be able to display the current policy settings by typing about:policy in the address bar. If you don’t want to enable your users seeing the list of blocked sites (good idea to disallow that), remove the aforementioned entries. To enable just a list of blocked sites, instead of an asterisk just enter up to 1000 blocked domains. Any domains after 1000 will be ignored. Another very useful set of settings can be found in the Google Chrome > Content Settings branch. Specifically “Allow JavaScript on these sites” and the respective “Block JavaScript on these sites”. Their logic is the same as above. In “Content Settings”, the “Default plugins setting” should be as in the screen below: If Chrome is not your favorite, you can and should still refer to the IASE DISA Application Security Browser Guidance: http://iase.disa.mil/stigs/app-security/browser-guidance/Pages/index.aspx Page 55 of 112 Hardening Flash: mission (im)possible Oh, Adobe Flash, why are you so insecure. But in corporate environments we (most of the time) just can’t get rid of Flash – for backwards compatibility, to prevent complaints (including from higher management who just will not back away from viewing their favorite flash sites and would be willing to risk the security of the organization for it)… whatever the reasons, we just have to put up with this amazing piece of software, for now (and let’s hope HTML5 gains traction faster). If you are one of the many who need to keep Flash on all user machines, then there is some limited relief – in the form of the official Adobe Flash 17 (could be newer at the time of you reading this) Administration Guide http://www.adobe.com/content/dam/Adobe/en/devnet/flashplayer/pdfs/flash_player_17_0_admin _guide.pdf For some unknown reason there are no STIGs or NSA security guides for configuring Flash, so we are on our own here. First of all: are you updating Flash across all your computers every time a new version comes out? Are you sure – are you checking the version after each update on all computers? Are you disabling it every time an exploit comes out, until a new, patched version is out? Second: after the above is done and integrated into the daily processes and procedures at your workplace it is time to think about hardening it. If you look at the payload of any flash exploit, you will see, in almost all cases, imports to functions relating to network and file system access, among others. So our objective will be to limit the access Flash has to file and network resources – so it would be unable to download 2nd stages of any payload or store it / modify it / decrypt it on the file system, effectively rendering the exploits useless. Ignoring the deployment options from the guide above as they’re not relevant to this book, let’s focus on the security configuration settings described in it, specifically page 24 and the file “mms.cfg”. In general as you go through the settings, you should follow a whitelisting rule, meaning allowing network connections and file activity (downloads, for example) only for explicitly approved domains and locations. Pages 28, 33 and 35 of the guide above are most interesting for our purposes. From all the settings, the following are almost mandatory, bold are the preferred settings (and remember: test, test, test. Some settings may and will break needed functionality, play at your own risk!): LocalFileReadDisable = [ 0, 1 ] (0 = false, 1 = true) FileDownloadDisable = [ 0, 1 ] (0 = false, 1 = true) FileUploadDisable = [ 0, 1 ] (0 = false, 1 = true) SilentAutoUpdateEnable = [ 0, 1 ] (0 = false, 1 = true) DisableSockets = [ 0, 1 ] (0 = false, 1 = true) (read the manual description, use the next option) ProtectedMode = [0, 1] (0 = off, 1 = on) Page 56 of 112 Sandboxed Browsers / Alternatives for the enterprise Sandboxing is a term coming from the times when guns were tested by firing shots in a box filled with sand – effectively making the practice safe for the shooter. In the same way if you protect the browsers of your users and isolate them in a sandbox (treating the browser and the exploits which might attack it as the bullets which could otherwise kill your security), you will achieve significant security benefits – some malware even gives up from running if it detects a sandbox. But… other malware is capable of escaping sandboxes – so keep that in mind and do not depend just on the sandbox. Out of all the well marketed and advertised solutions, let me introduce a few of the less popular but in my opinion, more effective solutions. Browser in a box The enterprise-ready version of this gem by Sirris AG (https://www.sirrix.com/content/pages/home_en.htm) is capable of delivering incredible sandbox isolation for your most sensitive machines, where simple sandboxing in the form of Invincea/Sandboxie and their likes is not enough. The same company offers full-disk encryption solutions, mobile security solutions – they are not paying me to advertise them, I am genuinely impressed by the quality of their products and would like to pass on the respect through my book. The difference between the commercial, enterprise version (https://www.sirrix.com/content/pages/BitBox_enterprise_en.htm) and the free version is the capability to properly integrate with your web filter and to fully separate intranet from internet browsing. But even the free version is good for personal use. Bufferzone Pro and Invincea along with Sandboxie are, in my opinion, other, standard commercial solutions worth evaluating and exploring in comparative tests. I have done my own tests and could say just this – in your testing always obtain fresh malware samples and run them on a freshly installed and updated hardware box inside the sandbox and outside of it, noting the registry / filesystem changes with Process Monitor and / or regshot or your favorite system monitoring software. Make sure to do these tests in fully isolated environments, not connected to your enterprise network, have disk images ready to quickly restore the systems to their original pristine state. A good free and effective disk imaging solution is AOMEI Backupper. Comodo offers an AV + Firewall + a Sandbox (very good one, I might add) for free – but please check their licensing terms and their compatibility with your environment. Page 57 of 112 Selecting operating systems according to your business needs Use BSD (FreeBSD/OpenBSD) whenever possible. If you have a Linux device which can be replaced by *BSD and maintain the same functionality it would be a good idea to go forward with the replacement. Use Linux whenever possible – including for some desktops in your environment which do not necessarily need to run Windows – like kiosks, etc. Enable security auto-updates when you can. Use Windows 8/10 64 bit when you can. And if you really, really care about security – try out Qubes OS – this could be the first step into considering its use personally or for specific business needs. Before getting into the discussion which OS is more or less secure – let me clarify one thing. Even Windows XP can be configured in such a way that it will become a very, very difficult target to exploit. For example: enable SRP application whitelisting and configure SRP properly. Install Browser-in-a-Box, only browse from that application, install all the latest updates, install EMET (the latest supported version for XP) and configure it properly. Install a proper AV, such as 360 Total Security (Chinese) (XP might still benefit from it), set up a Guest user account and a regular user account, set up proper passwords for all and only use the machine daily as a Guest-level account. When installing, elevate with Run-As. Regularly update the HOSTS file with blocked malicious domains (this is available from multiple sources and the task can be automated). Delete CMD.EXE, debug.exe, command.com and disable powershell. Delete reg.exe and regedit.exe after everything is set up and installed – use them from an external device if needed. Here you go! One paragraph, and the most “insecure” OS – Windows XP – has been secured properly. This only goes on to say that no OS is secure unless properly configured by a knowledgeable admin. Even FreeBSD can become less secure than Windows XP – so please, pay attention to best practices, SRG/STIGs and you will be fine. *BSD The *BSD family of operating systems is currently the least targeted and the most secure, if you count publicly released exploits / vulnerabilities per OS. Next comes Linux in its various flavors. The least secure (by default) operating system family is, of course, Microsoft Windows – just because of its wide use and incredibly large codebase, but also because it is severely under-maintained and under-configured compared to what it could become after proper tuning. One benefit of using *BSD systems as servers (especially web servers) is the concept of ‘jails’ they employ. This is similar to virtualization – but instead of virtualizing a whole OS for the sake of a single application, you run the application in its own container, called a ‘jail’. This concept is weaker in Linux (called ‘chroot’) and non-existent in Windows. The closest thing in Windows to a jail is a sandbox – and it is not at least to my knowledge a practice to run web applications inside a sandbox on Windows. *BSD as a Desktop Contrary to popular opinion, BSD can be used as a desktop OS as well. Even in corporate environments (check out http://www.desktopbsd.net/ ). Think about it – how many users in a company do not need specialized software to do their job? Call center operators, mail room operators, non-skilled workers, developers (some programming jobs do not require Windows) and many others. You can run your file servers on BSD, your web servers Page 58 of 112 (which is actually recommended due to the aforementioned ‘jails’), your print servers, - the possibilities are endless. And since it can easily integrate with Windows Active Directory, what’s stopping you from experimenting? Qubes OS Qubes OS is appropriate for sensitive situations, when there is a high risk of attack against a workstation in the form of an exploit. It has been created by Joanna Rutkowska with security in mind. I would put Qubes OS on the desktops of the administrative assistants of the C-level executives without any hesitation, as they are the ones most frequently compromised due to their low level of technical skills and security awareness combined with their high value as targets. In essence the operating system isolates all applications (such as browsers, editors, etc) in their own VMs. It is very similar in operation to a regular Linux desktop with the exception that the user needs to get used to the concept of application isolation. Office packages such as Kingsoft Office (described later on) are perfect for it and if all one needs to do is work with documents, print, scan, read and write e-mail, just regular office work – Qubes OS and Linux are perfectly appropriate alternatives, providing security from the most widely spread malware and exploits and making it very difficult for attackers to propagate in them if your other operating systems are compromised. This OS cannot be ran in a virtual machine – it has to be installed in a physical box – so in order to test it you will need a spare physical box with the right components inside. A hardware compatibility list is available on the project’s website – https://www.qubes-os.org/ Linux The level of maturity of the Linux family of operating systems (distributions) is enough for regular business use. Tools exist to run Windows applications on Linux too – and there are quite good alternatives to most frequently used Windows software for Linux. Office productivity suites for Linux Libre Office (Open Office) has been dominating the space for quite some time, until the appearance of KingSoft Office - http://ksosoft.com/product/office-2013-linux.html , but both are good for their respective audiences. It only boils down to testing and seeing which one fits you most. Differentiate and decrease your attack surface when using 3rd Party Software There are many alternatives for PDF readers, audio/video players, even for office packages. For example, we know how frequently attackers exploit Microsoft Office ® vulnerabilities and use Macro viruses to attack your endpoints. So why not use Libre Office or Kingsoft Office? Okay, maybe Libre Office is not really ready for most commercial environments, but I bet most people have not used Kingsoft Office! There is a fully free, fully-featured version available and I might say the functionality and UI of this software package are pretty good for the price. http://www.kingsoftstore.com/software/kingsoft-office-freeware Page 59 of 112 Image credit: linuxundich.de I would like to emphasize that Kingsoft® Office is available for both Linux and Windows® operating systems. The quality of the suite is better than that of Libre Office, in my personal opinion – or I least I find it better suited to my needs. It is up to you to decide – test both and see for yourself. For PDF reading make sure to eradicate Adobe© Acrobat Reader© from as many of your endpoints as possible. It is just ridiculous how many vulnerabilities have been found in a PDF reading package! Foxit Reader is good enough. There are many other alternatives. But for all that’s holy, stop using Adobe Acrobar Reader, until Adobe fixes the way it writes software – for me, seeing vulnerabilities in a software package all the time means I should use this software package. It is not worth the risk. The point here is, that Foxit with its smaller user base and much smaller code base – and sometimes better functionality – will always be the smaller attack surface compared to the most popular PDF reading software. Hackers will always target Acrobat Reader more – just because most people are using it. And while this might seem as “security through obscurity” – the point of being secure is sometimes in being invisible or being the less likely target – for me, this is better than using vulnerable software just to avoid “security by obscurity”. Some might call this security through obscurity – and yes, you are not solving the problem by switching your pdf reader. But for me a decrease in attack surface is still a decrease in attack surface. If 95% of the exploits written for pdf reader are for Adobe® Acrobat™ - and 5% for the other readers, I am all for using other alternatives. Page 60 of 112 Just make sure whatever software package you choose you have a plan (tested and working) on properly automatically updating them to their latest versions, either using SCCM/other internal software management system or using their official channels. Flash Oh, Flash. Need we even discuss… Please remove all flash plugins / remains from all your endpoints, unless there is a dramatically important business critical reason to use it – even then you should only use Flash in a hardly sandboxed environment. Just get rid of it. The amount of exploit packs using 0days for Flash is … over 9000. How to properly harden your operating systems The core of this book, the very essence of what building a cyber fortress is about is in this chapter. It will probably be the most boring work you will have to do – the most tedious, labor-intensive and frustrating – but if you follow this chapter properly the security posture of your company is going to get to the level you need - raising the price of compromise above the levels acceptable to most attackers. Building a cyber fortress is not about constructing walls and towers – it is about making the endpoint as secure as possible. If every endpoint and network connected device in your network is hardened using the techniques below you will have every reason to feel safe. Every operating system in mass use today is soft and squishy when its default configuration is attacked. Hardening guides for the major OSes are abundant – but what makes them dangerous is lack of standardization and testing. You cannot rely on blog posts and how-to guides for enterprise, military grade security, this is obvious. Relying on blog posts and advice found on the web (even on the sites of security experts) cannot be trusted for multiple reasons – they are not regularly updated, they will for sure miss quite a lot of settings and they are personal advice, published by people with different backgrounds and knowledge levels. Sources of hardening guides NSA offers a large list of hardening guides in document format – ones which you can print and go through page by page, as well as some scripts, configuration files – depending on the situation / guide. The page where you can find them at the time of this writing is https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/ The page contains guides even for iOS and Mac OS. The NSA guides are lacking what the next section has in abundance – relevance for the latest technologies and comprehensiveness. What they do have, though, are scripts and ADM templates – which may help a lot during the testing and automation processes. SRGs and STIGs Security Requirement Guides and Security Technical Implementation Guides are at the foundation of what should be your procedure to secure applications and operating systems, networking devices, basically everything which is configurable in your environment and which has SRG/STIG for it. Page 61 of 112 The concept of a STIG is the following: it is a XML file containing all the most secure settings of the software it was created for, as well as other configuration requirements and advice. The XML file is accompanied by several PDF files, all in a single ZIP package. Be it Apache, IIS, RDBMS or an Operating System – IASE DISA has most of them covered with the right STIG/SRG for every single one of the most recent versions. At the time of this writing there are 474 STIGs, all of them are listed in alphabetical order on http://iase.disa.mil/stigs/Pages/a-z.aspx There are specific STIGs (for example the “Google Chrome Browser STIG for Windows - Version 1, Release 2”, and conceptual STIGs, for example “General Purpose Operating System SRG”) You can use these files to create Excel spreadsheets, which can then be distributed to various IT support teams for auditing and configuration change tracking. The same files can be used to feed into commercial tools – such as Nessus or Qualis – to audit the configuration settings of your equipment. From the official SRG/STIG training: There are four Core SRGs. These provide general security guidelines for operating systems, network infrastructure, applications, and non-technical policy controls. These four Core SRGs are the highest level SRGs and govern specific technology and policy areas. Core SRGs contain all security requirements for their technology and policy areas. Technology SRGs are subordinate to the Core SRGs. Technology SRGs do not refer to a specific product or product version, but contain all requirements that have been flagged as applicable from the parent level Core SRGs. The technology SRGs provide the basis for product-specific STIGs. In this way, SRGs compile overarching technologyspecific security settings to help provide assurance that DoD information systems operate at an acceptable level of risk. Note that the Core SRGs are not intended for use in assessments. STIGs, or, if necessary, Technology SRGs will be used for assessments. Page 62 of 112 STIGs document DoD policies and security requirements for specific technical products, as well as best practices for configuration. You can find specific STIGs that cover widely used operating systems, infrastructure services, and support applications. There are also STIGs that cover general topics such as remote or wireless computing and networking. Note that STIGs have not yet been created for specific mission applications. Because STIGs can help you detect, or even avoid intrusions, respond to and recover from security breaches, and implement specific security policies for technical products incorporated into your information system, your system is more likely to operate at an acceptable level of risk. A STIG is more than just a text document. STIGs include detailed guidelines to configure systems for security and compliance, such as benchmarks, which are specific versions of STIG content with code to perform automated assessment checks. STIGs also include guidance documents that you can use to configure your system manually. In order to standardize the automation of compliance reporting, the code in these benchmarks is compatible with the Security Content Automation Protocol, or SCAP. Note that in the past, STIGs and their associated checklists were separate documents, but they are now included in a single document that contains both content you can use to configure systems for security and compliance and content you can use to check systems for security and compliance. Although conversion efforts began in 2009, you may still encounter older STIGs with checklists that are separate documents. Whether operating a current system or implementing a new system, STIGs and SRGs provide important security guidelines and configuration resources for both system operators and developers. The check content presented in STIGs will allow you to assess whether your current systems are in compliance with the STIGs, while the fix text content in the STIGs will help you configure new and existing products so they meet compliance requirements. Vendors should use STIG guidelines for both new and existing products during research and development efforts. But what if an appropriate STIG does not exist? If there is no product-specific STIG for your product, you should use an appropriate SRG to guide you in implementing the appropriate security requirements. While FSO primarily uses SRGs as the basis for writing product-specific STIGs, vendors may use SRGs to build more secure products that comply with DoD security standards. SRGs, STIGs, benchmarks, and other information security-related resources are all available at DISA’s Information Assurance Support Environment, or Page 63 of 112 IASE, website. Each SRG or STIG will provide instructions on how to use and apply the guidance it contains. All of the above information is available on the free DoD course – http://iase.disa.mil/eta/srg_stigs/launchPage.htm – and you get to print out a nice certificate in the end! No other organization in the world has put up as much work as IASE/DISA into cataloguing and explaining every single settings in such a large amount of software products from a security point of view. In fact, this topic is so important, I wish I could be able to mark it in red in the book’s Table of Contents. I have to give it to them – they’ve done an incredibly precise and labor intensive job to accomplish it – and it will be a shame if you do not use this freely available resource. This whole book might have been written on this topic alone and the best I could ask you for is to research into it and start implementing. The place to start is at http://iase.disa.mil/stigs/Pages/index.aspx – maybe it is a good idea to download the whole archive, located at http://iase.disa.mil/stigs/dod-purpose-tool/Pages/index.aspx before it has been taken down or made available only to U.S. military personnel with a PKI issued by them. I sincerely hope it does not happen – but the whole planet is preparing for war and after the release of this book, one can never know which resources would become unavailable freely. You can find a really good training on the topic in an online training published by the US DoD – located at http://iatraining.disa.mil/eta/srg_stigs/launchPage.htm - they even provide a certificate on completion! Using SRGs / STIGs Before using the guides you should at least be able to view them. For that there are several resources. One is an online viewer located at http://www.stigviewer.com/ - it has been created by a volunteer who is not related to IASE/DISA – but still did a great job in helping us all use this invaluable resource. From that website you can download the guides in Excel / JSON or XML format – without the need to search and extract from the official source. Also the website can be used as a quick search engine and reference when you just need to check something quickly. The structure of the pages on that website is reflecting the structure of the guides themselves Finding ID, Severity, Title and Description. Same website has a list of DoD 8500 security controls - http://www.stigviewer.com/controls/8500 as well as all of the NIST 800-53 security controls - http://www.stigviewer.com/controls/800-53 Overall, this is the swiss army knife of working with SRG/STIGs. I would suggest you navigate through the site, choose a guide / stig and just explore from there – click on the controls, see the detailed descriptions, etc – dive in and you will get the idea pretty quickly. Page 64 of 112 The Official Way The official way of viewing STIGs/SRGs is http://iase.disa.mil/stigs/Pages/stig-viewing-guidance.aspx a Java application, allowing you to view/modify/save/track progress, as well as to export the files in various file formats. Creating a STIG Checklist One of the most useful functionalities of the Java-based STIG viewer is creating checklist from the XML files. All you have to do is open the app, load the XML and from the interface choose Checklist - > Create checklist from current STIG: A new window pops up, allowing you to save the checklist to the native format, where it could be useful to other people having the same program, or you could export to Excel (CSV): Which is even more portable. Besides using commercial applications and manual labor to check for STIG compatibility, you also have the option to use a free tool, when it comes to Linux systems. The tool is called LinuxChiro, and can be found at https://github.com/johnculkin/LinuxChiro OpenScap Another free tool supporting *nix/Linux operating systems is OpenScap, http://www.openscap.org/page/Documentation#Scanning Page 65 of 112 It is much more powerful than LinuxChiro and has the capability of reading/working with multiple formats – such as: XCCDF: The Extensible Configuration Checklist Description Format (ver. 1.2) OVAL®: Open Vulnerability and Assessment Language (ver. 5.10.1) Asset Identification (ver. 1.1) ARF: Asset Reporting Format (ver. 1.1) CCE™: Common Configuration Enumeration (ver. 5.0) CPE™: Common Platform Enumeration (ver. 2.3) CVE®: Common Vulnerabilities and Exposures CVSS: Common Vulnerability Scoring System (ver. 2.0) Working with STIGs and OpenScap is detailed in this link: http://www.openscap.org/page/Documentation#How_to_Evaluate_Defense_Information_Systems_Agency_.28DISA.2 9_Security_Technical_Implementation_Guide_.28STIG.29_on_Red_Hat_Enterprise_Linux_5 Nessus and Qualis are also able to scan for STIG compliance – even though they are commercial products, you can compare them feature-wise and price-wise, maybe one of them will match your needs perfectly. Application Whitelisting - SRP and AppLocker The industry as a whole has a problem – we rely too much on blacklisting, if at all. We blacklist suspicious applications, domains and functions – but at a rate which is negligible compared to the speed and capabilities of our adversaries. An organization or a vendor can only blacklist what they know about – and the dark side of the Internet is too wide and powerful, one vendor could never be able to cover it all. Services exist on the black market to generate malicious executables undetectable by any AV – and their SLA states that as soon as your malicious binary starts being detected, they replace it with a new one, for free. There is only one way to win in this situation: APPLICATION WHITELISTING As soon as you mention the idea of application whitelisting, your IT team will immediately start acting in denial – saying that it is not possible, that it will not work, etc. What is happening is just their lack of experience in that matter and their fear of change – also, their fear of the additional work which is inevitable in this situation. Your job will be to handle them smoothly and create a plan of multiple consequential steps for the adoption of SRP (Software Restriction Policies) and AppLocker. That plan will need to include a proofof-concept test scenario where a small set of computers is configured properly (initially), to see how the new configuration might impact the work of regular employees. Once this pilot project is complete and the IT team is comfortable with it, they will accept wider adoption of the same much easier than if you try to force a complete migration right from the start. Note: the following pages will be deeply technical and will rely on understanding of Windows Client/Server administration basics. If you come from a different background you may need to consult Page 66 of 112 with your systems administrators / IT team. In the references section you will find all whitepapers on which this chapter is founded – as well as in the end of the chapter itself, for your convenience. It is best if you print them out or save them as PDF files and hand them in a discussion meeting to your IT team. The amount of available exploits for Windows components (remote / local exploitation, privilege escalation) grows, generally servers and desktops get patched on a set schedule and some of them lag months behind – in the best case scenario. Execution of code on any node should be controlled and impossible without authorization. This means that all applications and executables present in the environment need to be pre-approved and on an authorized list (system) before being allowed execution. This sounds and is a lot of work initially, but as your organization matures and more and more applications are added to the authorized list, the easier it gets and the less requests for new additions you will receive. Without this last rule your defenses will be almost helpless against attacks – even if your nodes are hardened to the maximum possible in their configuration. Blocking the execution of unauthorized code in any of its reincarnations is the only way to keep your network immune and healthy. It is no longer enough to block the downloads of executables on the proxy / firewalls – malware now uses encrypted data inside JPG files, unpacks them in memory, decrypts and executes code and you can’t control or contain that without blocking the execution of the initial malicious payload. If any malicious payload gets executed and obtains access to a system, the game is over – it can do whatever it wants and security teams would have a very difficult time stopping it. Your goal is to prevent this initial infection from happening. The vectors of attack are known: USB (including smartphones, flash drives, e-cigarettes, basically any USB device), e-mail attachments, e-mail links, infected web pages, malvertising – all of them rely on the user opening a file, extracting a file from a zip file (sometimes double zipped), clicking on a link or simply loading a web page. Infected web pages usually rely on unpatched versions of Java or Flash – and they usually success as most companies don’t believe they can update Java and Flash at the same pace exploits for them get released, without breaking legacy applications. Blocking this specific vector – Java and Flash exploits – is not a part of this chapter, please refer to the next chapter, where I will talk about browser sandboxes and browser isolation. The reason you can’t control Java and Flash exploits via SRP / AppLocker is simple – if you allow Flash and Java, they become whitelisted and any malicious code anywhere on the Internet is free to exploit your decision at will. My personal recommendation is to disable Flash completely – I can’t think of a valid reason having it, now that most video sharing sites are using HTML5 to deliver content and most modern browsers use HTML5 (I hope you are not using IE8). Disabling Java in a corporate environment is not possible – but you can disable the execution of Java applets on untrusted sites (sites not explicitly defined in a whitelist). Thankfully Oracle developed Deployment Rule Sets – unfortunately, documentation on that front is lacking. They announced the new feature here – Page 67 of 112 https://blogs.oracle.com/java-platform-group/entry/introducing_deployment_rule_sets - but according to many people the initial documentation is not clear and easy to follow. Still, their documentation as well as several blog posts, such as http://kylebubp.com/2013/11/use-javawhitelisting-to-further-secure-your-organization/ , http://ephingadmin.com/administering-java/ , and https://isc.sans.edu/diary/How-To%27s+for+the+Holidays++Java+Whitelisting+using+AD+Group+Policy/17267 Java whitelisting is a very complicated topic – nevertheless you will need to put it in a standalone project and work through its completion if you want to control this very large execution vector in your environment. Are you ready to jump right into configuring application whitelisting? Not so fast! Execution Monitoring First, you need to make sure you know what is happening in your environment. Since by default Windows operating systems don’t have any process execution tracking, you would have to either use SysMon by Microsoft (https://technet.microsoft.com/en-us/sysinternals/dn798348 ) or use a thirdparty tool such as http://www.nexthink.com/ or https://www.bit9.com/solutions/carbon-black/ (I only recommend products I’ve used, others might exist but I cannot cover all of them in that book, as it would be unfair to mention things I have no experience with personally). In any case, it is imperative that you store all executions of binaries in a central database, away from the endpoint, for later investigations or for real-time analysis and alerting. SysMon logs can be sent and analyzed in a SIEM, for example. Having a log like this will help you with the actual application whitelisting implementation process – without it, you will be working with one eye closed and one hand tied behind your back. (Note on Sysmon: the best article I’ve read about it – which tops even Microsoft TechNet – is at https://jon.glass/discusses-sysmon-v2/ and https://jon.glass/discusses-sysmon-v2-filtering-rules/ ) I will talk more about system monitoring in the SIEM and Logging chapters – this is relevant just for this chapter. Now that you’re done with your process monitoring, you can start planning the actual application whitelisting process. Your first step is to determine which technique is more suitable for you – using Software Restriction Policies or AppLocker. Microsoft has created a good (although not that great) comparison table here: https://technet.microsoft.com/en-us/library/ee424371%28v=ws.10%29.aspx This is also the point when you should decide if you are going to use Whitelisting or Blacklisting. Because you can block execution from specific folders and still be relatively protected from Internet threats (the folders used by browsers as download and temporary file storage). I will only do a small deviation from the Whitelisting topic to define the best practice for Application Blacklisting: Page 68 of 112 Application Blacklisting with SRP Not as recommended nor as secure, but some organizations still prefer to go with it as it is less hassle to maintain (but trust me, much more hassle if you get compromised and your whole business shuts down for a week, with your job being given to someone else as a result). For application blacklisting to work correctly, you will need to create 2 separate accounts per user for your admins – and your regular users should have no admin rights. Your Admins should never log in to Windows as Administrator – in fact, their log on locally right should be denied. They will only run applications with admin rights using the Run As… function, and their administrative users should be exempt from most of the SRP rules – all of them except execution from Temporary Internet File and Downloads folders. For Local Group Policy editing when the machine is not part of the domain, you will still be able to set up two sets of group policies for two groups of users (admins and non-admins(built in)) following this guide: https://technet.microsoft.com/en-us/library/cc766291%28v=ws.10%29.aspx Here are the rules: Software restriction policies: -Security Levels: --Default: Unrestricted Additional Rules: Path Rules: (set all to Disallowed) %Temp%* %USERPROFILE%\AppData\Local\Temp* %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE* %USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files\* %USERPROFILE%\Local Settings\Temp* E:\* F:\* Explanation: blocking execution from E: and F: usually is enough to block execution from USB devices. Blocking execution from temporary internet files prevents many malicious programs to silently download and run executables, the same applies to the Temp folder. The %temp% rule prevents execution from opened Zip archives (for example, when a user opens a zip file and then runs the “PDF”.exe from inside the zip file directly). Another way to block USB execution is using Group Policy Editor and using the specific policy setting: Administrative Templates, System, Removable Storage Access: Page 69 of 112 Yet another way to block removable storage execute access is using the tool Ariad by Didier Stevens http://blog.didierstevens.com/programs/ariad/ As already mentioned, only admins will be able to run installations with the rules above. Another consequence is that some software, which loads and runs executable code to/from temporary locations, will also fail to run. You will have to make the decision which is more important: having this software, finding other options or enabling exceptions in order to run the software. Moving users with this software to groups with other rules applied (specific rules disabled, all the rest – still on) might work. Once again: application blacklisting is only recommended for non-critical environments, when you have very good control over the web traffic (web site whitelisting) and over your firewall, utilizing a next generation firewall technology with IDS/IPS turned on, protocol whitelisting and so on. In other words: use with extreme caution, use only if you want your security to be slightly better than no execution prevention at all. One more thing which will be a beneficial read for you before starting with Application Whitelisting is to read the US DoD / NSA leaflets on the topic (just 2 pages each): https://www.nsa.gov/ia/_files/factsheets/i43v_slick_sheets/slicksheet_applicationwhitelisting_stand ard.pdf and https://www.nsa.gov/ia/_files/factsheets/Application_Whitelisting_Trifold_Jan_2013.pdf . The same can be provided to your team / manager / executives for their understanding before any further discussions arise (the logos on the paper weigh more than the paper itself). Page 70 of 112 AppLocker Whitelisting Limitations Please keep in mind that AppLocker only prevents execution of binaries and scripts from storage media. It does not prevent direct exploitation where code is loaded and executed only in memory – for that you will need to have other controls, limiting the amount of foreign code which can touch your internet-facing applications (such as browsers). Most state-sponsored exploits in 2015 and onwards operate in memory only – you will have to think about mitigations such as web site whitelisting, java applet whitelisting, disabling flash completely, browser sandboxing and others, to mitigate state-sponsored malware. Also, by default DLL control rules are not enabled and need to be created – without them you will be missing a significant portion of the benefits, provided by AppLocker. A lot of the malicious code is distributed and used in the form of DLLs. Mitigation for common attacks against AppLocker: - Deploy SMBv2 packet signing to mitigate Man in the Middle style attacks. Restrict paths that binaries can be executed from to local non-removable media sources where possible. In order not to turn this book into application or protocol specific manual – and because much better manuals have been written by military organizations already, I will just leave 4 links on the topic here: http://www.ncsc.govt.nz/assets/NCSC-Documents/NCSC-Applocker-public-v1.0.5.pdf - the New Zealand guidance on applocker implementation – probably the best guide out there. The Australian Government Department of Defense has also published a short paper on application whitelisting, located here: http://www.asd.gov.au/publications/protect/Application_Whitelisting.pdf - it’s not a stellar one, but nonetheless is useful (in my opinion, the most useful part of that document are the two links at the bottom of it). It goes hand in hand with their page for Mitigation Strategies, located at http://www.asd.gov.au/infosec/mitigationstrategies.htm The sister page of NSA on mitigation strategies is located at https://www.nsa.gov/ia/mitigation_guidance/ - and it also includes a guidance on mitigating targeted malware at https://www.nsa.gov/ia/_files/factsheets/Defending_Against_Destructive_Malware.pdf One question I keep asking myself: if http://support.microsoft.com/kb/2532445 has been out for 4 years, why none of the papers listed before - NSA, Australian - mention it? Do they want you to believe AppLocker is safe without this hotfix, just to be able to bypass it? In any case. You got the right implementation here.. with one exception. http://www.wilderssecurity.com/threads/circumventingsrp-and-applocker-by-design-with-sandbox_inert-new-process.291593/page-3 is still not fixed. I generally recommend free and open source solutions and try to avoid recommending commercial solutions, due to the many "snake oil" salesmen on that arena. But... in this case I can recommend Bit9 + CarbonBlack. It's expensive - and effective. Practical advice The articles linked above will give you best practices for implementing Applocker. Page 71 of 112 My practical advice: have 2 users (I mentioned this multiple times throughout the book) for your admin users and for the users who need exceptions when running specific tasks/software. You can have different policies applied to 2 or more groups of users, based on their needs. Sometimes, you may even need 3 users for your admins, if they’re doing installations – especially if you have different rules for accessing the Internet for users and admins (generally users with admin rights should not have Internet access). Other uses of SRP & Applocker include the ability to block the execution of an outdated or a vulnerable application until a patch is deployed (actually forever – you don’t need that older version running ever again once it’s blacklisted). For example as soon as a new version of your favorite PDF reader comes out, block the hashes of all previously known versions. You should block any scripting interpreters not used on a specific machine / server / subnet for business purposes – that includes python, perl, cscript, on some machines – even powershell.exe, AutoIt, etc. One more idea on PowerShell – you should DISABLE it with a policy for all nonadministrative users. Administrators should only be able to use it on specific machines. Keep in mind that powershell is called “a post-exploitation framework” by hackers – they value it more than gold when available after an initial compromise. Finally, this document is in the list of references of this book at the end of it – but I know nobody reads the list of references. But you should read it! https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon_2014_IR_Track_APT_Detection.pdf 2-factor authentication for servers Using password-based authentication is a call for trouble. Your passwords (and even Kerberos authentication tickets) can be stolen in so many different ways there is not enough space on one page to list them. Think software keyloggers, hardware keyloggers (wired and wireless, including ones planted inside your keyboard), remote micro cameras, exploits, etc. One of the best solution to thwart attempts to use a stolen password to authenticate to your critical servers is 2-factor authentication. http://blogs.msdn.com/b/rds/archive/2014/04/30/using-rd-gateway-with-azure-multi-factorauthentication.aspx is one suggestion by Microsoft on using Azure services for 2-factor auth. Besides the commercial applications (which are multiple and not mentioned here) you could even use open source software: https://github.com/LastSquirrelIT/MultiOneTimePassword-CredentialProvider and http://www.multiotp.net/ as well as https://github.com/sbeh/RDP-OTP for Windows-based systems. For Linux and BSD there are many more options – for Debian-based distros, just apt-cache search 2factor or OTP and you will find plenty. Biometrics Commercial solutions providing biometric matching of typed passwords are very good as well. I’ve tried several and they work really well – some even lock a desktop as soon as they detect a typing pattern which is not that of the rightful owner / user of the system. This eliminates the risk of losing a Page 72 of 112 device and is more user-friendly, potentially deployable not just for your admins and core servers but for the whole organization. Caution: Be careful to prepare for the loss of your 2-factor auth device/key/phone – and have procedures in place to rollback to password authentication. Have a procedure in place to deactivate access for stolen/lost 2-factor auth devices. Maintaining the operating systems I don’t know if patching should even be mentioned. But noticing how many organizations put patching behind and are sometimes years (!) behind schedule on updating essential components after an exploit has been published for them, maybe it’s a good idea to repeat a well-known truth. If your organization does not have an official patch policy this could lead to chaos and depending on the emotional disposition of your system admins whether your devices will be patched on time or not. That is why I recommend creating a patch policy based on https://www.first.org/cvss/cvss-basedpatch-policy.pdf - as it strictly defines the timelines depending on the patch and vulnerability criticality. Always be careful with devices brought in by external vendors – servers, appliances – everything which contains an operating system of some sort – as many times vendors are only trying to sell an appliance and rarely strive to keep it updated. *Everything* should be patched – everything which is patchable and for which a security patch has come out must be patched as soon as possible, according to the above or similar policy. Ensure you have the proper mailing lists and subscriptions to receive notifications on new security patches from all vendors used in your environment. Make successful on-time patching part of the KPIs of your system admins and infosec teams. Page 73 of 112 Raise the cost of malicious code execution in your environment The economics of malicious software separate into multiple facets, two of which are mass malware distribution and targeted malware. Mass malware distribution depends on a network of services itself – groups delivering hacked websites and compromised hosts for file storage, groups delivering compromised advertising networks and groups providing services to make malware undetectable. For the criminals having compromised legitimate websites (at a certain point even Forbes.com was compromised for several months, delivering targeted malware) means that your automatic malicious url blacklisting systems would not work and they will be able to pass through your defenses easily. Having access to compromised (or just willing to deliver anything for the right price) advertising networks means criminals can deliver malicious software on virtually any website – including Youtube, for example (there have been multiple occurrences of the same). Combined the two above create an unprecedented threat environment where any website can deliver a malicious payload to your users – when even whitelisting, believed to be a draconian measure, would not help much. Moving on to MAAS – or Malware As A Service Malware as a service delivers on two promises – at any point in time your adversaries will have access to compromised hosts and undetectable malware. If a certain number of vendors start detecting the malicious sample, their fully automated service will generate a new sample and deliver it where needed – no interaction needed. As soon as a compromised host or website gets on any blacklist, the malicious code automatically moves to a new set of compromised hosts. This is part of their SLA (service level agreement) – and as mature business people they are well aware of the reliability they need to maintain in order to retain their customers in a highly competitive underground market. Their model is solid and proven – and relies on return on investment just as any other business model. In order to disrupt their operations against your business, you could do only one thing: raise their costs of attacking you using their automated methods so much as for the attacks to become unprofitable – at this point they will move to another target. That is IF you are not targeted specifically – at which point it will be only a matter of time until the actual compromise occurs – where your incident response and digital forensics capabilities will be put to the test, but that is a discussion for an entirely different chapter. Preventing Exploit Execution If you followed through on the previous chapters and have implemented applocker/software restriction policies and / or a commercial product to control the execution of unknown applications / code, if you have full control over powershell and have blocked malvertising to the maximum possible extent – it is time to move on with prevention of exploit execution. There are commercial and free solutions for this purpose, but you have to be extra careful when testing and evaluating them as what is advertised is not always what is in the box. Page 74 of 112 Years ago a well-known name in the AV industry sent a project for evaluation – and they had a point where their ‘unique anti-exploit functionality’ had to be tested. They promised protection from a specific RDP exploit. So I tested the exploit and lo and behold, the protection was working! I was surprised, but digging deeper it turned out all the product did was use the Firewall to block RDP connections from outside. Turn off the firewall functionality and the exploit crashed the system completely. Exploit prevention? Always test and ask tough questions before spending a considerable amount of money on software licenses. In the end, not even the money spent is at risk – it is the protection of your assets (or lack of the same). Malwarebytes Anti-exploit (https://www.malwarebytes.org/antiexploit/) is one product I would recommend you to try out and compare to its free counterparts. One suggestion I always give when evaluating a security company: look for signs of noncommercial community work. For example, releasing useful, non-marketing targeted tools designed to actually help users to fix their information security problems. Malwarebytes excels in this field – if you look at their free tools section you might find plenty of good ones https://www.malwarebytes.org/downloads/#tools. EMET The operating systems widely deployed at the endpoints are vulnerable. God forbid you’re still using Windows XP – but I’ve seen even the Space and Naval Warfare Systems Command of the USA visit my website from an XP box, so I guess everything is possible? Even Windows 7 is outdated by modern standards – but migrating to a newer operating system is not always possible due to multiple reasons, especially in larger environments. 3rd party software is also rarely updated, mostly due to lack of knowledge and experience on the side of IT staff – they don’t see the reasons or don’t know how to update to the latest PDF reader or Flash version (but why even have Flash on the endpoints, is another question), they don’t patch the installed office applications with their latest security patches unless forced specifically by an audit requirement or finding. Since at least 3 years there has been a ‘silver bullet’, guarding against application vulnerabilities and preventing exploitation by adding a second layer of defense between the operating system kernel and the applications on Windows systems. The name of this silver bullet is EMET (Enhanced Mitigation Experience Toolkit). At the time of this writing the latest version is 5.2 – a very mature application, I would say. I am constantly amazed by how many IT “experts” have not heard of or are not using EMET. Given its effectiveness and price – FREE – and given its developer – Microsoft – with the sole purpose to protect Microsoft Windows operating systems from exploitation, it really is difficult to comprehend why people ignore this product. This is likely one of your best and most effective defenses against exploits – even when they are attacking non-updated plugins like Flash, Java and Silverlight. And let’s be honest, does your company auto-update all plugins to their latest versions as soon as one is available? Sadly this is almost always not the case. For those of you who are not familiar with the concept, you can get yourself acquainted on the following links: Page 75 of 112 http://support.microsoft.com/kb/2458544 https://technet.microsoft.com/en-us/security/jj653751 http://blogs.technet.com/b/srd/archive/2014/07/30/announcing-emet-v5.aspx http://support.microsoft.com/kb/2909257 Please, break the rule and read the manual! After that, go ahead and download and install the tool. The installation page will offer you to download the manual as well – do it and read it. It’s not the best manual out there, but that is why my book exists! Let’s get into the technical details. The settings you see on this screenshot are not the default – they are the recommended ones (by me and by Microsoft). On first launch, just click the dropdown menu and choose “Maximum security settings”, then reboot your computer. Note: some AV products might interfere with EMET. If that is the case, you can contact them and ask for support or uninstall them and get a better AV product. In all cases – EMET should be preferred over an antivirus product anytime. After all, if you follow the advice in this book, you will never need to rely primarily on an antivirus for your security, ever again! Page 76 of 112 Most people don’t even get to this point – they install EMET and consider their job done – and it’s not. Next, you need to click on Import, go to C:\Program Files (x86)\EMET 5.1\Deployment\Protection Profiles and import Popular Software.xml. You can also import the other two xml files, but this one is most important. This step will add additional configuration settings for widely used applications which will prevent nagging crashes and issues of incompatibility. If you encounter application compatibility issues – namely, some apps crashing and the EMET window popping up saying it has blocked something – or if you see events in the event log that emet has closed an application due to some kind of mitigation – you have two options: either it has been a legitimate threat (exploit) or you have encountered a bug in the application. Sometimes these conditions are caused by a very long uptime, when EMET confuses memory addresses used by apps and thinks it’s an exploit. Sometimes these crashes are caused by a conflict with other security software. Sometimes you just need to update the crashing application, and sometimes… you need to re-configure EMET. Here is how to do it. Go to the main screen, then click on the Apps icon: You will see the following window: Usually the event log will tell you which mitigation has been triggered – most often it is Caller Mitigation. If this happened to you, you can turn off this specific mitigation for this specific application – fully aware that you are losing a part of your security. Never disable mitigation settings unless you are absolutely sure this cannot be rectified by updating your application, OS, EMET or AV. There have been blog posts about certain security consultancy firms bypassing EMET – I can assure you these were written primarily for marketing purposes. It is still not common for attackers to use exploits capable of bypassing EMET and it is still advisable that you implement it in your company as soon as possible. If you think about it, everything can be bypassed – does that mean that if a protection measure can be bypassed, you should not install it? Page 77 of 112 Other malware prevention measures I wish NIST 800-83, http://csrc.nist.gov/publications/nistpubs/800-83/SP800-83.pdf - Guide to Malware Incident Prevention and Handling” was made mandatory for implementation everywhere. My recommendations on this document: there are action items which you can mark (with a colored marker) for implementation and add these to a project, something similar to “Malware prevention measures” – then add all the action items on a timeline and task the IT / IT Security teams for their implementation. Simply reading will yield little benefit as the document is a bit high level, not getting into much technical details, which I think is on purpose, as otherwise they would have to go down to the vendor level configuration settings, which is not the purpose of the document. Other server / workstation hardening ideas I generally recommend getting rid of any binary which is not essential to the business operation of a workstation or a server. Deleting non-essential binaries Does a specific user need cmd.exe, reg.exe, regedit.exe, cscript.exe, at.exe, psexec.exe, nbtstat.exe, ftp.exe, bitsadmin.exe, makecab.exe, quser.exe, ieexec.exe, schtasks.exe, netstat.exe, sc.exe, xcopy.exe, nslookup.exe, taskkill.exe, tasklist.exe, route.exe, regsvr32.exe, ping.exe, wmic.exe, powershell.exe? There are several ways of dealing with the situation. 1. 2. 3. Delete the binaries, when needed – bring them with you to the machine Restrict execution with a policy Rename them – cmd.exe could become dmc.exe, for example (after the proper tweaking of the system’s self-preservation mechanisms trying to return such system files to their original form). Renaming renders useless many automated attack scripts / exploits / etc, just as well as deleting or restricting with a policy. The same applies to any operating system. Please use proper change management, testing and implementation for all such changes – some systems management software uses powershell, some enterprise scripts might need cscript to run – take this advice with a grain of salt and always test for an extended period of time before rolling out such drastic hardening measures across the enterprise. Rendering a system unusable is worse than not implementing a hardening measure. More on PowerShell: A security expert (Nikhil SamratAshok) recently posted a set of posts on his blog, named “Week of PowerShell Shells”. If you’re not familiar with what a shell is in this context – it is a way to obtain a remote ‘command line shell’ via non-standard techniques, for example by sending and receiving ICMP (Ping) packets. So while you’re sitting there and looking at your clean traffic showing only ping packets traveling between system A and system B, someone might actually be having full remote control of said systems. Well, it would be best to just read the blog posts to get a better picture: Page 78 of 112 http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-5.html http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-4.html http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-3.html http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-2.html http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html The above blog posts prove just one thing – if PowerShell is available on a system it represents almost everything an attacker needs to utilize the system and penetrate deeper into your network. It is yet another reason to lock it down and make it accessible to administrators only and only on specific machines, definitely not on all your endpoints. The following 2 posts by Microsoft will help you lock down your PowerShell: “PowerShell’s Security Guiding Principles” http://blogs.msdn.com/b/powershell/archive/2008/09/30/powershell-s-security-guidingprinciples.aspx and “PowerShell Security Best Practices” http://blogs.msdn.com/b/powershell/archive/2013/12/16/powershell-security-best-practices.aspx Page 79 of 112 Choosing secure networking components Hardware-level encryption between nodes via built-in encryption in the network cards / other networking equipment is desirable, but not necessary – the same can be achieved via software in budget-oriented organizations. Network outlets should be properly secured (in an ideal world, with a physical lock of the cable to the network outlet, making it impossible to unplug or connect something else without changing the lock). The minimum level of security for said network outlets is a strong NAC (network access control) based on a whitelist of allowed devices and vendors mapped to specific network outlets. Before you buy a device you should have some idea how secure it is, how prone it is to compromise and how well it can integrate with other secure elements in your organization. As you could imagine, someone has already done this work for you at least to some extent: https://aplits.disa.mil/processAPList.action On this page you could see all components which have already been tested and approved for use in US military environments. I suppose that’s good enough for most organizations. What comes next is for you to secure your core network services. DNS DNS is critical to your networking infrastructure. Even so, when setting up the foundation of your core network, you better not rely only on the decisions of your trusted sysadmins as they are mostly focused on functionality and performance and leave security last. The most widely used DNS server is BIND – it is also the most widely exploited one. It has been plagued with bugs and security holes since its inception. If you are really serious about your security, I suggest you think twice and only use BIND if you are absolutely sure in what it has to offer and are ready to accept the risk. Djbdns http://cr.yp.to/djbdns.html - this project is not as flexible or as powerful as most other DNS servers in existence – but it surely is more secure and reliable than most. Page 80 of 112 If you can afford the time and effort to make the switch – and especially if you are still using BIND – you should. The attack surface of djbdns compared to BIND is … uncomparable. There maybe was one exploit published for djbdns – compared to hundreds for BIND. If you can, start at least with testing the server and evaluating its capabilities in a test environment. Routing I will not mention vendors in this part of the book, but you might as well guess who they are. Being the most targeted in the world, you can be certain there are multitudes of 0-day exploits for their devices in the hands of various actors. They might not be your adversaries – nor your country – but being vulnerable can still render your network incapacitated as a collateral damage in somebody else’s battle. Besides, referring to the all-popular ‘leaks’ we can all be assured with a high level of certainty that many popular network device vendors have released and keep releasing intentionally or nonintentionally backdoored products. Even if they are not backdoored when leaving the factory, the process for backdooring them on the way to your premises is documented and practiced to perfection. So you cannot rely on their invincibility from any point of view – and if it was my choice, I would never trust my router to a popular vendor. There are non-commercial, open-source alternatives. The BSD Router project – thanks, Ivan Natchkov, for pointing this project out! Most environments don’t need the overly complex and incredibly expensive commercial routing products. Unless there are features which the vendors offer you and you really need them, I suggest you go with the BSD Router Project, as it is very secure, very effective and, well, very free. From the project’s features page: Base OS: Embedded FreeBSD 10-stable using NanoBSD, Easy upgrade process using two system partitions Routing features: All routing protocol supported by quagga: BGP, RIP and RIPng (IPv6), OSPF v2 and OSFP v3 (IPv6), ISIS All routing protocol supported by Bird: BGP, RIP and RIPng (IPv6), OSPF v2 and OSFP v3 (IPv6) Multicast: DVMRP, IPv6 PIM Dense Mode and Sparse Mode Multiple FIB: 16 Routing Tables available High availability with CARP (support also load balancing the incoming connections) and VRRP. Multi-link PPP: PPTP, PPPoE, L2TP, etc… (all features supported by mpd) VPN: GRE, GIF, IPSec (IKEv1 and IKEv2) and OpenVPN IPv6: native 6to4 tunnels and Tayga NAT64 Qos: Traffic shaper with IPFW+dummynet supporting: FIFO, WF2Q+, RR (Deficit Round Robin), QFQ, Alternate queuing with ALTQ supporting: CBQ (Class Based Queuing), RED (Random Early Detection), RIO (Random Early Drop), HFSC (Hierarchical Packet Scheduler), PRIQ (Priority Queuing), Committed Access Rate with netgraph: Single rate three color marker (RFC 2697), two rate three color marker (RFC 2698), RED-like, Traffic shaping with RED Page 81 of 112 Ethernet features: 802.1q vlan tagging, link aggregation and link failover interface, bridging with support of Rapid Spanning Tree Protocol (802.1w) Network services: DHCP Relay, DHCP Server Management: From CLI only: local console, serial and SSH access, Command completion with somes BSDRP tools: config, system, show and upgrade Monitoring: SNMP v1,v2c and v3, Syslog, Mail, Netflow with native ng_netflow (v5 and v9) Security: mtree reference files available for system integrity check (sha256) Building your own router from scratch on OpenBSD OpenBSD is considered to be more secure than FreeBSD, on which the ORP is based. You can see a full tutorial on building such a router at http://www.bsdnow.tv/tutorials/openbsd-router Firewall alternatives Commercial firewalls have a disadvantage – that is, it is never known if the vendor has introduced (willingly or unwillingly) a backdoor or intentional security weakness to allow access for unknown parties. It is generally a good rule of thumb to remember that if a vendor is known to have used a backdoor once, they will place a backdoor a second time – just trying to hide it better the next time. That is why for smaller organizations it is a good idea to evaluate other options, such as PfSense or OpnSense - https://www.pfsense.org/ and https://opnsense.org/. Another vendor, who also offers commercial versions and support, is https://www.untangle.com It is only logical that for large organizations small, open source firewall will simply not be enough – or at least not as their main firewall. But for small environments the aforementioned are more than enough. Port Knocking – NSA is using this for the past 10 years, are you? The concept of port knocking is: the firewall presents all ports as closed, unless a specific port sequence is ‘knocked’ with a special packet. For example, if you want to keep port 22 for remote administration purposes, but want to close it for everyone but a list of authorized people/devices, you could set the firewall up in such a way that if your authorized person sends a specially crafted packet to ports 1888, 25678 and 3456, their IP address is temporarily whitelisted and can open a connection to port 22. NSA has been known to use port knocking for all remote access connections for many years – even for access to their internal systems, not just remote administration and / or VPN. A good tutorial on setting up port knocking on open source operating systems can be found at DigitalOcean: https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-tohide-your-ssh-daemon-from-attackers-on-ubuntu Page 82 of 112 Ask your Firewall Appliance vendor if they support port knocking. If not, you can certainly place an open source screen in front of your appliance anyway, just for that purpose. Network Segregation / Isolation Way too many organizations do not use any form of network isolation / segregation. For example, they do not control which workstations can access specific servers directly. Does the administrative assistant of the CEO (or any other user) have a legitimate business need to be able to access the Domain Controller via RDP? Do they need to access the database server? On any port? You get my point. Now is the time to really think about how to isolate specific groups of users (even inside the IT department!) from specific groups of other users and devices. No employee should be able to access network shares or anything else in the HR department, for example – and if you sit with your team and think about it, there are really a lot of rules which can and should be created for this. A good person to call to the brainstorming session is the risk manager of your organization, as they will be able to help with identification of sensitive areas you might not have thought about. You should assume that at any point in time some endpoint will get infected in one way or another – when that happens, the attacker should be ‘sandboxed’, isolated in that specific network segment and should not be allowed to roam freely across the whole network. Protect people from themselves. You are not isolating them because they might somehow magically obtain the ability to hack computer systems – you are protecting them from the risk of being exploited and becoming a bridge between a threat actor and your most sensitive data. On Web Servers / Externally accessible services and DMZs Do you have web servers and / or other internet-accessible services in a DMZ? Move them out immediately. They should not be located even in the same datacenter as your primary devices. Ideally the only connectivity there should be over a VPN with a port-knocking set up, so as to not expose any remote administration capabilities over open ports. DMZ is dead (my personal opinion), from a security perspective. Treat all your devices as internet accessible – from the point where your user endpoints became entry points DMZ became irrelevant. Whenever possible, such services should run from a BSD Jail – or from isolated (per app) virtualized environments, never overlapping more than one service on one jail or one virtual machine. On VPN connections Always remember that a VPN connection and the target device / network is only as secure as the source device connecting to it. That means, that no matter how hardened your network and servers are, if an administrator connects from home from a compromised machine, whoever has compromised their machine has also effectively compromised your network. You can prevent this by providing separate, secured laptops to your administrators with an enforced policy to ONLY be used for remote connectivity. Same should be encrypted, should have the same Page 83 of 112 hardening measures applied to them as all your other critical endpoints, including security software, policies, STIGs, etc. Think about enforcing 2 or even 3 factor authentication for VPN connections. MAC and vendor whitelisting Only MAC addresses existing on a pre-approved list of devices should be able to connect to the network, and only to specific network outlets. Let me give you an example why. Attackers often use rogue devises to plug a gateway (in the form of a wirelessly connected flower pot, for example) into your network. Other times they come in during a time when people are on a break and plug in rogue devices. A new device on the network, even if not allowed to connect due to MAC filtering, should raise the loudest of alarms for your infosec and physical security teams. Since MAC addresses are extremely easy to fake and duplicate, you should enforce matching of a mac to a wall outlet – a device should not be allowed to ‘roam’ – can you imagine your networkconnected printer suddenly picking itself up and connecting from another floor? Another good idea is physically securing specific wires to specific outlets, with a lock – where applicable. It sounds like an overkill but it is not. Attackers do come into printer rooms, they do copy MAC addresses – and they can unplug your printer and plug in their rogue device, even putting it between the printer and the wall outlet. Unplugging the cable in such rooms with limited visibility should be impossible (and these rooms should always be under video surveillance). Host-based Network Whitelisting Most commercial Antivirus products come with a host based firewall. If yours doesn’t it is time to switch vendors. Host based firewalls should be granularly, centrally configured to only allow traffic to the internet for specific applications (your corporate approved browser, for example). If everything else is denied, hostile binaries will not be able to communicate with C&C (command and control) servers and / or exfiltrate data. You should explicitly deny, log and send alerts for all traffic attempts from unauthorized applications. Rules should also be defined in the same way for servers, as internet access should only be allowed for the hosted application and for nothing else. You should NOT allow any powershell executable / ftp or anything else internet access from a server or a workstation. Applications to block from internet access using host-based firewalls: ftp.exe, powershell.exe, psexec.exe, psexecsvc.exe and any other executables you may want to prevent from external access in your environment. If you need an official-looking document to convince the network team that this topic is worth discussing you might want to take a look at https://www.nsa.gov/ia/_files/factsheets/I43V_Slick_Sheets/Slicksheet_SegregatingNetworksAndFu nctions_Web.pdf Page 84 of 112 DoS / DDoS protection There are some unconventional ways to protect from a Denial of Service attack. In 2015 when this book is being published these are the most effective attacks in terms of return on investment – the price to shut down your public service / website is so low that without spending a considerable amount of money on ‘protection services’ (reminding you of any other business models?), it is very difficult to stay assured of your survivability. The famous players on the field of DDoS protection charge ungodly amounts of money on a monthly basis for something which might never happen – hoping that your fear will keep driving money to their bank accounts. I agree, they are effective, but they are not the only solution. Some of the measures suggested below are only applicable to small to medium organizations – of course, if your size justifies serious (TB/s) attacks, you will need to go with the big vendors. Luckily there are less common and very effective ways to counter DDoS attack effectiveness. Use 3rd party services to serve your customers on a constant basis One very important thing is to learn and start using social media as a communication channel – and why not the main communication channel? It’s easy to flood your website with traffic – and extremely difficult to do the same to your Twitter / Facebook accounts. Devise a plan to still being able to sell your services even if your website is completely down. Establish presence on online marketplaces, utilize Skype other similar VOIP services for communication in case your phone networks are down. You get the idea – decentralize. Do not depend on a single point of failure. You can, even now, setup some of your web presence on services such as Google Sites – I would love to see an attacker take that down. In the event of an attack you just redirect your visitors there, while your team is working on mitigating the attack. Use CloudFlare I am not a part of their sales team, but considering their prices and effectiveness small organizations would benefit tremendously from the resulting protection. Besides the DDoS protection they have a pretty good Web Application Firewall and website optimization as part of their package. All you need to do in order to place a website behind CloudFlare’s protection is change your DNS server settings in the domain control panel, as well as make sure all DNS records are properly replicated during the initial setup (mail, etc.) – that’s it. Usually takes less than an hour, I’ve managed to get it working in 20 minutes in some cases. You should specifically look at the security features they’re offering – even in their free plans – here: https://www.cloudflare.com/features-security - besides everything else provided for free. In my opinion it is well worth to pay the $20/month for this service, especially remembering that other vendors charge more than $1000/month for much less. Page 85 of 112 Advice for Security Services/Products Vendor Selection A very good standard for choosing MSS (managed security services) providers is described in the book “Surviving Security: How to Integrate People, Process, and Technology” by Amanda Andress (2003). I will not repeat anything from that book as I recommend you to buy it – but there are other aspects which are not mentioned there. Just as described previously on the topic of choosing a penetration testing company – the process to select a security vendor should be similar. Try to arrange a pre-sales meeting and ask for the engineers who are supposed to be serving you to be present – not their best engineer but the ones who are supposed to work with you on a long term basis. This moment is very important – as what the sales team can describe is often not what you will get out of the box after paying. The engineer should be able to answer most of your questions (just as they are supposed to solve your problems later on) without writing them down for a later follow-up. If they are not able to answer a question, they should give proper pointers and politely promise a follow-up. Ask for at least one resume of the people who are supposed to be providing professional services to you – the process should be as tough as in hiring your own team – as in fact you are doing just that, with the difference that the legal and financial dealing is with a company and not a person. The IT / infosec work will be with their engineers and you should assess them properly. Have a list of requirements specific to your organization in advance. Do not compromise on attitude and quality – a slight price difference in their favor is acceptable – but choosing a vendor just based on price is a very bad choice long-term. If the engineers are proud and / or arrogant on that first meeting you can be sure the situation will be much worse down the line – at the first sign of arrogance on their side cancel the meeting and move on to the next vendor. Once again – make sure at least some employees of the vendor are active in the infosec community. Look how popular are their blog posts (on twitter and google) – if the vendor is not contributing anything but is only trying to sell there is a big chance their employees are not capable enough to be useful to the community – and probably are barely doing their job. Look for a different vendor if that is the case – there are thousands of small companies packed with qualified individuals – and finding them is your job. Good teams rarely have to proper marketing / sales teams to reach everyone. If you need security expertise in a specific technology – you can find your vendor on the reddit / google groups topics on it. Their twitter feed should be filled with helpful advice to people asking them for their advice and that is just one example. Finally, feel free to (anonymously) post your need on the same forum / reddit / twitter hashtags – someone might refer you to a good vendor / team. Trust the community! Price negotiation Open competition is the driver to a clean and fair market, where deals under the table are harmful to all. Be sure to have the approval of a vendor to share the average / not exact number of their offer with other vendors. Base price expectations on the compliance % of different vendors to your requirements. Page 86 of 112 When building my list of requirements I usually used the Gartner detailed vendor comparisons per sector, adding all functionalities and features of all vendor offerings to an excel spreadsheet. Then I consolidated all overlapping features, assigned different weights to the features most important and built a matrix comparing vendors on their compliance with the features my company needed. This matrix was then compared to the prices offered by all vendors – making the selection process quite straightforward and easy, especially for justifying the price to higher management. Page 87 of 112 Security Monitoring and Logging If you really need to work on this topic, I suggest you read the book of Anton Chuvakin - Logging and Log Management: The Authoritative Guide to Understanding the Concepts Surrounding Logging and Log Management. It has helped me tremendously in several projects and I would like to pass on the fact that it is an incredibly useful book. Besides that, I have a few ideas to share which might be useful to you and are not present in the aforementioned book. Before even starting to collect logs you need to understand your environment. That is why audits and assessments are useful. But that is not all – you need to understand how much data your devices are producing in log format every second, minute, hour, 24 hours – then you need to understand how to optimize what is logged and what is not. It is very easy to lose yourself in the amount of logging information generated on each of your devises, especially if you add them all at once to your SIEM (even if you add only servers/switches and firewalls and omit the desktops). The noisiest devices in my experience are Windows systems – especially domain controllers and mail servers. Second would come your proxy servers and firewalls. To understand how logging in a Microsoft Environment works, I suggest you read these two links: Advanced Audit Policy Configuration FAQ http://technet.microsoft.com/enus/library/ff182311(v=ws.10).aspx, HOWTO: http://technet.microsoft.com/en-us/library/dd408940(v=ws.10).aspx Once you’ve read the above and understand the difference between basic and advanced audit policy configuration, move on to the next link: http://www.nsa.gov/ia/_files/app/Spotting_the_Adversary_with_Windows_Event_Log_Mon itoring.pdf It explains in detail the changes you need to make in order to have an optimized for detection logging environment. It also explains which EventIDs you should focus on. In order to clean up your logs and only collect what is needed, you need to know what can be discarded. To know what is being logged, a good idea would be to export the logs from your noisiest server for a day to a CSV file, open it in Excel and filter by EventID. It should be easy to distinguish by percentage which events are happening most frequently and which are not. In one case I saw thousands of events per second with the word “Filtering engine” in them. Turns out packet logging was turned on – and every single network packet coming through the internal Windows firewall was being logged! You can imagine the amount of logs generated by this server per hour and the usefulness of these logs. Unfortunately such level of detail can render your SIEM and your storage incapacitated – and you should be very careful what you log and what you discard. If you want a good start with configuring your SIEM, you could only configure it to log the EventIDs in the aforementioned “Spotting the Adversary with Windows Event Log Monitoring” paper by NSA – and expand to other systems / events once you are sure you got that one right. Don’t just plug in Page 88 of 112 your SIEM and all your devices into it in a shotgun manner – all your money spend on storage and SIEM will go to waste if the system is not optimized and tuned for effectiveness. You should also focus on the following EventIDs: 4688 Process Create (after going to https://technet.microsoft.com/enus/library/dn535776.aspx?f=255&MSPPError=-2147217396 and enabling logging) 4663 File/Registry Auditing 4075 Service Created 4070 Service Changed 4624 User Login Success 5140 Share accessed (List taken from http://www.slideshare.net/Hackerhurricane/ask-aalware-archaeologist) The same process can and should be repeated for all your systems / devices. Only plug a device into your SIEM solution once you fully understand the format of logging it uses, the amount / type of events and how you could fine-tune the amount of details in these logs. A really good additional guide on configuring Windows Logging is this one: https://malwarearchaeology.squarespace.com/s/Windows-Logging-Cheat-Sheet.pdf – the “Windows Logging Cheatsheet”, if the link breaks and you find the need to Google it. Tools These links will be useful during your work on optimizing your logging environment. http://sourceforge.net/projects/syslogserverwindows/ http://sourceforge.net/projects/nxlog-ce/ https://indihiang.codeplex.com/ https://eventloganalyzer.codeplex.com/ https://logexpert.codeplex.com/ - especially this one! https://www.mandiant.com/resources/download/highlighter Using open source tools for centralized logging management Before even beginning to think about buying anything, think about optimizing your logs and storage – as storage is utilized very quickly and becomes expensive if not managed properly. There are multiple log storage calculation options online – what I used back in the days were a set of spreadsheets with pre-configured EPS (events per second) per device or operating system, or one of the online tools, such as http://codepen.io/packetinspector/details/vxjbL/ Another way of obtaining proper log storage calculation spreadsheets is asking SIEM vendors for them in a pre-sales meeting – their engineers have them and are willing to share. There are a few really good open source solutions for centralized log storage and analysis (well, not as in a SIEM, but with a really good searching and filtering capability which is still good) for smaller budgets. Page 89 of 112 One of them – a classic – is Syslog-NG - https://www.balabit.com/network-security/syslogng/opensource-logging-system They offer free and commercial versions. In my opinion though the next 2 projects are offering better user interface (at least I like them more): Logstash, ElasticSearch and Kibana ElasticSearch has recently acquired Logstash under its wing – which is a good thing from a compatibility / support point of view. Logstash is the engine used to receive, process and then forward your logs for storage. ElasticSearch has a very good performance, compared to conventional database log storage – and Kibana is probably the most beautiful visualization / search engine developed. Together they form a really nice combination – and if you don’t have the budget for a SIEM (which is the case with many companies) – is a really good evaluation option. Just remember to make sure you calculate your storage requirements – as it might turn out that your storage will cost as much as a SIEM with good archiving capabilities (archiving (compression ratio) is one weakness of the above combination). Yet another good tutorial from DigitalOcean on setting it up: https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-andkibana-4-on-ubuntu-14-04 GrayLog2 Another really good open source log management product is GrayLog2 (https://www.graylog.org/) . It is very similar in operation and performance to the ES/Logstash/Kibana – with the difference that it is a bit simpler to set up and get up and running and that the user interface of GrayLog2 does not use Kibana – which is a weakness, as Kibana is incredibly powerful in terms of what you can do with its dashboards and custom filtering / reporting capabilities. I will spare you the screenshots / detailed technical capabilities – and I’m just mentioning the projects so you could have them in your mind when comparing to commercial solutions. Security Onion I cannot possibly write a chapter on security monitoring without mentioning this security linux distribution. It is installable on your own hardware – and for a small (500 endpoints) would require at least 16 gigs of RAM and many TB of storage (as much as you can / want to afford) to store all the network traffic passing through your gateway. It operates by running all network traffic through a set of open source intrusion detection systems. As with all of them turned on the machine would need significant amount of RAM and CPU power as well as the maximum IO you can push it is not recommended to run it on a VM. It is also recommended that your storage is built out of high-performance disks. The distro allows you to look back in time in a way, and if an incident happens, to extract the exact packets containing the attack. The longer period you can store your network traffic for, the better. Page 90 of 112 http://blog.securityonion.net/p/securityonion.html Feeding your SIEM with external threat intelligence data The value of having threat intelligence data fed into your SIEM can be seen when events from your IDS/IPS/Firewalls/other devices properly correlate with it. When unknown binaries or traffic patterns enter your network this new data will help make sense of the unknowns and generate alerts when a patterns matches with a known threat indicator. Since it is humanely impossible to read all the information passing through your SIEM you would probably rely on its alerting capability whenever it detects anything suspicious. Let us leave aside anomaly detection and spike detection for a moment and focus on threat intelligence as that is a very good source of alerts whenever something matches with your network. External threat intelligence feeds usually comprise of file hashes, IP addresses, hostnames, domain names, Indicators of Compromise (IOCs), matches to YARA rules, etc. Companies make a living from dissecting botnets, malware and breach investigations to produce valuable information on detecting even small portions of malware based on similarity and functionality rather than hashes (so called fuzzy hashing, for example). Then they convert that data into actionable form and sell access to it – so you could plug it into your SIEM. Once your SIEM is fed with one or more threat intelligence feeds it could notice any similar activities, files, portions of files, accesses to suspicious networks or hosts – and alert you. Below I will list some free and commercial threat intelligence feeds. It is your choice which ones to use, but I would put my focus on the commercial ones (after reading reviews from their customers and comparing them). Commercial threat intelligence providers: Kaspersky Security Intelligence Services: http://www.kaspersky.com/enterprise-it-security/security-intelligence-services/ TrendMicro Security Threats Connect: http://www.trendmicro.com/us/security-intelligence/currentthreat-activity/threat-connect/ Norse Intelligence Service: http://www.norse-corp.com/products/norse-intelligenceservice/index.html (they also have a pretty cool (funny to look at) map of ongoing attack traffic here: http://map.ipviking.com/ ) iSightPartners ThreatScape®: http://www.isightpartners.com/products/threatscape/ VeriSign Security Intelligence: http://www.verisigninc.com/en_US/cyber-security/securityintelligence/threat-intelligence/index.xhtml CrowdStrike Falcon Intelligence: http://www.crowdstrike.com/falcon-intelligence/ And finally, one service by Microsoft, which is focused on internal data analytics rather than external: http://www.microsoft.com/en-us/server-cloud/products/advanced-threat-analytics/ Open Source / Free Threat Intelligence providers: AlienVault Open Threat Exchange (OTX): https://www.alienvault.com/open-threat-exchange Page 91 of 112 Thanks to http://cyberwarzone.com/30-malicious-ip-list-and-block-lists-providers-2015/, we have a list of 31 (30 active) malicious IP/domain list providers: 1. CriticalStack - https://intel.criticalstack.com/ 2. ATLAS - https://atlas.arbor.net/ 3. BLADE Malicious (outdated) 4. CLEAN-MX Realtime Database http://support.clean-mx.de/clean-mx/viruses 5. CYMRU Bogon List http://www.cymru.com/Documents/bogon-dd.html 6. DShield Blocklist http://www.dshield.org/ipsascii.html 7. EmergingThreats Lists http://www.emergingthreats.net/index.php/rules-mainmenu-38.html 8. Google Safe Browsing API http://code.google.com/apis/safebrowsing/ 9. hpHosts File http://hosts-file.net/ 10. Malc0de Database http://malc0de.com/database/ 11. Malware Domain Blocklist http://www.malwaredomains.com/wordpress/?page_id=66 12. Malware Patrol’s Malware Block Lists 13. Malware-Control Blacklist http://www.malware-control.com/ 14. Malwared http://malwared.ru/database.php?page=1 15. MalwareDomainList.com http://www.malwaredomainlist.com/hostslist/hosts.txt 16. MalwareURL List http://www.malware.com.br/lists.shtml 17. Malwr https://malwr.com/ 18. Nictatech http://www.nictasoft.com/viruslib/ 19. Norse Darklist http://www.norse-corp.com/darklist.html 20. OpenPhish http://openphish.com/ 21. ParetoLogic URL Clearing House http://mdl.paretologic.com/ 22. PhishTank Phish Archive http://www.phishtank.com/phish_archive.php 23. Project Honey Pot’s Directory of Malicious IPs http://www.projecthoneypot.org/list_of_ips.php 24. Scumware.org http://www.scumware.org/ 25. Shadowserver http://www.shadowserver.org/wiki/pmwiki.php?n=Services/Reports 26. Sourcefire Vulnerability Research http://labs.snort.org/iplists/ 27. SRI Threat Intelligence Lists http://mtc.sri.com/ 28. Sucuri Blacklists http://sucuri.net/?page=tools&title=blacklist 29. ThreatStop http://www.threatstop.com/ Page 92 of 112 30. URL Blacklist http://urlblacklist.com/ 31. ZeuS Tracker Blocklist https://zeustracker.abuse.ch/blocklist.php , https://zeustracker.abuse.ch/monitor.php?browse=binaries You can also use these to plug into your Web Filter appliance / proxy server blacklist. Page 93 of 112 Control the Insider Threat There is a sea of products and services on the market offering the same with different names – essentially you would be interested to detect intrusions shortly after their occurrence (it is inevitable) – no matter if they are external or internal. Please remember the statistics – the majority of incidents happen with the help of insiders, not from external sources. It only makes sense to focus on the most likely risk and move further from there, once you have a pretty good grip on it. It would be an overkill to try and beat the best paper written on the matter by CMU University staff – “Common Sense Guide to Mitigating Insider Threats” http://resources.sei.cmu.edu/asset_files/TechnicalReport/2012_005_001_34033.pdf Controlling what people copy to their personal devices via any medium (Bluetooth, USB, WiFi) or personal mailboxes or what and how much they can upload to external sources is essential. Blocking HTTP(S) POST requests larger than X KB unless specifically whitelisted is a very good idea I’ve seen at one of the places I worked at. Even then – there is a way to establish an encrypted session with the outside world and push (stream) data slowly over time – which is what many advanced intruders do. Whitelisting is essential in this case. People associate the insider threat with an individual with malicious intentions – which is not always the case. Most times when an incident occurs where the cause is an insider this is due to someone with privileges deciding to slightly bend the rules to ease their life. Think of a user with admin privileges on a machine, who decide to install non-approved application because they “know” it’s “clean”. Or someone bringing in a portable app, to make their life easier – and bypass installation policies. Or someone being logged in the whole day with their admin account, ‘just because it’s easier to do my job this way’. You might be surprised at the LOW level of information security awareness of people with an extensive IT background. The ones who are the pillars or your IT environment are often either oblivious or not aware at all – or don’t care, which is worst – about cyber security risks. So you have two ways to deal with that. One is total control of admin accounts and their allowed use. For example, you could completely restrict interactive logons for admin accounts, only allowing them to execute the “Run As” or “sudo” functionality, but not being able to login. You could also completely restrict Internet access for admin users – thus even further reducing the motivation to work all day logged in as an admin. You could define it as a violation of policy – and impose punishment for violating it, with strong monitoring and detection rules in place, which would alert you when someone is abusing their admin rights. Page 94 of 112 The other way is education. You could provide your system admins with the proper training for them to understand the risks of not following the official policies and guidelines, as they should understand them first before agreeing to following them (there is such a thing with IT people and not only them). In the Information Security Awareness chapter I referenced some materials which might be helpful in that task. There is also another aspect of controlling the insider threat, which is rarely mentioned in professional literature (at least not in infosec literature) – and that is the emotional and psychological environment people work in. If people are stressed and pressured, if they live in a bitter environment of gossip and dirty games they will naturally be less motivated to follow the rules and maintain the security of your data. If people are happy with their job and their colleagues, they will naturally try to protect this environment from internal and external threats – as this essentially protects their well-being. Page 95 of 112 Cyber Incident Response If your company is like most, you consider a cyber security incident to be such only if ‘you get hacked’ – whatever this magic term means, or if a major mass infection occurs in your network. But if you really look into what is going on in your IT environment you might find one or more intruders roaming freely, collecting information, leaking it out and deleting their traces, then another intruder coming in, doing what they intended to do and leaving, this would be repeating on and on. Because some intruders don’t want to advertise their presence and never show up publicly with a report they hacked you. They would not trigger your AV, either. By implementing proper security monitoring (which usually costs a lot of money on SIEM/IDS/IPS/DLP/storage/analysts/threat intelligence subscriptions) you will suddenly start receiving a lot of alerts – and some of them will be of actual incidents. Employees break security policies and procedures on a regular basis, code gets executed without authorization – and in the cases when this code is malicious, external parties might gain access to your internal network. People browse non-work related sites, download things they are not supposed to, execute things they are not supposed to, send home documents they are not supposed to, bring devices they are not supposed to bring, etc. And if a few years ago it was appropriate to let the IT Administration / CISO handle such situations, now this is impossible due to the number and complexity of incidents – if your organization counts in more than 1000 people, you need a separate DFIR (digital forensics and incident response) team. Building such a team is a complicated effort and if you are just starting to consider this option, start by reading the following resources: NIST Computer Security Incident Handling Guide http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf http://www.dtic.mil/cjcs_directives/cdata/unlimit/m651001.pdf - CYBER INCIDENT HANDLING PROGRAM (U.S. Military guideline) Then move on to https://www.enisa.europa.eu/activities/cert/training - this resource could become the single point of training for the whole DFIR team, as it offers practical exercises as well as theoretical material in the form of templates, guidelines, text books, etc. It is impossible nor desirable to cover such a complex topic in a single chapter – as with many of the chapters of this book (which I call a reference for a reason) – its main objective is to give you guidance in a helpful direction. Your CSIRT is the immune system of your organization – detecting internal and external breaches and isolating any perpetrator before it has done major harm. In the case of an ‘infection’, your CSIRT will raise the ‘temperature’ of the whole organization and with the collective intelligence of the whole organism will drive the intruder out. Here is the best possible material / source you could learn from: https://www.enisa.europa.eu/activities/cert/support/guide Page 96 of 112 A handy list (frequently updated) of useful resources your CSIRT (cyber security incident response team) will need to get to know and use: https://github.com/rshipp/awesome-malware-analysis The best blog on incident response you could start reading is http://journeyintoir.blogspot.com – as it details a lot of the processes which are not described in books on the topic. Another similar blog is http://windowsir.blogspot.com – as its name implies, focused primarily on Windows. Page 97 of 112 Smoke and Mirrors Or the art of active defense and enemy disorientation “You can ensure the safety of your defense if you only hold positions that cannot be attacked. Hence that general is skillful in attack whose opponent does not know what to defend; and he is skillful in defense whose opponent does not know what to attack.” – Sun Tzu It is impractical to cover everything on this topic in a single chapter – but what could help you in building good active defenses is reading the following book – “Aggressive Network Self-Defense”. What I am going to cover here is just some basic ideas of making the life of an attacker more difficult and the usefulness of their automated tools less effective. For example, you could open certain ports on purpose and redirect all input from them to /dev/null – an effective measure which would keep an adversary entertained for quite some time trying to exploit that open port. Honeypots and honeynets Building a good honeynet is useful in 2 ways: 1. It gives you intelligence on what the attackers are doing before they have a chance of doing the same on your production systems 2. It wastes the adversary time and resources while wasting comparatively low resources on your side to run the honeynets/honeypots. Having several honeynets and honeypots is not enough. Attackers look not only for ports and services, but for the story behind them – you will need to build a whole story around the honeynet/honeypot – fake personas, fake business applications, fake presentations indexed by Google, fake profiles on social networks, etc. A lot of malware will simply stop running if there are VMWare tools (or specific registry entries which are present on VMWare/Virtualbox virtual machines). You could simply install VMWare tools (check the license terms first) on a non-virtualized machine. User agent spoofing In one of my favorite Chrome plugins – uMatrix, in the Privacy tab, you can see a very handy option: Spoof user agent every X minutes: This is one additional measure against exploit kits targeting specific browsers, as user agent is what most of them rely upon in order to deliver the right exploit. Page 98 of 112 User agent string rotation has one additional benefit. When a targeted attack is planned, the attackers will usually send a series of links to various employees, recording the user-agent strings in order to better plan their exploitation. With the tool above (and especially if you add more useragent strings besides the default) you will significantly increase the complexity of preparing a targeted attack against the browsers/plugins employed in your organization. Adding confusion everywhere you can will slow down adversaries and will completely thwart automated attack tools in some cases – spoof web server signatures, dns serve signatures, mail server welcome banners, ssh, etc. Page 99 of 112 Mobile Device Security You should not forget that mobile devices are swiftly replacing desktops as targets – I have seen a full compromise of a fully updated Android phone via a simple, ‘empty’ SMS message – granting full control of that device to a third party at all times (remember, phones are rarely shut down and you have much less performance / network monitoring tools for your phone than for your desktop). Isolating mobile device usage in a proper manner is important. That includes having separate devices for corporate and personal usage, separate network providers, separate applications / credentials, separate mobile device management systems, etc. Compromising your mobile device means someone gaining access to all information on that device. If you can’t afford losing that information’s confidentiality or availability, think twice before storing information on that device. At the time of this writing Samsung Knox (now open to everyone with a strong enough Samsung device - http://www.engadget.com/2013/09/04/samsung-opens-up-knox-security-platform-to-allconsumers/ ) and Apple iOS are the two effective ways you could choose for your mobile device security. The latest (at the time of this writing) iOS security guide by Apple is located at https://www.apple.com/business/docs/iOS_Security_Guide.pdf Delivering exploits to mobile browsers is no different than the way its’ done on desktop systems – the problem is that we don’t have well sandboxed browsers for smart devices yet – at least not on the level of “Browser-in-a-box” by Sirrix. Delivering all mobile content after it has been filtered already by your web filtering appliance is one solution to the problem as that will block a lot of malicious domains / advertising (malvertising) networks, for devices which are under your control. Mobile devices you control should be a subject to the same hardening efforts you spent on your other endpoints – and there are plenty of STIGs for all the major mobile operating systems. In general it is advisable to use alternative browsers whenever possible to avoid easy compromise via exploit kits (Webroot, Maxthon and Opera come to mind as appropriate alternatives). If your device has 3GB of RAM or more and a quad-core CPU then full encryption will not harm its performance much – and is recommended. So far I’ve found Webroot AV to be the most effective in blocking web-based attacks against Android, followed in quality and performance by 360 Security. The first has a paid version while the second is 100% free and has a thousand times bigger user base (China + the rest of the world). Not using a log screen password mechanism is a call for trouble. Note that a 4-digit pin is broken in seconds, simple passwords in hours – the most secure android protection now is the pattern lock with as complex pattern as you’re comfortable with. Biometric protection is much better – and I am glad Apple and other vendors have started embracing it. Page 100 of 112 Creating a personal cyber fortress Protecting your own digital life and that of your family is of paramount importance and even we as security veterans may sometimes forget to take care of our own with the long hours we spend doing the same at work. Protecting a personal computer / mobile device / anything personal with some form of connectivity to other devices is becoming an interesting objective – just as complex cyber-attacks from 2006-8 were discovered only in 2014/2015, we will most likely realize what kind of threats were lingering in our smartphones only after 2018-2020. Keeping that in mind, we should assume our personal and mobile devices as vulnerable now as our computers were vulnerable to APTs in 2008. The chapters above – on Software Restriction Policies / Applocker and EMET apply to personal computers just as they apply to business devices. You should at the minimum install and configure EMET as otherwise you will be prone to a lot more exploits. That is if you’re using the Windows operating system, of course. Hopefully when you read this Windows 10 will be out – which is much more secure than Windows 7 by default, but even then you should still install EMET on it. For my family (especially for its older members) I have a rule: when setting up a computer and fully configuring it, I enable the Guest account, change its picture and name and only show that as a login option. For a regular user this is more than enough – all their applications are working, but I would not want to be in the place of a malware author trying to exploit a Windows 8.1/10 box fully configured as per the rules above and running with a Guest account… However for highly sensitive situations I recommend you switch your operating system to Qubes OS or DektopBSD - http://www.desktopbsd.net/. Or at least use something like Kubuntu or Xubunu (Sorry Ubuntu, but your user interface is just…. Ugh!) Starting from a clean install is also very important, always using licensed software and avoiding cracks/keygens as the plague. Seeing such applications without any malicious code in them is like seeing a unicorn. Knowing that most people will ignore the advice to use an alternative OS and will continue using the most popular one – the advice from now on will be focused on solutions and ideas for Microsoft Windows. Full Disk Encryption With the demise of TrueCrypt the alternative I would recommend for Windows 7 devices is VeraCrypt. Unfortunately Windows 8 has changed the way it boots and VeraCrypt does not fully support full disk encryption for system (boot) partitions yet for Windows 8/10. For such situations BitLocker is more than enough protection for a home computer – as we can consider what you’re keeping safe is the privacy of a home computer in the case of a loss / theft, not in the case you’re being chased by an intelligence agency. Page 101 of 112 Store your passwords in a secure way Always use a password manager for your online accounts (this implies you use different passwords for all websites which require authentication and are sensitive in nature). I recommend KeePass Password Safe - http://keepass.info Browse the web safely Using a regular browser simply is not good enough anymore. Being exposed to sophisticated exploit packs on potentially any website we access, we need to re-learn how we use the web on a day-to-day basis. Using a non-standard browser will put you in the small percentage of users exploit pack writers ignore due to the cost of covering 100% of all browsers – it is 10 times cheaper to cover 80% than 90% of them. It is probably 100% more expensive to cover 100% than 80%. So it’s simple math – be a part of these last 10%, be safe (as much as possible). Browser-in-a-box This is a unique concept. In essence it is a virtual machine (linux) which exports a Firefox browser to your Windows desktop, making it almost transparent to the user and at the same time very, very difficult to exploit. You can download the ‘application’ at http://download.sirrix.com/content/pages/bbdl-en.htm or read more about it at https://www.sirrix.com/content/pages/BitBox_en.htm Comodo “Dragon” browser Based on Chromium (most people would recognize that as Google Chrome), with enhanced privacy and as per their website: Has privacy enhancements that surpass those in Chromium's technology Has Domain Validation technology that identifies and segregates superior SSL certificates from inferior ones Stops cookies and other Web spies Prevents all Browser download tracking to ensure your privacy Not as secure as “Browser-in-a-box”, but much lighter. Would work best with the whole Comodo suite of applications, which they are offering for free – AV, Firewall and a sandbox. Just be careful not to install anything else when installing – de-select any additional offers. For secure banking, I recommend the usage of Bitdefender Safepay™ Browser: http://www.bitdefender.com/solutions/safepay.html Page 102 of 112 Another cool solution is the combination of the 360 browser + 360 total security suite. The 360 browser is built by Qihoo 360 and is, just like the Dragon Browser by Comodo, based on the Chromium engine, which makes it compatible with all your favorite Chrome Extensions – it can also import all your bookmarks and passwords (if you can trust it) from Chrome and / or Firefox. The additional security features of this browser can be seen from the screenshot on the right. With sandbox protection, process isolation and the 360 cloud security you will be protected from phishing as well as malicious websites – and it comes with adblocking turned on. The browser is developed by Qihoo http://en.wikipedia.org/wiki/Qihoo - a company with more than 640 million users of its security products – it is Chinese but I personally trust them more than I trust certain famous companies – simply because certain government agencies have absolutely no power over them. One really good reason why choosing 360 as your AV is a smart choice: they have no benefit in signing agreements with the Five Eyes Alliance to keep their malware undetected, as some other vendors do. Browser Add-ons https://addons.mozilla.org/en-US/firefox/addon/noredirect/ For the Firefox users out there I recommend this add-on, which prevents 302 redirects in your browser, effectively blocking a lot of malicious redirect scripts, pointing to hacked / malware infested pages. NoScript https://noscript.net/ This extension is a must-have for security-conscious people with a little bit of technical skills. It will probably not be appropriate for regular users who will have no idea why certain pages and page features are not working and will be constantly complaining to tech support about it. By blocking all unknown scripts and active elements it implements script whitelisting in the browser, a very effective measure even when visiting hacked websites. uMatrix uMatrix is appropriate for the more technical users who know how to configure it per each website visited, as it often breaks desired functionality in its eagerness to protect you. But as you can see from the image below – loading one comic site drags along scripts and content from so many others tracking and advertising sites, the list can’t even fit and needs to be scrolled down! By clicking the right box the elements get loaded (after you press the reload button) or their allowed/denied state is being saved when you click on the save button so you wouldn’t have to reconfigure everything again next time you visit that website. Page 103 of 112 This extension is an ad-blocker on steroids (or something stronger) – I combine it with uBlock for ultimate peace of mind. Antivirus protection for the home computer Personal computers (and tablets on the Windows OS) will need antivirus protection for a few more years, whether we want it or not. AV protection is necessary to defend against 40% of the threats which are active and detectable by them. The rest you will have to defend against using common sense and proper device hardening, as mentioned elsewhere in this book. There are two products I can wholeheartedly recommend: 360 Total Security and Webroot. Page 104 of 112 360 Total Security As can be seen on the image above, I have highlighted 2 of the very important features of this product. Arrow 1 points to the Tool Box, which contains functionality to optimize your computer and patch it with any missing updates, even if the update functionality of your PC is broken for some reason. The second arrow points to the 5 AV engines (2 of them must be manually disabled right there, clicking on the BitDefender and Avira icons) it uses. The product also protects your web browsing and enables phishing protection for certain websites. There are a few default settings you need to enable to ensure maximum protection: - uncheck this box if it is checked. In Active Protection > System, in the section Files to be monitored, select All files. Page 105 of 112 In Virus Scan, set the following options: And the best part… IT IS FREE Webroot This product was my favorite before I discovered 360 because of its excellent behavioral malware detection, sandbox and web browsing protection – as well as detection of system modifications which are not normal (once a Java update tried to replace a system file in c:\windows\system32 and it caught and prevented it on my machine). Unfortunately they do not offer a free version (except for their mobile version) – but I was using it for 2 years and recommend it to anyone who does not trust 360 Total Security for some reason or another. The web browsing protection from malicious websites is very good. Comodo AV + Firewall If you’re careful when installing and deselect any additional options / software / offers they try to force your way, the product is amazing. https://www.comodo.com/home/internet-security/free-internet-security.php The bundle is especially useful to technically adept users as the amount of features and settings under the hood is just mind boggling. The sandbox and the firewall alone are worth the effort of installing. The Comodo Firewall is really useful when it comes to notifying and preventing unknown / new processes from connecting to the Internet without your approval. Security monitoring for your home computer https://www.glasswire.com/ - is a must. This application allows you to monitor your internet usage in a way no free or commercial home firewall does – via usable and informative graphs and notifications. Page 106 of 112 It is not a firewall in the pure sense – but is a really good monitoring solution to detect anomalies in your network traffic. As can be seen on the screenshot above, this is probably the best user interface in a consumer grade security monitoring product ever developed. One example of a potential detection, which turned out to be a false positive: As you can see (hopefully) from the image above, an application tried to connect to the Internet for the first time. The location: c:\users\username\appdata\local\temp\isgvmkv.tmp\countinstallation.exe – looks exactly like malicious software, as legitimate software Page 107 of 112 would not run its components from that location. Luckily, this is a binary signed by Foxit Software Incorpoated – and I noticed this executable right after the installation of Foxit Reader in a VM. In another situation I would have been alerted of a malicious activity at the time it would happen, not during an investigation later on. Censorship avoidance There are countries which limit freedom of speech and access to information. There are situations when you might need to avoid being tracked – even just for principle’s sake, if you want to make a point that your browsing is your own business and should not be in anyone’s statistics. I will list a few ‘free’ censorship bridges – in various forms and effectiveness, nevertheless, they are worth trying. Google Compression Proxy https://chrome.google.com/webstore/detail/data-compressionproxy/ajfiodhbiellfpcjjedhmmmpeeaebmep The way it works is, you add it as an extension to Google Chrome and it passes all your web browsing traffic through Google’s servers – compressing data and saving your traffic as well as privacy. Of course, if you are worried about Google inserting data (think NSA exploits) or monitoring you, avoid this service. SoftEther VPN This is a serious privacy project trying to provide secure and private browsing experience to everyone, for free. https://www.softether.org/ Any paid VPN with a good reputation is also a good alternative. Protecting a personal mobile device To protect your personal smartphone or tablet you can rely on technologies such as Samsung Knox™ - but if your device is not of that brand, you still have multiple other options. Apple devices remain relatively secure – as the operating system is maintained very well and their security team is doing a great job. As long as you do not jailbreak your device and you properly configure your account and device you can remain with a peace of mind. Jailbreaking an iOS device is akin to asking a random ‘keymaker’ on the street to install a lock of their choice on your door and allow them to keep a key, just in case – and distribute it to their friends. Does not sound safe to me. It is in this sense better to allow the vendor access (which they will always have anyway) and deny it to everyone else, rather than giving access to unknown adversaries. Yes, you can install additional security software after jailbreaking – but yet again, you have no control over the source code nor the vulnerabilities present there. Doing the same to an Android device (called “rooting”) results in the same weaknesses – you gain more control but you lose security features, opening more holes in your mobile device than were present before. Page 108 of 112 The few benefits I see in rooting an Android phone is that you can install security patches and newer versions of the OS more rapidly and you can give security applications deeper access to the OS – that is a fact, the choice is yours. Installing the proper protection applications on your Android phone can help a lot. Just be careful what you install – not every vendor out there is benign and not every security app is effective – many are there just to maintain marketing presence. Recommended Android security apps VirusTotal - https://play.google.com/store/apps/details?id=com.virustotal – generates hashes of the applications and services on your phone an uploads unknown apps to VirusTotal – and is the best way to detect malicious files which are undetectable by your current Android security app. Their system also has a sandbox where such unknown apps show their behavior – another added benefit. 360 Security - https://play.google.com/store/apps/details?id=com.qihoo.security – yes, I know, a Chinese security vendor. Yes, I know you’ve been scared by the media about how evil the Chinese are. But please evaluate the app and its capabilities. I have used many security apps and so far personally find this one the most effective and feature-rich. An alternative to 360 is Webroot - https://play.google.com/store/apps/details?id=com.webroot.security Besides offering an excellent and effective mobile security suite, Webroot also offers a premium one (features as many as above, but at a price) – which I find very effective against malicious websites. They also offer a very good, secure browser – overall the company is security-oriented and offers excellent products. Another company seriously focused on security for many years with excellent research and excellent products is Kaspersky. Yes, Russian. No, they are not evil communists. https://play.google.com/store/apps/details?id=com.kms.free Google Authenticator – a must have. If you are not using 2-factor authentication, you should start NOW! I will mention it a bit further – but for now, install the app. https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Secure Mobile Browsing You should not access banking websites with a regular browser – especially if clicking (tapping) on links in e-mails, supposedly leading to your mobile e-banking. Webroot SecureWeb Browser https://play.google.com/store/apps/details?id=com.webroot.secureweb Trusteer, just as Webroot above, offers a secure browser https://play.google.com/store/apps/details?id=com.trusteer.securebrowser.trusteer Secure Messaging You should only trust encrypted communication for confidential conversations – and even if you only want to keep your conversations as they should be – between you and your conversation partner. Threema - https://play.google.com/store/apps/details?id=ch.threema.app – so far, the leader in security and user interface usability. Not free, but well worth the price. Page 109 of 112 TextSecure Private Messenger https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms This one is free, but I personally prefer the UI of Threema. The same developer also offers a secure calling app, which is very effective in keeping your voice conversations private https://play.google.com/store/apps/details?id=org.thoughtcrime.redphone – RedPhone. Encryption Encrypting your device is recommended if it has more than 2GB (3 or more) of RAM and a high-speed CPU (quad core). You can encrypt weaker devices, but you will pay a high price in performance issues and lag. But encrypting your phone and SD card is the only protection you have in case your phone is stolen or confiscated at an unfriendly border (some countries may well jail you for a single photo or e-mail they consider inappropriate). Choosing your encryption key is as important as choosing your banking passwords – phrases containing spaces and symbols are best. Securing your personal finances against confiscation / inflation / financial crisis / others I will only leave a single link here – as there is a blog out there which goes to great lengths about protecting yourself and your finances against abuse – it is the International Man website http://www.internationalman.com/ As the author points out on their website: “The problem — your problem — is that any country can turn into a 1970s Rhodesia. Or a Russia in the ‘20s, Germany in the ‘30s, China in the ‘40s, Cuba in the ‘50s, the Congo in the ‘60s, Vietnam in the ‘70s, Afghanistan in the ‘80s, Bosnia in the ‘90s. These are just examples off the top of my head. Only a fool tries to survive by acting like a vegetable, staying rooted to one place, when the political and economic climate changes for the worse." - Doug Casey But that is not the only way you could go. Look into Bitcoin – really look into it – as it is the only technology in existence which protects your money from being taken away if you properly secure it digitally (or in print, yes, you can print bitcoin). Page 110 of 112 Various tools Finally, if you are curious, here are some miscellaneous links to tools related to information security you might want to check out: http://sourceforge.net/directory/security-utilities/os:windows/freshness:recently-updated/ - a collection of open source / free tools related to information security. Many are regularly updated, I would like to specifically highlight ProcessHacker as one useful example you should look at. Another useful open source repository is https://github.com/showcases/security Page 111 of 112 References: https://www.nsa.gov/ia/mitigation_guidance/ https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon_2014_IR_Track_APT_Detection.pdf http://www.computerworld.com/article/2872292/nsa-secretly-uses-scapegoats-data-mules-andinnocent-victims-pcs-for-botnets.html http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparationsfor-cyber-battle-a-1013409.html http://www.ncsc.govt.nz/assets/NCSC-Documents/NCSC-Applocker-public-v1.0.5.pdf http://iase.disa.mil/Pages/index.aspx https://www.nccgroup.com/media/481134/2013-12-04_-_ncc_-_technical_paper__bypassing_windows_applocker-2.pdf http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43231.pdf Page 112 of 112