Speaker 1: Welcome to the deep dive. If you need that shortcut
Speaker 1: to being really well informed, you are definitely in the
Speaker 1: right place. Today we are taking on one of those
Speaker 1: really persistent, kind of frustrating problems in technology cybersecurity defense.
Speaker 1: We're diving deep into this whole concept of the active defender,
Speaker 1: asking how do we actually move security professionals out of
Speaker 1: that constant reactive mode that burn out and into something
Speaker 1: more proactive a well a winning mindset.
Speaker 2: Yeah, and our mission today is, I think crystal clear,
Speaker 2: we really have to fundamentally understand why the traditional passive
Speaker 2: security model just isn't cutting it anymore. It's failing. We're
Speaker 2: going to explore how adopting the knowledge the insights from
Speaker 2: the offensive security community, that hacker mindset is maybe the
Speaker 2: only way to really transform your defense posture.
Speaker 1: And when we say failing, I mean we have the
Speaker 1: numbers right. The stats from the sources we looked at
Speaker 1: are genuinely well terrifying this traditional approach. It basically means
Speaker 1: you sit back, you wait for an alert. You're waiting
Speaker 1: for an attacker to make some loud noise that tells you, hey,
Speaker 1: I'm already inside.
Speaker 2: Exactly, and when they finally make that noise. The real
Speaker 2: question is how long have they already been there? The
Speaker 2: average to get this, The average time to discover and
Speaker 2: contain an attacker inside an organization's network in twenty twenty
Speaker 2: two was two hundred and seventy seven days.
Speaker 1: Two hundred and seventy seven days. That's what nine.
Speaker 2: Months nine months of undetected access.
Speaker 1: Yet nine months, just think about the kind of damage
Speaker 1: that causes. That is more than enough time to steal
Speaker 1: pretty much every piece of sensitive data you own, to
Speaker 1: set up persistent back doors, maybe quietly map out your
Speaker 1: entire environment for I don't know, a future ransomware attack.
Speaker 1: When an adversary has that kind of unchecked dwell time,
Speaker 1: it's not just a security failure anymore. It's like a
Speaker 1: potential business extinction event.
Speaker 2: It really is.
Speaker 1: And that number two hundred and seventy so it was
Speaker 1: only down slightly from two eighty seven the year before.
Speaker 2: Right, It basically tells you the status quo is well
Speaker 2: static failure. It's not improving meaningfully. That two hundred and
Speaker 2: seventy seven day metric just confirms it. Waiting for your firewall,
Speaker 2: your basic endpoint tool to flag an IP address that's
Speaker 2: obsolete thinking, and that's precisely why we need this actor
Speaker 2: defender concept. Now, they aren't launching counter attacks, let's be clear,
Speaker 2: that's illegal, it's unwise, but they are cultivating that hacker mindset.
Speaker 2: They use the offensive knowledge, the attacker techniques to understand
Speaker 2: the adversaries thought process even better than the adversary understands
Speaker 2: their own defenses.
Speaker 1: Okay, let's unpack that the core philosophy here. We need
Speaker 1: to define this hacker mindset because I think for most
Speaker 1: people that word conjures up some figure in a hoodie
Speaker 1: and a dark basement like on TV. What are the
Speaker 1: key traits that security pros actually need to adopt.
Speaker 2: Yeah, it's definitely not about the attire or any dramatic flare.
Speaker 2: The mindset. It's really defined by maybe six essential traits curiosity, creativity, patients, persistence, agility,
Speaker 2: and maybe most importantly, nonlinear thinking. The defender has to
Speaker 2: stop being satisfied with just getting an answer. They need
Speaker 2: to start relentlessly asking why, why not? What if they're
Speaker 2: constantly trying to make the system do something it was
Speaker 2: explicitly designed not to do.
Speaker 1: Right, And you found some incredible historical examples of that creativity,
Speaker 1: didn't you. Let's talk about the freakers, the original sort
Speaker 1: of tech hackers focusing on phone networks way back like
Speaker 1: sixties seventies.
Speaker 2: Oh. Absolutely, that's just pure brilliance born from curiosity. They
Speaker 2: didn't just stumble upon a secret code. They spent incredible
Speaker 2: amounts of time pouring over really obscure, really technical documentation
Speaker 2: stuff put out by the phone companies themselves, just trying
Speaker 2: to understand the deep inner workings of call roading. And
Speaker 2: their creative breakthrough it came when they realized that generating
Speaker 2: a very specific audio tone twenty six hundred hertz could
Speaker 2: trick the phone line, make it think the line was idle,
Speaker 2: which then let them make free long distance calls.
Speaker 1: And the legend, the famous part is that specific tone
Speaker 1: could be made by a toy whistle, one found in
Speaker 1: cap'n Crunch cereal boxes. I mean, that level of just
Speaker 1: lateral creative thinking. It's exactly what most security processes seem
Speaker 1: to lack today.
Speaker 2: Absolutely, and that right there it immediately highlights the huge
Speaker 2: difference between linear thinking and what we're calling graph thinking,
Speaker 2: which is really the core of this active defender concept.
Speaker 1: Okay, so how do traditional security teams usually miss that
Speaker 1: that lateral thinking. Are they just stuck in a very specific,
Speaker 1: maybe restrictive way of processing information.
Speaker 2: They often are, Yeah, the traditional defender. They're usually taught
Speaker 2: to think very linearly. You know, if A happens, then
Speaker 2: check B. Follow the steps they become excellent at following.
Speaker 2: Checklists could be internal hardening guides, maybe the CIS controls,
Speaker 2: or a defined flow chart like the sans's incidant response process.
Speaker 2: It's all very step by step, a straight line, and.
Speaker 1: That linear thinking. It just misses the bigger picture completely,
Speaker 1: doesn't it.
Speaker 2: It only sees the individual steps, the trees, It misses
Speaker 2: the forest. The attacker, however, thinks in graphs, in connections.
Speaker 2: Their actions aren't usually a straight line towards one single goal.
Speaker 2: It's more like a mesh, a network of potential connections
Speaker 2: and pathways. They are deliberately looking for relationships between seemingly
Speaker 2: disparate data points that no single checklist, no flowchart could
Speaker 2: possibly anticipate. It's almost holographic in nature.
Speaker 1: So okay, if I'm a defender trying to focus on
Speaker 1: the graph, what's a tangible example in security? Like when
Speaker 1: am I just seeing versus when am I truly observing
Speaker 1: that graph.
Speaker 2: That's a great question. So you see a single event, right,
Speaker 2: a dot on your dashboard, let's say a log in
Speaker 2: fail you're alert from a user in accounting. Okay, noted,
Speaker 2: But you observe the graph when you realize, HM, that
Speaker 2: log in failure happened exactly thirty seconds after a weird,
Speaker 2: non standard port scan was logged against the database server,
Speaker 2: and then maybe ten minutes later, a completely different but
Speaker 2: legitimate admin account suddenly queries in an unusually small, very
Speaker 2: specific data set from that same database. See. No single
Speaker 2: alert there is necessarily critical on its own. But the graph,
Speaker 2: the connection between the odd timing, the port scan, the
Speaker 2: specific data query that reveals the attackers underlying patterns, their intent.
Speaker 2: It's exactly what Sherlock Holmes meant, right, You see, but
Speaker 2: you do not observe.
Speaker 1: Wow, okay, that makes the distinction incredibly clear. Thank you.
Speaker 1: A passive defense is so demonstrably well ineffective. Why are
Speaker 1: organizations still so stuck? Why is that two hundred and
Speaker 1: seventy seven day, twelve times so stubborn, so hard to
Speaker 1: bring down?
Speaker 2: Yeah, it consistently seems to boil down to two really
Speaker 2: heavy forces holding organizations back organizational inertia and internal culture
Speaker 2: and inertia. Is that classic really frustrating? Well, that's just
Speaker 2: how we've always done it a pitfall for decades, security
Speaker 2: meant perimeter defense, build bigger walls, stronger firewalls.
Speaker 1: Right, a totally nineteen nineties approach for a twenty twenties world.
Speaker 2: Exactly, that model just completely falls apart when your employees
Speaker 2: are working from home from anywhere, and your most valuable
Speaker 2: data it's living across three different cloud providers. Maybe more.
Speaker 2: Inertia also shows up in how we misuse tools. Organizations
Speaker 2: spend millions, literally millions on passive protection tools SIMS intrusion
Speaker 2: prevention systems. They're designed sure to give consistent protection, but
Speaker 2: defenders often end up relying on them exclusively just watching the.
Speaker 1: Dashboard, which leads directly to that infamous tunnel vision. Right.
Speaker 1: You're only looking at that specific dashboard, only reacting to
Speaker 1: the specific alerts the tool decides are important enough to
Speaker 1: show you.
Speaker 2: And the result it's inevitable alert fatigue mass burnout. If
Speaker 2: you're getting bombarded with say, ten thousand low priority alerts
Speaker 2: every single day, you physically cannot look for that critical
Speaker 2: graph pattern. You stop trying and compounding all this is
Speaker 2: the financial inertia, the reality that cybersecurity is still overwhelmingly
Speaker 2: viewed as a cost center. Really so organizations are chronically understaffed.
Speaker 2: They often won't commit money to essential validation activities, things
Speaker 2: like active threat hunting or frequent realistic penetration tests, and
Speaker 2: that lack of investment just reinforces the passivity. It's a cycle.
Speaker 1: And beyond the money, beyond the tools, the culture itself
Speaker 1: often seems to breed passivity, specifically through siloing, right, departments
Speaker 1: not talking well.
Speaker 2: Siling is devastating, absolutely devastating. Think about it. Crucial observations
Speaker 2: made by say a networking engineer about some unusual traffic patterns,
Speaker 2: or maybe a developer noticing some bizarre latency in an application,
Speaker 2: that information might never reach the security team. Why Because
Speaker 2: they don't have a shared framework or maybe even a
Speaker 2: shared goal. They operate in bubbles.
Speaker 1: And then there's the flip side, the shadow it problem,
Speaker 1: which is always a great point of friction.
Speaker 2: Users get frustrated, right, yeah, central it is too slow,
Speaker 2: too rigid, So what do they do? They just employ
Speaker 2: their own tools, Trello for project management, maybe WhatsApp for
Speaker 2: quickcoms outside of any central control and boom. This drastically
Speaker 2: increases the attack surface in ways it doesn't even know about. Now.
Speaker 2: A passive defender sees shadow it and their first instinct
Speaker 2: to just shut it down, block it. But the active
Speaker 2: defender they see shadow it and they ask a different question,
Speaker 2: why why did the user feel they needed that tool?
Speaker 2: What legitimate business function was it? Maybe preventing or making
Speaker 2: too difficult. They use that discovery as an opportunity to
Speaker 2: maybe streamline the official processes, not just play whack a
Speaker 2: mole blocking things.
Speaker 1: The shift and perspective is so crucial, isn't it moving
Speaker 1: from security as just a roadblock to security as an enabler.
Speaker 1: I really liked the analogy used in the source material
Speaker 1: comparing security to driving a high performance racecar.
Speaker 2: Yeah, it's the perfect summary. I think of the cultural
Speaker 2: shift that's needed. If you think about security controls as
Speaker 2: the brakes on that race car, Well, the brakes don't
Speaker 2: actually make the car go slower overall, they're what allow
Speaker 2: the car to go faster safely. They let the driver
Speaker 2: take deliberate, well managed risks while still maintaining control through
Speaker 2: the corners. Security has to be seen the same way,
Speaker 2: enabling the business to move faster, smarter, not just introducing friction.
Speaker 1: Okay, so we know we need this fundamental shift. It's
Speaker 1: clear how does an organization or even an individual defender
Speaker 1: actually transition go from being a passive monitor to an
Speaker 1: active defender. It sounds like it requires a kind of
Speaker 1: immersion into the very culture you're trying to defend against.
Speaker 2: That's exactly the starting point, immersion, and maybe the first
Speaker 2: hurdle to jump is just getting over that media portrayal
Speaker 2: of security experts, you know, the myth of the solitary
Speaker 2: extraordinary genius savant like you see in shows like Mister Robot.
Speaker 2: You don't need to be some reclusive genius coding in
Speaker 2: a basement. You just need to be willing to engage,
Speaker 2: to listen and to learn from the people who actually
Speaker 2: specialize in breaking things. The offensive community.
Speaker 1: So where do we find this community, this offensive security knowledge.
Speaker 1: It's not all just lurking in hidden forms on the
Speaker 1: deep web business, No, not at all.
Speaker 2: It's actually very accessible surprisingly, So yeah, one of the
Speaker 2: best entry points is probably local communities. Conferences like security
Speaker 2: b sides are fantastic for this. They're often free or
Speaker 2: really inexpensive, and they were specifically created to be less corporate,
Speaker 2: more intimate, more about sharing knowledge than say the huge
Speaker 2: commercial events. Also look for local security meetups in your area,
Speaker 2: groups like infosex seven sixteen or hashtag mee sec or
Speaker 2: just a couple examples, places where people just get together
Speaker 2: share what they're working on, what they're learning, really openly.
Speaker 1: And beyond the physical meetups, I imagine online communities are
Speaker 1: pretty key too.
Speaker 2: Oh, absolutely huge online communities on platforms like discord, Slack,
Speaker 2: and yes, Believe it or not, even Twitter, which is
Speaker 2: currently kind of the primary pulse the main platform for
Speaker 2: real time info sharing in the offensive community. The learning
Speaker 2: there is practically instantaneous if you follow the right people.
Speaker 1: Okay, so once you're tapped into that knowledge stream that community,
Speaker 1: what's the first proactive activity and active defenders should undertake?
Speaker 1: You mentioned ocent open source intelligence exactly ocin.
Speaker 2: It sounds fancy, but it's simply using any data you
Speaker 2: can find from publicly available, unhidden sources. The magic isn't
Speaker 2: really the data itself, everybody can find it. It's learning
Speaker 2: to view that public data through the attacker's eyes, understanding
Speaker 2: what intelligence they can gather about you.
Speaker 1: Just by looking around online, right, that's what the analysis
Speaker 1: comes in. Give us an example, how does that public
Speaker 1: data turn into like actual attack intelligence?
Speaker 2: Okay? LinkedIn is a gold mine, an absolute gold mine
Speaker 2: for attackers. They look at employee job titles, their certifications
Speaker 2: listed on profile. If they see, say five of your
Speaker 2: employees listing certified Palo Alto firewall administrator on their profile,
Speaker 2: well guess what they know? Exactly what perimeter technology you use.
Speaker 2: They can start researching specific vulnerabilities for that platform and
Speaker 2: that information. It provides the perfect pretext, the perfect hook
Speaker 2: for crafting a highly targeted, very believable phishing email.
Speaker 1: And beyond social media, you mentioned tools like showdan that
Speaker 1: shows more physical or I guess network exposure.
Speaker 2: Yeah. Shodin is basically a specialized search engine, but instead
Speaker 2: of websites, it finds Internet connected devices, things like servers, webcams,
Speaker 2: even industrial control systems that are accidentally exposed directly to
Speaker 2: the Internet. An attacker uses this to scout for open ports,
Speaker 2: maybe find misconfigured systems, default credentials. And we see it
Speaker 2: constantly too, developers accidentally leaving sensitive stuff like source code
Speaker 2: or API credentials public on sites like gethub, These are
Speaker 2: often the attacker's very first steps reconnaissance, and the active
Speaker 2: defender's job is to replicate those steps, find those exposures
Speaker 2: before the real attacker does.
Speaker 1: Okay, so moving beyond just intelligence gathering, the active defender
Speaker 1: must prioritize active testing. Right. You can't just install defenses
Speaker 1: and assume they work, or assume your backups are actually restorable.
Speaker 2: Absolutely not. Assumption is the enemy here, and we need
Speaker 2: to be precise when we talk about testing. It's important
Speaker 2: to distinguish between attack simulation and attack emulation. They sound similar,
Speaker 2: but they're different.
Speaker 1: Okay, what is the difference then?
Speaker 2: So an attack simulation is usually where you test individual
Speaker 2: specific techniques in isolation. You might use open source tools
Speaker 2: something like Atomic Red Team to test if your defense
Speaker 2: is catch a specific action, like say running one particular
Speaker 2: malicious script. It tests a point solution does this control
Speaker 2: stop this action? But attack emulation is much more advanced.
Speaker 2: It's about mimicking a specific known adversary group, their intentions,
Speaker 2: their goals, and the entire chain of procedures they would
Speaker 2: likely use to achieve that goal start to finish. Emulation
Speaker 2: tests your security program's ability to detect and respond to
Speaker 2: an entire evolving narrative, not just one single event.
Speaker 1: That narrative testing that seems to lead naturally into deception technologies,
Speaker 1: which you mentioned are a more sophisticated tool, maybe for
Speaker 1: the advanced active defender.
Speaker 2: Yeah, deception tech is fantastic, especially for detecting adversaries who've
Speaker 2: already gotten past the perimeter, which let's face it, the
Speaker 2: stats show they often do. You deploy decoys, things called honeytokens,
Speaker 2: or maybe entire fake systems called honeypots. The goal is simple,
Speaker 2: create an attractive looking asset that no legitimate employee should
Speaker 2: ever have a reason to touch or access.
Speaker 1: So it's basically like setting up a digital tripwire.
Speaker 2: Precisely a high fidelity tripwire. For instance, you could create
Speaker 2: a decoy user account in your active directory, make it
Speaker 2: look like some old forgotten service account, give it a
Speaker 2: fake service principle name an SPN. This account is never
Speaker 2: used by real people or real services. It just sits there. Now.
Speaker 2: If anyone attempts to access that account or maybe query
Speaker 2: credentials related to that specific fake SPANA technique often used
Speaker 2: in curber roasting attacks to steal passwords hashes, boom it
Speaker 2: immediately triggers a high priority, high fidelity alert. Accessing that
Speaker 2: decoy is basically a dead giveaway. You know with near
Speaker 2: certainty you have an adversary active inside your network.
Speaker 1: Okay, this is fascinating. Now let's move up the stack
Speaker 1: to the highest level of defense planning. You said passive
Speaker 1: defense often waste time focusing on easily change things like
Speaker 1: IP addresses or file hashes, right, indicators of compromise. So
Speaker 1: if the active defender wants to truly frustrate an adversary
Speaker 1: make their life difficult, what should they focus on instead?
Speaker 2: They absolutely must focus on tactics, techniques, and procedures. Ttpis,
Speaker 2: we need to move our thinking beyond just detecting a
Speaker 2: specific tool and focus instead on the attacker's broader goal
Speaker 2: and the methods they use to achieve it. We can
Speaker 2: kind of visualize this as a pyramid, the pyramid of pain.
Speaker 1: Okay, So at the top, the highest level of value
Speaker 1: for the defender, we have tactics. That's the adversary's overall goal, right,
Speaker 1: like credential access exactly.
Speaker 2: That's the why. Below that, you have the technique, that's
Speaker 2: the general method used to achieve the tactic credential access
Speaker 2: A technique might be dumping all SaaS memory, trying to
Speaker 2: steal credential stored in memory. But the most valuable level
Speaker 2: for the defender to focus on, the place where the
Speaker 2: active defender really concentrates their efforts is the procedure. This
Speaker 2: is the specific implementation of the technique. For example, is
Speaker 2: the attacker using a well known specific tool like mimicats
Speaker 2: to dump LSAs or are they maybe leveraging a native
Speaker 2: Windows process, something already trusted by the system, like using
Speaker 2: Rundel thirty two dot ex with commsvcs dot dll to
Speaker 2: achieve that same memory dump outcome.
Speaker 1: Okay, why does that distinction matter so much? The difference
Speaker 1: between the tool mimicats and the procedure using Renneal thirty two.
Speaker 1: Why is that key for the active defender?
Speaker 2: Because attackers fundamentally don't care about using one specific tool
Speaker 2: over another. They care about the outcome. They want this credentials.
Speaker 2: So if a passive defense tool like an anti virus
Speaker 2: blocks the procedure of running the mimicats executable file, well,
Speaker 2: the traditional defender often stops there. The block maybe close
Speaker 2: the ticket threat contained, right, But the active defender, they
Speaker 2: understand the attacker isn't going to just give up. They'll
Speaker 2: simply pivot. They'll try what we call a procedural synonym,
Speaker 2: just the different way, a different procedure to achieve the
Speaker 2: exact same technique, the same outcome exactly. They'll just try
Speaker 2: running runnel thirty two dot ex with the right parameters instead,
Speaker 2: it achieves the same goal dumping credentials. The active defender
Speaker 2: uses that initial failed mimicats attempt not as the end
Speaker 2: of the investigation, but is the first data point on
Speaker 2: their mental graph. They will then actively look for that
Speaker 2: subsequent suspicious behavior, look for those connections across the network,
Speaker 2: hunting for the procedural synonyms, regardless of what specific tools
Speaker 2: are being used. That deep focus on understanding and detecting procedures,
Speaker 2: not just tools or basic indicators, is the key feature
Speaker 2: that truly separates the active defender.
Speaker 1: So, wrapping this up, what does this all really mean
Speaker 1: for you, the person listening, the person responsible for defense?
Speaker 1: It sounds like the active defender is less about buying
Speaker 1: the next shine, any security product, the next magic box,
Speaker 1: and almost entirely about adopting a persistent, analytical, curious mindset,
Speaker 1: one that focuses on outcomes on patterns, on procedures. It's
Speaker 1: really an investment in curiosity over just compliance checklists.
Speaker 2: Absolutely, and this proactive procedure focused approach is becoming absolutely
Speaker 2: critical when you look at the emerging threats, threats targeting
Speaker 2: the really foundational layers of our operating environments. Consider something
Speaker 2: like the blackloadus UA five bootkit. It was found in
Speaker 2: the wild, operates at such a low hardware level below
Speaker 2: the OS it can bypass secure boot even on fully
Speaker 2: patched Windows systems. Traditional patching, passive monitoring, they're simply insufficient
Speaker 2: to detect or stop that. And we're also seeing this
Speaker 2: huge increase in highly sophisticated software supply chain attacks and
Speaker 2: things like BYOVD attacks bring your own Vulnerable Driver where
Speaker 2: attackers use legitimate sign drivers with known flaws to gain
Speaker 2: kernel level access.
Speaker 1: Wow. So these low level, potentially high impact future challenges,
Speaker 1: they absolutely demand that constant situational awareness at holographic graph
Speaker 1: based thinking you mentioned.
Speaker 2: They absolutely do. Only by actively engaging with that offensive
Speaker 2: security knowledge, the knowledge that reveals the procedures used by
Speaker 2: adversaries at every level. Only then can defenders really hope
Speaker 2: to stand a chance. So maybe your homework this week
Speaker 2: as you start thinking about your own journey towards becoming
Speaker 2: an active defender is to really look at the systems
Speaker 2: you're responsible for protecting. Start researching what hardware specifically and
Speaker 2: what kernel mode drivers are actually running in your environment.
Speaker 2: Right now, you really need to know what you are
Speaker 2: truly protecting at that foundational level, because increasingly that's precisely
Speaker 2: where the attackers are aiming next