now as an ERISA more obvious or cuanto
antes by maintaining a por ser Mariana
Pino come representing the defense joint
command the reason for coming here is to
let you know what we do now unit
everybody knows about the about what
defense our unit does everybody knows
what a fighter is submarine etc but
right now the chief head of state has
created this cyber defense unit with a
joint command as in charge of it
phenomena
for comment re-mose I like to begin with
a description of cyberspace which is the
place where war scenario takes place we
have the first domain which is countries
or units start fighting on land then we
have the sea and River River unit and
the first world war we world war 1 we
see that planes start being used after
this we have fifth domain NATO etc
[Music]
missiles etc and all these things but
right now the Armed Forces be realized
that not enough attention was being paid
that the security within the devices
that had been connected and networks
because we mustn't forget that the all
the networks emerged thanks to military
initiative for instance the network said
that you used to connect yourselves to
communicate amongst yourselves and in
Spain we created created defense Joint
Command in 2013 before NATO recognized
the existence of the fifth domain and
operations inside the fifth domain
this means that according to Article
five and
a treaty that we signed an aggression an
attack in cyberspace would be like an
attack in space so that is clear how
important this is for NATO from 2018
onwards new specific unit was created in
order to give service to and within
military operations we have many devices
that are interconnected I'm sure you've
seen drones of flying soldiers on land
also interconnected through the net and
we come to a scenario similar to the one
you can see here lots of support lots of
control of the situation lots of
information the rest of the domains
depend on the security and an
interruption of communications may
represent an important blow to the
enemies so therefore it's a fundamental
to ensure communication communicate the
communications and to be able to
interrupt our communications of the
enemy and this is an addition to
classical intelligence because with a
very low risk it allows to obtain a
large amount of information without
officers exposure we all know that the
three basic pillars of cyber security
are confidentiality integrity and
availability and
so all this so information may be
sequestered information sequestering is
not very important because we may have
backups but for a company it is a
problem to this information
breaking into information or having
information stolen and having them
exposed in WikiLeaks the impact social
level is very high enough apart from
this the possibility of having military
projects stolen and this means losing
millions of euros in research for the
company different examples for example
shipyard shipyard as building ships for
the military and also from the point of
view of the military this is also a very
serious problem and also information
that is stolen or referred to be sold
and people steal information from a
country and sells it to another country
so there is also an economic motivation
and there are also ethnic religious
reasons that may lead to information
theft and there is also a possibility of
destroying a stored information this is
also very dangerous for the military
sector foreign
view the database where all the blood
groups are stolen for instance from a
blood bank all this information is also
important and then there's information
destruction and this also entails an
important cost regarding how much is
going to cost to retrieve all that
information from the previous slide
looking at all the macro network of
operations if you can attack the
availability of the network that
interconnect all these military systems
this also represents a very important
drawback this is not accessible to
everybody because normally we know we
need a very expensive equipment this is
available for countries this is why I'm
showing this transparency Parana
representing Africa this is a
representation of what the cyber threat
triangle is about and the rest of the
presentation will be based on this
drawing in the end this is a risk
analysis and assets that you may have
whether they be networks or information
and you will attack these assets in the
end of the people groups people who for
whichever reason will try to exploit
your vulnerabilities so according to
whether people are more interested in
objectives and
actors will change depending on what it
is they look for money or information or
industrial patents and actors will
change so will motivation and
vulnerabilities may be intrinsic for
instance budgets for sine T by defense
ministries can also be violated everyone
has one same the same server that one
may find in a company is relatively
simple for a hacker who hacker to know
what the your system is like or that you
have that system in your database or
server and at a given moment is to try
and their abilities developing an
exploit years ago when there was a huge
budget and when equipment were different
to what you found in the street right
now we we have the same web server
server than the bank of Santander has
just depends on how good your staff is
when it comes to doing the patching the
main stakeholders that main actors we
have in the cyber world or our enemies
would be sub reminisce this affects our
civilians or companies activists
activists this is a term that came up on
mixing terms hackers and activists these
are people that live in these social
networks and not only they
say what they wanna say but they also
produce attacks and then there's a state
agent things that everybody is thinking
of when they think of CIA or whatever
and then groups that paid by States in
order to try and and we are known if it
is that is companies that are set up in
order to obtain information about
possible interests of their contractors
and in this case what they do is to
devote all their efforts to obtain
information about the targets and then
to exploit that information for as long
as possible this is a very high risk for
the state Emily what is to steal
information and then insiders like the
example I gave you before people like
Snowden people inside a corporation who
all of a sudden start going against it
and they produce huge harm because first
of all they're inside the network and
all the security measures have no effect
and especially here they practitioners
and know what to do in order to damage a
network sometimes people are made
redundant and also they may revenge they
may leave behind a logic bomb and in
order to extract information remotely
another classical thing in no
presentations is what cyberspace is but
from the point of view of the users
users self of a net and we see that
they're in there
Google or the information in Wikipedia
Wikipedia we have Chinese search engine
everything that's in Dexter represents
30% of all the services connected to
internet under the water we have the
Deep Web these are services connected to
the Internet you cannot index because
they are protected by a user and
password an example is the accounts in
the banks of people that you must log
whereas you cannot access and then
beneath this we have the dark web you
can access like to encrypted services
for instance used reporting on criminal
activities pedophilia cetera and the
cyber criminals their main motivation is
basically money so what could happen
somebody whom you think is not a risk
for instance for the Ministry of Defense
somebody who just wants money shouldn't
be for instance or somebody who works as
a mercenary so the country the Hashi
sets up an intermediate barrier cyber
crime is people make lots of money
in 2015 was that that cybercrime was
more preferable than drug dealing so the
more and more countries in Eastern
Europe with their mafias are moving
their business towards a cybercrime
going into a bank with a gun doesn't
produce a much profit doing cyber crime
is much more profitable as you can
imagine and you can do remotely and then
TTP's massive fighting once you find
that an attacker what you need to do is
to moralized
the model that attacker how do they work
we can define a profile of the attacker
you can try and have an idea of who is
attacking you because normally the
defense is reactive normally you've been
attacked first you find out you have
been attacked and you try and find out
what's happened so we try and use to
model the attacker so if you know that
you are the banker sent and they're
those people kill demitri and rob you
you need to protect yourself against
there's techniques used by the attacker
in a case we must be protected against
[Music]
powerful organized groups you try and
bet themselves in the defense ministry
they can buy exploits in the black
market you need to have a much greater
security level than an SME for instance
you need to invest a lot of money in
defense and you need to obtain the
commitment indicator cyber criminals
what they do normally is to go in
through emails and aimed at potential
victims the more targeted the email is
the more credible
is going to be for people to click on it
and type the bank account passwords for
instance people will send you weekly or
monthly a report with a summary of a
bunch of events arms information this
mail comes it looks like a summary from
the net NATO use agents whatever so you
open it up there's an exploit that
infects the machine the attack has done
his homework and did a good
characterization of the victim systems
they know the operating system and the
PowerPoint for instance they can just go
in and I try to connect their server and
keep downloading things in the case of
home cyber criminals probably all
they're going to do is to download a
whole bunch of packages do they want to
stay many years in your network but in
the end me procedures are the same the
only thing is that techniques people who
are attacking this since they have money
they buy exploits they go to the black
market and buy them
they have an ability to purchase to buy
[Music]
some of these systems cost $200,000 you
go into high executives phone and still
the what subs the messages you can
blackmail them do horrible things
hacktivists doing with what happened in
Catalonia all the campaign in the
internet the writing in Twitter and also
they can do you service denial different
targets they considered interesting for
them these activities when tension goes
up the level of ethnic and religious
conflicts people become polarized all of
a sudden they dish to organize our
campaigns through Facebook and Twitter
that are open in order to have a greater
audience and what they do is to allow a
bunch of people to join anonymous once
they used to like blog and they do
distributed service denial somebody a
bit more enthusiastic they will try to
do is to do about like in order to net
in order to attack any targets they want
to attack normally
don't have money to do this some of them
huge attacks different networks networks
you can buy and you can buy or pay
according to the amount of in fact
equipment and have you pay in bitcoins
you have an absolute transmit point the
monofin RS in territory by a network in
order to have some type of
infrastructure within the profiles of
activists you have Steppenwolf's here he
may be terrorists who may be linked to
Isis for instance and maybe somebody
who's black hack and here for which ever
reason decide to do something the normal
thing is for hacktivists to work in
groups these activists are very hard to
detect because they do not deploy their
campaigns in areas that are controlled
by state security cops security forces
and security cops normally study and
focus on a certain type of users and
this entails an economic cost and human
cost
please don't think that they watch every
single thing you everybody writes on
Twitter you may use key words you may
see well these terms have been I've
showing up I don't know how many times
you need to learn whatever language as
being used Java in fact it was kind of
so Hector ist's look for publicity in
their actions a group like Anonymous try
to become notorious if they can do
defacement or spy on a website for five
minutes that's what they are after for
from the state's perspective this is
only damage to the image for example if
ministry's website is hacked or for
example the Twitter account of us then
we're stolen and they really damaged
their image so it's nothing further than
becoming ridiculous well it can cost
somebody their their job for example but
it's not a state level defense matter
when I was talking about the botnets is
that you can control them for example
the operation in Catalonia well they
weren't able to find supporters to
perform massive attacks however if you
pay people for generating 600 gigabytes
per second that is unbearable and in
these cases the economic damage has its
consequences of course
well then we have the attackers with the
state's support these are our greatest
concern they have time and they have
money usually attackers have the time
advantage that is they can attack
whenever they want and when they feel
ready however you need to be on alert 24
hours you know the to avoid threats they
can map your networks map your users
they can prepare fising emails they can
try to introduce a blog they can map
your network you are always on the
defensive so these are people who have
money you have time and all the apts
that big corporations for example McAfee
is Simon tech worker skorsky have and
published reports on different campaigns
carried out by the same groups of people
using different names but what they
leave behind is a fingerprint sometimes
they want you to know that it was them
and well that allows you to characterize
them so they usually change their
tactics but the techniques are usually
the same and the entrance vector is
generally the facing vector
they've also adapted themselves to
defensive measures if you know a little
bit about how defensive devices have
evolved and what probabilistic detection
is well they know that in the past when
you characterized a network you could
say well computer that is encoding
information in on a Saturday at 4:00
a.m.
and malicious why because nobody is
working on a public building at the time
and on that day so if the computer is
connected on a Saturday night that is
totally abnormal and if they is
extracting Jacob Ides of information
that is a clear attack and the
consequences of that attack cannot be
seen until until the Monday after
therefore you need a 24/7 monitoring
service in order to monitor 24/7 that
something is going on so when the
attackers realized that they cannot
connect and extract that information
they decided to change their tactics and
they decide to attack during the daytime
and extract smaller amounts of
information so in the daytime when
people access for example sports
websites or food web sites well that
traffic can be masked if your detection
system is good enough you'll be able to
find out that the connections take place
in China or Russia or other foreign
countries but still when they realize
that you are controlling certain IP
addresses they are going to use all the
tactics for example now we're using
Dropbox accounts then you close accounts
but they will try something else so they
always find the way to access the
information that's why this last point
is important in 2012 the window for
filtering information the deadline was
416 days this figure has gone down with
time but these are the days when they
can still documents or reports or
anything from you well this is partly
due to the fact that the expenditure on
defense has increased as well
so then we have the insiders they work
in the organization they are hard to
detect because if they are
administrators or if they have
privileges inside the company for
example accessing the data servers or
sometimes they can access paper files
well they are internal threats and the
only way of detecting these threats is
not only publishing it on social media
you need to be alert to anomalous
situations at work in order to detect
these people fighting back in the
Mannings case this was discovered
because this guy thought that the u.s.
practices in Abu Ghraib were unethical
and the same widths now than that
filtered information that thought was
dangerous for the US population so if
this happens in a company they will
probably fire their IT department and
end up outsourcing the service so we
need to be alerted to these things and
and try to prevent attacks from
happening a way of finding out about
malicious activities is the use of honey
pots or honey nets a honey pot is what
it is a pot full of honey a decoy that
is a group of servers with marked or
labeled information this is you use true
and false information in the same
document and if you see that the
information has been filtered to the
press for example and you see that the
fake news came up you can discover how
it was felt
you can deny the authorship of the
document and at the same time you can
put up an infected PDF file for example
for them to download so this way you can
practice who which user in the network
pulled out the files I underlined the
term user why because in digital
investigations it's important to say
that this was done by a user through an
equipment through machine the authorship
the hue of the Criminal Investigation is
more complicated in the cyber world this
picture helps us understand a little bit
better what I have just said if the
criminals are on the left and they
attack massively they are only
interested in money so the bigger the
ransomware campaign the better the more
infected people the more money for them
however on the other end of the error we
have the insiders the insiders have the
very precise targets they are going to
attack their company only then
you can trust your allies and for
example if you are from NATO you can
discard a number of nations that want
attack here then we have competitors if
you are Samsung for instance you can
suspect that IBM or other IT companies
are trying to find its secrets against
you then we have criminal hackers that
look for money and sell the services to
the Mafia and also to foreign nations
for example an person who's unemployed
and who knows some hacker to help them
out that could be in a scenario that
could be a scenario - but mostly their
services are provided to mafia groups
that pay very good salaries by the way
now we have the network defense based on
intelligence this is as follows if
you're able to find out information
about what's going on in your networks
in terms of security you have to
implement that as a defensive measure if
you find anomalous traffic you must be
able to characterize it and create a
rule so that that detection capability
turns into something physical so that
with that rule you can prevent things
from happen if you have advanced methods
you can only you can not only detect but
also prevent however there are always
analysts behind the attacks and no
machine will ever outperform and
and his capacity of telling if there is
a false positive or a real case if you
let machines to control the total
network traffic you would probably be in
a mess now going back to attackers a
PT's will try to deceit you time and
time again which are common in large
corporations is that they buy io C's
indicators of commitments why because
it's difficult for you to characterize
all threads or have a global vision of
the entire system for example a provider
such as Simon Tech has more than 20,000
probes all over the world whereas in
your company you're only able to see
what is happening in your company but if
your peeps are everywhere you know that
an attack taking place in Taiwan may
come to Europe in a couple of days
because this is a global issue so a file
an infected file can be exported very
easily everybody works with the same
hardware with the same operating systems
so the victim operating systems may be
victims also in the other corner of the
world so if you take it your attacks or
if you target your defense you will be
better off because you know what's
happening to you and what's happening to
others recommendation is not to buy that
kind of information from many different
providers if you compare the information
between three or four companies most of
the results will match they have
agreements
among themselves to share signatures so
the hashes are interchangeable and the
companies exchanged them here we are
talking about detection beyond the hash
we're talking about behavior network
connections that can be inside the files
the companies are competitors and they
create more advanced devices more
advanced that the hash themselves so I
can find out what they are doing the
login used in Windows for example if all
that information is used as a signature
inside the malware that costs a lot of
money because it requires a great amount
of time for research and not all the
companies can afford that we are the
state and we have a dedicated person we
have more where investigation Department
in what we do is to characterize our
information but we complete that with
external information because if you are
too focused on what is happening in your
network only you won't be aware of what
is going on elsewhere so instead of an
external provider we use our own
providers with a mis platform that is
used for the exchange of Io sees and if
that source is trustworthy it is very
useful but if you are only interested in
your own business and you don't want to
share your IOC's or your results then
you are worse off with respect to your
competitors i sees our indicators of
compromise they may be atomic that is
tiny very small undividable malware they
can be computed for example the hash
Hanjour file and i have the signature
and i can easily define it as malware
they won't be two files having the same
hash some attackers know that you can
detect there are hashes so what they do
is make small modifications and the code
in order to release different dogs and
all the ones use diffuse logic which
look for blocks instead of performing
the global search and if there are
partial coincidence there are chances
that that file is indeed infected then
there is the behavior if there is a
process that always connected to the
same IP address we can identify that at
least it belongs to the same family and
we can also detect the mode of operation
it's easy to find that they come from
either Russia China or North Korea which
are the countries that typically hit
European business this is the Mitra
system developed by a US company f-35 is
one of its most ambitious and well known
projects and sadly it became famous
because supposedly Chinese operation got
into their networks for many years for
many years they were using their servers
and they were drawing information from
the f-35 project so the Chinese were
able to copy all that
technology they weren't able to clone
the turbines but many of the f-35
features were covered by the Chinese who
saved millions of euros planes are only
defensive but they are very good combat
planes anyway so they learned from the
plane and they from this example and
they decided to create their own
Department that's how they came up with
this modeling and we've all used it
because it's very good and attacked
starts with a recognition phase trying
to look for targets the operating
systems they have etc and then they go
to the weaponization that is I need to
find a weapon against it I need to find
a medium for infection whether it is an
email a flash drive something that can
be downloaded from the internet a fake
access point well you need to find your
way then the next phase is the
exploitation phase remote control
execution and maintenance people try to
maintain the persistence as I explained
before and against that model we have
the reverse method the intuition kill
chain we use the attackers
vulnerabilities in order to get him so
the sooner you can get them the less the
damage so it's important to start
detecting that they are downloading
packages from suspicious IPS or finding
out computers that are compromised in
the network you can find out how long
they've been in your system etc
well you know the to be a child in these
you need to move as fast as possible to
the delivery face so that they don't get
inside your organization the in the
ideal world you would need to get them
in the recognition phase having people
going into for detecting information
about exploits because if you find out
that they are trying to exchange that
information you can react promptly and
patch your vulnerabilities and all the
way of modeling this is this one from
the hands Institute it is the so-called
diamund model it is similar to the
former one but it adds the social
political ring for example with the
Catalonian issue there is another thing
to be borne in mind which is the social
context and to wrap up this is the cycle
for event management first we detected
the event we respond promptly and we
analyze the intrusion it has to cover
the planification face to be effective
if there is no planning the rest of the
chain is worthless so this is a chain
that needs to cover each and every step
you know we have a flow chart showing
how the operations center and the
research units exchange information for
detection
so that they feet the detection
capability and benefits the organization
from the defensive perspective in our
case we work this way and in our
operation center we need people
everything updated the probes setup and
if you want to have your staff working
24/7 or not that's up to you you have to
train your personnel and/or make them
capable of detecting the alerts and that
was all for me yeah if you have any
questions
yes what about yes
[Applause]