Development and operations a practical guide

Download 4.62 Mb.

View original pdf

Page	7/96
Date	11.02.2023
Size	4.62 Mb.
	#60628

1 2 3 4 5 6 7 8 9 10 ... 96

1 Joe Vest, James Tubberville Red Team Development and Operations

Consider This
A phishing attack leading to compromise is NOT the
fault of an end-user but rather, insufficient security
controls of a target environment.
End-users are often blamed for compromise due to a phishing attack. Security defenses are not intended to hinge on a user’s click decision to click or not. If a user who falls victim to a phishing attack leads to system-wide compromise, that user already had the potential to elevate privileges or otherwise compromise the environment.
Why is this scenario successful?
Organizations often have the wrong mindset to security defense.
Users are blamed for clicking links
User education is only one piece of defense insecurity operations. Users will click. It’s their job!

Policies, procedures, and compliance measure security
These are extremely important to a security program but often only represent the minimum needed to comply with a standard. Treat compliance as the stick at an amusement park. You must be "this tall" to

ride.

Log everything You never know what you need
Security operations often log a tremendous amount of unactionable data. Logging maybe due to compliance requirements, vendor recommendations, lack of understanding of data sources, or abetter safe than sorry' mindset. This misunderstanding leads to bottlenecks and overburdened security analysts.

Patch, patch, patch. Threats only use exploits
A common misunderstanding or viewpoint is threats only use exploits. This is far from the truth. Patch management is an essential factor in a comprehensive security program that helps with attack surface reduction. Threats understand this and may change their tactics. This concept is further explored and discussed in the text as exploitation without exploits”.

Our security tools will save us
The security industry is very dependent on security tools. Unfortunately, many do not know how these tools work. The lack of understanding leads to poor tuning and misconfiguration. Tools should improve the efficiency and capability of our security defenders and analysts and not drive security operations directly. These are tools. A hammer and nails won't build a house without a carpenter.
There are numerous reasons why the above scenario is successful. These bullets are lighthearted attempts at humor they are more often than not issues in practices and thought processes of real- world organizations.

Download 4.62 Mb.

Share with your friends:

1 2 3 4 5 6 7 8 9 10 ... 96