The 7 Steps to a Successful Cyberattack: How to Defend Against Them

©2018 BOMGAR CORPORATION ALL RIGHTS RESERVED WORLDWIDE 1
The 7 Steps to a
Successful
Cyberattack: How to
Defend Against Them
Chris Stoneff
September 20, 2018

Chris Stoneff
VP, Security Solutions

Follow along on social media!
@Bomgar
#bomgarwebinar

• About Bomgar
• 7 common cyberattack steps
• Mitigating threats to stand up against
today’s threats
• Additional resources
• Q&A
Agenda

Privileged Access Security Solutions
IDENTITY
Protect and manage
privileged credentials
and accounts
ACCESS
Secure and manage
remote access and
privileged sessions
ENDPOINTS
Defend endpoints by
removing excess
admin rights

Planning and Executing Cyberattacks
• Reconnaissance
• Scanning
• Access and Escalation
• Exfiltration
• Sustainment
• Assault
• Obfuscation

Reconnaissance

Reconnaissance
– Metagoofil,
Exiftool, Strings,
Maltego

Social 360
• Monitors social networks
for other companies
• Offers special “crisis-
monitoring” service which
aims to identity protestor
activities that might be
threatening to companies
tarnished by scandals
The World’s Largest Social Networks

Attack Defense
Reconnaissance • Control sensitive information in public domain
Attacks - Defense

Scanning
• NMAP
• Nessus

Attack Defense
Scanning • Prevent information leakage to scanners
Attacks - Defense

• Hydra
• Mimikatz
Access and Escalation

Metasploit
• Target servers, network devices,
databases, web applications, endpoint
systems and virtual machines.
• Exploit machines, choosing from the
world’s largest public collection of quality-
tested exploits.
• Brute force passwords on over a dozen
services, including databases, webservers
and SSH.
• Launch a social engineering campaign to
compromise user machines with phishing
emails and malicious websites and
attachments.
• Jump from one compromised machine to
the next through VPN pivoting until you’ve
owned the entire network.
Access & Escalation

Access & Escalation

Attack Defense
Access & Escalation
• Control all passwords for accounts that allow
escalation or privileged access
Attacks – Defense

• Truecrypt
• Create encrypted volumes on
storage media which appear to be
random noise on the media and are
neither detectable nor recoverable
without the proper keys or
passwords
• Puff/OutGuess
• Hide data in images or audio files
• Corkscrew/OzymanDNS
• Tunnel SSH in HTTP
Exfiltration

Attack Defense
Access & Escalation
Exfiltration
• Restrict access and monitor. Password and
session management
Attacks - Defense

• Access system and reach the
desired level of access
• Add “authorized” access
• Add ourselves to the list of users
that is legitimately allowed access
• Useradd on Unix-like
systems
• Netuser command on
Windows systems
• Create additional access to
applications, networks, and
any number of other
systems in the
environment
• Backdoors
• Exploit known application
vulnerabilities
• Ex: Target Breach
Sustainment

Attack Defense
Reconnaissance • Control Sensitive Information in Public Domain
Access & Escalation
Exfiltration
session management
Sustainment
• Harden systems and applications; restrict outgoing
and incoming as much as possible and still
function properly
• Lock down admin access to systems
• Audit accounts, system access, open ports, and
other items that could be used to create a
backdoor
Attacks – Defense

• Usually requires administrative rights
• Achieved with simple commands
• cat / dev/ zero > file average system will
product 4 GB of zeros in 6 seconds
• Change system time settings
• Emails, logs, timestamps, etc. are
impacted
• Change the umask setting on a database
server
• Will result in database failures by
changing file settings in database
• Alter environment variables
• Linux: # echo “fs.file-max = 1” > >
/etc/sysctl.conf
• Tells system to only open one file
at a time
• System crash!
Assault - Software

• Requires administrative access
• Flash ROM
• Alter the functionality of the hardware, or disable the hardware entirely
• Delete drivers
Assault - Hardware

Attack Defense
Access & Escalation
Exfiltration
session management
Sustainment
and incoming as much as possible and still function
properly
• Audit accounts, system access, open ports, and
other items that could be used to create a
backdoor
Assault
• Control administrative rights on a machine
• Prevent attackers from gaining administrative
rights on the system
Attacks - Defense

• Location obscuration
• Log manipulation
• File manipulation
Obfuscation - Smokescreen

Attack Defense
Access & Escalation
Exfiltration
• Restrict access and monitor. Password and session
management
Sustainment
and incoming as much as possible and still function
properly
• Audit accounts, system access, open ports, and other
items that could be used to create a backdoor
Assault
• Control administrative rights on a machine
• Prevent attackers from gaining administrative rights
on the system
Obfuscation
• Control admin rights on a machine
• Log real-time file and log manipulation
• Export logs to secure systems
Attacks - Defense

Defending Against
Cyberattacks with
Bomgar’s solutions

Attack Defense Solutions
Reconnaissance • Control Sensitive Information in Public
Domain
• Privileged Identity
Scanning • Prevent information leakage to
scanners
• Privileged Identity + Endpoint
Privilege Management
Access & Escalation • Control all passwords for accounts that
allow escalation or privileged access
Exfiltration • Restrict access and monitor. Password
and session management
• Privileged Access + Privileged
Identity + Endpoint Privilege
Management
Sustainment • Harden systems and applications;
restrict outgoing and incoming as
much as possible and still function
properly
• Audit accounts, system access, open
ports, and other items that could be
used to create a backdoor
• Privileged Access + Privileged
Identity + Endpoint Privilege
Management
Assault • Control administrative rights on a
machine
• Prevent attackers from gaining
administrative rights on the system
Obfuscation • Control admin rights on a machine
• Log real-time file and log manipulation
• Export logs to secure systems
• Endpoint Privilege Management

• 2018 Privileged Access Threat
Report
• Bomgar Privileged Access
• Bomgar Privileged Identity
• Endpoint Privilege Management
Additional Resources

Questions?
Thank you for joining us!

The 7 Steps to a Successful Cyberattack: How to Defend Against Them

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a The 7 Steps to a Successful Cyberattack: How to Defend Against Them

Semelhante a The 7 Steps to a Successful Cyberattack: How to Defend Against Them (20)

Mais de Bomgar

Mais de Bomgar (6)

Último

Último (20)

The 7 Steps to a Successful Cyberattack: How to Defend Against Them