OK today we're going to be talking about the proactive security team methodology and this is something
that I came up with after doing a lot of research in different engagements throughout the last 20 years
and it was actually pretty interesting.
I took a look at different implementations that I was involved in and how things were successful or
unsuccessful and the reasons why they were unsuccessful or successful and this is the the model that
I came up with right now that I use on every engagement to make sure that I can try to improve the security
teams that I have and the security teams that customers have on different sites.
Now this is a living model model.
Every model I think in my opinion is has to be dynamic because first off threats are always evolving
into more complex types of threats cyber threats.
So we need to take all of these things with a grain of salt.
Like I always say throughout the entire course and discussions.
There's no such thing as a silver bullet but these things do work.
They've been tested in real life and they make a lot of sense.
And I think once we go to the points you'll see that as well.
So here basically we have a seven point seven step process here.
It all starts off with identifying and assessing the state of where you are where you need to be starting
to map out different things and different plans so that you have a good idea of what different types
of tactical steps you need after you have that fundamental strategy in mind.
Now I hope throughout the course a lot of the things that we talked about make a lot more sense to you
now.
And that's the reason why the last chapters are towards the end of the training and not towards the
beginning because they basically assume a certain type of knowledge so that you can take those basic
concepts and put them into a methodology.
So with identifying and assessing where we are things like the risk management process fit in here very
beautifully because when you use these processes the right way it'll actually help you identify what
types of risks that you're dealing with.
And it will help the security teams build the right type of architecture mechanisms rules Excedrin so
that they can defend these different assets within the company.
And if you don't know what the assets are then you're not going to be able to defend.
Right.
So the second step is research and dynamic threats.
Third step is basically keeping track on innovation.
Lifelong Learning is a very important piece of this.
We talked about making Intel actionable obviously including people is one of the most important aspects
that a lot of people most people forget verifying and checking the things that you have implemented
and updating and modifying.
So let's take a look at these seven steps in more detail.
So like I said identifying assessing we're talking about where we are where we need to go what different
infrastructure points we already have.
What different things that we can improve on things like the secure network design are absolutely detrimental
to the success of this.
So those of you that may not have the skills the technical skills to understand secure network design
and how ideas IPX firewalls honeypots different types of sensor arrays cetera fit into a proactive and
defending network then these are obviously topics that you need to read into.
We'll think about adding stuff like honeypots and sensors into this course as we move forward.
I'm not really sure yet but just make sure you understand those concepts so that it will help you understand
why secure network design is so detrimental to a very high security posture.
Right.
OK.
So the research into dynamic threats this is where the portions like reverse malware engineering come
into play.
So if you understand those threats how dynamic they are and how they work and you have the skills to
be able to assess those threats then it'll give you a better security posture because you understand
what these things are doing.
And you can also understand what different types of code can execute different things.
Now if you're in and not you'll be paying more attention to the network traffic and network security
aspects of these things VPN etc..
But if you're in the sakta security operations team then you obviously need to understand what malware
is and what different types of codes do what.
So I'm starting to understand assembly code which is tough but you need to get into it.
Dive into air knowing C++ and all those other languages that are the updated malware that we use those
root kits the boot kits the exploit kits that are out there and there's a lot of new ones coming out
all the time.
There's some really new ones in the last few weeks that we've discovered.
So you know keep an eye on this keep on doing research into dynamic threats because this is part of
the next step which is innovation and lifelong learning.
In my opinion the research that I've done in the past for my masters and for other academic reports
has indicated that security teams that are innovative or that need to be innovative they also have an
environment where creativity can happen.
Now this is important when you lead these teams but it's also important if you're part of these teams
right.
So if you're part of these teams and you understand this this is not going to be anything new to you
but for a lot of leaders this is extremely new.
So if you're leading a team of folks in the in the soccer knock you need to add here to what I call
lifelong learning now lifelong learning means that you never stop learning.
You know you need to have this type of passion because the point before this dynamic threads they always
evolve.
So you need to stay ahead of the game.
You need to be able to do research you need to be able to have that passion to continuously and learn
something new because you never know the new things that you learn if they'll be able to help you protect
your network from threats that everyone else doesn't know about.
Now if we talk with each other realistically in real life there's so many zero day vulnerabilities are
the threats coming out because applications and operations systems are inherently insecure because humans
basically create these.
Right.
So there's a lot of stuff that's out there that we know is not working right but we haven't had the
verification of that yet so we need to assume as a follow up thought of that that all the operating
systems and applications we use are inherently insecure and that it's just a question of time until
information comes out with the new threats.
And this is a game changer it sounds like it's a no brainer but a lot of people don't think this way.
And you need to be able to think like this.
I'm not saying paranoid but be aware that this happens because spyware and all these different other
types of applications they use this information.
And a lot of these threats are not publicized so you need to be really careful and proactive so the
next piece actionable intel.
What this basically really means is if we're collecting something on a firewall IPX idea seems solution
honeypot et cetera.
All this information has one objective.
It's to give you the information that you need to be able to protect your assets.
You need to ask yourself the question if you're buying a technology if you're in charge of a technology
if you're creating the rules for all these different types of mechanisms whether it's snort whether
it's ArcSight whether it's basically other different types of solutions OS etc. you need to ask yourself
the question are the rules that I'm configuring and the solutions that I'm using.
Do they help me or hinder me.
Now if you have a choice it makes a lot more sense to incorporate seems IPX.
I guess it's you're into security or design into the overall security infrastructure so that you only
get the alerts the reports and the information that you absolutely need to do your job quickly.
Now if all these different mechanisms are giving you too much information and you can't depend on them
they're not consistent.
They're not in the near real time or real time then they don't really add any value.
And the question is do you really need these things.
Right.
And this is a tough question to answer but believe me I've done a lot of different seam solution implementations.
Ideas firewalls and I've seen so many teams whether it's some of the biggest companies in the world
they had absolutely crap solutions and the rules they configured everything and the amount of information
at the NOC and sacque were getting so much information that they couldn't use it.
Everybody saw the alerts they didn't pay attention to them.
Everything was critical.
And when somebody broke into the network obviously at some point somewhere deep down in those data mines
there was some information indicating the attack.
But since these teams couldn't cope with the information overload it did exactly the opposite.
So actionable intel means that every system that you have every type of ticket every type of mechanism
process procedure you have in security has to help you.
If it doesn't it's hindering.
You need to question its value people.
People are one of the most important aspect that unfortunately so many security teams leaders et cetera
forget the right people the right skills.
Going back to innovation going back to lifelong learning going back to having a passion for technology
and doing research understanding actionable intel people are a critical piece of any process.
Now this isn't lip service it just makes sense if you take a look at the lot of a lot of the academic
research and research that companies do.
If you take away the aspect that they want to sell you something a lot of the research on people is
absolutely true.
We talked about the human factor we talked about when people help in security awareness campaigns and
that other training that I do when you include people you see Eureka that the amount of successful social
engineering attacks go down.
You see that password complexity ex-editor when people have gone through these tests and they've been
burned then through security awareness campaign when you include people in those processes like Incident
Management to see certain Excedrin that it improves the amount of information you get and improves all
of these processes and it makes you more secure.
It's a no brainer.
Include people into the security process let them know why you're doing this give them the information
they need to help you.
If you're not then you're doing something wrong.
It's an ultimate epic fail verifying and checking again always verify the things that you implement
the policies that you implement that makes sense that the help that they don't hinder a lot of companies
here do the mistake again that we implement the entire whole entire 9 yards of a security policy in
the first draft.
It's not realistic.
It's not going to work.
Trust me if you don't trust me do it yourself.
Implement a security policy that has more than 10 items.
It's going to be way too complex.
People are going to find ways to work around the policy.
And it's not going to do you any good.
So I've seen a lot of companies that implement a security policy like the BSI handbook mist and sands
and other things in the first draft.
It doesn't work updating modifying every process every procedure that you will ever deal with has to
be dynamic simply because things change any policy any procedure excited that you have that is does
not incorporate updates and modifications is doomed to fail.
Recognize this.
It's a fact of life.
I know people don't like change but you know suck it up.
Sweet Cheeks.
Updating and modifying is a part of the proactive security team methodology.
Continuously check the things that you implement make sure that they work or not.
When you do for instance penetration testing you're not doing these penetration tests to scare people
but you really need to think about how a hacker will break in to your network.
And I know a lot of people want to scare you with social engineering that there's always a way to get
in and there ultimately is but you're tying penetration testing and all of these things into a process
that makes sense.
So you can't check everything but you can check can check as much as you can by having red and blue
teams.
They make absolute sense and anybody that says they don't has no idea of security.
So when you do have these things and make sure you don't just do this for paranoia make sure that it's
incorporated into the entire security process and that everything you find makes sense and goes into
modifications to your existing security policy.
So the second pieces when we implement projects when we implement proactive security methodology what
we're doing is we want to move towards better security.
And this basically requires that method and a standardized approach.
So at the end of the day everything requires a vision and a strategy.
This vision and strategy ties into the business strategy of every company or entity.
So we need to make sure that we speak the business language and we need to make sure that we understand
and both speak the same languages whether it's security team and the rest of business I.T. energy security
our core business processes.
Let me say that again I.T. and I.T. Security are core business processes.
If he doesn't work you can't write invoices you can't write invoices you're not generating revenue.
If you can't generate revenue your company will go bust.
And that's the end of this discussion.
Sizzles and CEOs and CEOs need to understand this they need to get this and everybody in the team also
has to have an affinity for the business and discussing security in business terms.
Now we always have to train we always have to educate.
We always have to do these things to the business because they don't understand our world.
Keep this in line.
So we need to talk about the assumptions about how we work.
We need to list the amount of needed services that we have in the company.
Then we need to list the current state and the challenges that we face.
Then we move on to the next step which is develop that future vision and reality.
And then we start building the road map to implement that future vision.
And while all this stuff is going on we continuously implement and monitor how we're doing.
So we make the assumptions about how we work that will lead us to the different types of network services
applications servers.
Cloud yes or no that we need then will list the business and the I.T. and Iraqi security state and challenges
wrapped them into that region and what our reality is going to be or is and then we start building the
road map to implement that future vision we implemented and continuously monitor OK.
So how we work as a business what are needed services are we list them what does our current state and
which challenges do we face as a business in the market and in security.
So everything we do has to have a business case business proper business reason.
So then we create that vision of strategy so that we know where on earth we're going to be going.
And then we can build the strategy we can build a tactics around that strategy which results in a roadmap
and that will get us to that goal in that mission.
And after we have that we implement that plan.
We monitor it towards the roadmap see where we're going where it's right where it's not where we need
to modify and that's basically the end of this process.
So and then to wrap things up when we take a look at the productive security methodology we have five
different steps.
So the initial stages what we're doing we start building up these processes and we're always moving
towards proactive security.
The second thing is we talk about these basic processes and procedures and we start implementing them.
We further divided the processes that define those processes then we start managing and being more reactive
in security and then Level 5 is where proactive security team were predictive we're learning organization.
We wrap up all these different things to make sure that we're continually proactive.
We have systems that provide actionable intelligence and everything we do has a business reason with
a grain of salt.
And it's proactive.
We can predict we can continuously learn from the things that we're collecting.
And this my friends is the magic silver bullet if there is one to implementing a security team in methodology
that really does work and doesn't waste your money.