Speaker 1: All right, strap in everyone, let's take a deep dive
Speaker 1: into this open Source Security Testing Methodology Manual THEMM. Yeah, STMM,
Speaker 1: that's a mouthful. It is kind of like a security
Speaker 1: decoder ring, right, I mean, the thing is dense. Yeah,
Speaker 1: but don't worry. We're going to break it down. Make
Speaker 1: it makes sense. You shared some concerns about I think
Speaker 1: it was mentioned a specific detail from listener source material
Speaker 1: related to security, right, and the OSSTMM. It can actually
Speaker 1: help you understand that stuff a little better.
Speaker 2: Absolutely. It's put together by security testers for security testers,
Speaker 2: real world stuff, real world.
Speaker 1: Stuff, so less theory, more like in the trenches kind
Speaker 1: of stuff.
Speaker 2: Yeah, that's how security works in the real world.
Speaker 1: That's good. That's good. So one of the first things
Speaker 1: that kind of jumps out at you, you know, going
Speaker 1: through the OSSTMM, is this focus on operational security op sec. Yeah,
Speaker 1: what exactly does that mean? I mean, is an all
Speaker 1: security operational? In some way?
Speaker 2: I think the OSSTM and really draws a line.
Speaker 1: Okay.
Speaker 2: You know a lot of times security is presented like
Speaker 2: this wall, solid wall between your assets, your data and
Speaker 2: the bad guys. Okay, but in reality that wall is
Speaker 2: full of holes. Ah, okay, and the OSS TMN calls
Speaker 2: those holes trusts, trust and optic. It's all about, you know,
Speaker 2: looking at those trusts, figuring out how strong they are,
Speaker 2: figuring out if they're actually holding up.
Speaker 1: So instead of just assuming things are secure, you've got
Speaker 1: to really look closer at those trusts exactly and see
Speaker 1: if they're actually doing their job.
Speaker 2: Yeah, you're trusting something to do what it says it's
Speaker 2: going to do.
Speaker 1: Okay, Okay, can you give me like a real world example,
Speaker 1: like what would a trust look like in the real world?
Speaker 2: I mean, even something you mentioned in your notes, like
Speaker 2: relying on a specific piece of software for your business. Yeah,
Speaker 2: you know, that's a trust. You're trusting that software to
Speaker 2: do what it's supposed to do and to do it securely.
Speaker 2: But what if that software has vulnerabilities? Oh what if
Speaker 2: the company behind that software has you know, kind of
Speaker 2: shady security practices, that trust becomes a weak point.
Speaker 1: Okay, Yeah, that makes sense. So opsec is really pushing
Speaker 1: you to look beyond the surface question those assumptions.
Speaker 2: Absolutely.
Speaker 1: So how does the OSTMM actually help you do that? Like,
Speaker 1: how do you assess these trusts and figure out where
Speaker 1: you're vulnerable?
Speaker 2: That's where this idea of the four point process comes in. Okay,
Speaker 2: because a lot of security assessments are kind of like
Speaker 2: yelling into a cave and waiting for the echo. You're
Speaker 2: only getting this very limited perspective, right, and the OSSTMM
Speaker 2: says that's not good enough. You've got to get up
Speaker 2: close and personal with your security.
Speaker 1: Okay, So less like superficial checks, more like a deep
Speaker 1: dive into how things are working.
Speaker 2: Yeah, how are things actually functioning?
Speaker 1: Okay? I like that, I like that, But how does
Speaker 1: this four point process actually work?
Speaker 2: It breaks it down into these four stages. Okay, in quest, intervention, induction,
Speaker 2: and interaction.
Speaker 1: Wow, okay, break those down for me.
Speaker 2: So inquest is all about gathering information you really want
Speaker 2: to understand the system you're trying to secure. Intervention is
Speaker 2: where you actually simulate real world attacks.
Speaker 1: Oh so you're actually like trying to break things.
Speaker 2: You're trying to see how your security holds up under pressure.
Speaker 1: Okay, now it's getting real.
Speaker 2: Then you have induction, where you're analyzing all the data
Speaker 2: that you've gathered, figuring out what it means. And then
Speaker 2: finally there's interaction, which is really understanding how people and
Speaker 2: processes impact security. Like you mentioned reference a security related
Speaker 2: human element detail from the listener's source material. Right, that
Speaker 2: fits right into this interaction piece.
Speaker 1: Okay, So this four point process is giving you this
Speaker 1: much more in depth view of your security. It's not
Speaker 1: just about finding the holes. It's about understanding.
Speaker 3: The whole systems, understanding every dingy inside and out exactly.
Speaker 2: Yeah. And out of that process comes something called the RAF.
Speaker 2: The RAF it's like your security scorecard.
Speaker 1: Okay, hold on, we can't just breeze pass the RAV.
Speaker 1: You compared it to a credit score for security.
Speaker 2: Yeah, it's a way to measure how exposed are you,
Speaker 2: how good is your security posture?
Speaker 1: All right, but how is it actually calculated? And what
Speaker 1: does that number actually tell you?
Speaker 2: So think of it like this. A RAVE of one
Speaker 2: hundred is perfect balance, everything is working perfectly. Oh, your controls,
Speaker 2: you know, they're aligned with your operations. Anything less than
Speaker 2: one hundred, that means you've got gaps, gaps, there are
Speaker 2: areas where you're more vulnerable.
Speaker 1: So the lower the RAVE, the more work I need
Speaker 1: to do.
Speaker 2: Yeah, basically I'm getting the picture.
Speaker 1: What I find interesting is that you said this can
Speaker 1: be applied to anything, right, You know, a massive data center,
Speaker 1: a small business, even your own home. Exactly how is
Speaker 1: that possible? How can one score apply to all these
Speaker 1: different situations?
Speaker 2: Because the RAV isn't tied to specific technology or specific systems,
Speaker 2: it's really a framework for understanding how well your security
Speaker 2: is working compared to what you need.
Speaker 1: Okay, relative to your needs.
Speaker 2: Yeah, so you could look at the RAV of your
Speaker 2: home network, you know, and think about how strong are
Speaker 2: your passwords? Is your Wi Fi secure? Do you leave
Speaker 2: your front door unlocked?
Speaker 1: Okay, So it's not just about the tech, it's about
Speaker 1: the whole picture.
Speaker 2: Yeah, every habits and all that, it all plays a part.
Speaker 1: Okay, this is really making me rethink my own security habits,
Speaker 1: I'll be honest. Now, another big concept in the OSSTMM
Speaker 1: is trust. Right, but it's not the kind of like
Speaker 1: touchy feely trust we usually talk about.
Speaker 2: Right, We're not talking about feelings here, Okay. This is
Speaker 2: about the OSSTMN breaks down trust into ten quantifiable properties.
Speaker 1: Ten properties.
Speaker 2: Yeah. It's taking something fuzzy, something subjective, ye, and turning
Speaker 2: it into something you can actually measure and analyze.
Speaker 1: Okay, Okay, so we're taking these vague ideas and making
Speaker 1: them concrete exactly. But ten properties. That sounds a little overwhelming.
Speaker 2: It's a lot to take in.
Speaker 1: Can you give me an example, like, how do these
Speaker 1: properties play out in the real world.
Speaker 2: So let's go back to that software company. Okay, you're
Speaker 2: trusting them with your data, maybe even your business operations,
Speaker 2: but how do you know if that trust is well placed?
Speaker 4: Right?
Speaker 1: Good point.
Speaker 2: So one of the trust properties is transparency.
Speaker 1: Transparency, Okay, is.
Speaker 2: The company open about their security practices? Do they have
Speaker 2: a privacy policy that you can actually understand? Another property
Speaker 2: is competence. Competence, have they actually built secure software in
Speaker 2: the past, you know, do they have a track record
Speaker 2: of not getting breached? All of these things play into
Speaker 2: whether or not a company is trustworthy.
Speaker 1: So you're looking at these properties, you're building a more
Speaker 1: informed picture of whether this company is actually worthy of
Speaker 1: your trust.
Speaker 2: Absolutely, this is wow.
Speaker 1: This is really making me rethink how I approach trust
Speaker 1: in all areas of my life.
Speaker 2: A different way of thinking about it.
Speaker 1: Yeah. Yeah, And we haven't even touched on the ostmm's
Speaker 1: deep dive into the five security channels five five we
Speaker 1: got human security, physical security, wireless.
Speaker 4: Security, telecommunications again in a network security YEP, that's all five.
Speaker 1: Okay, So we got op SEC, we got this four
Speaker 1: point process, we got RAVS. Now you're telling me there's
Speaker 1: five security channels to consider.
Speaker 4: It's a lot, but it's all connected. We got to
Speaker 4: unpack those absolutely. Where do we even start, Well, let's
Speaker 4: start with human security h U M SEC, DOM SCC
Speaker 4: Yeah okay, since we were just talking about the human element.
Speaker 1: Okay, Yeah, this is where it gets really interesting. Goes
Speaker 1: beyond just the technical stuff.
Speaker 2: It's not just about bits and bytes right right, It's
Speaker 2: about psychology, social factors.
Speaker 1: So it's understanding how people actually behave yeah, how they
Speaker 1: make decisions, and how those decisions can actually like impact
Speaker 1: security exactly. Okay.
Speaker 2: Remember that software company we were talking about. Yeah, HTMSEC
Speaker 2: would consider things like what's their internal security culture? Like, oh, okay,
Speaker 2: do the employees actually understand security? Right?
Speaker 1: Right?
Speaker 2: You know, do they follow the best practices?
Speaker 1: They care?
Speaker 2: Do they care? Exactly?
Speaker 1: Yeah?
Speaker 2: Also looks at social engineering, okay, you know, are they
Speaker 2: vulnerable to phishing scams or other things that try to
Speaker 2: manipulate people?
Speaker 1: You know, I mentioned in my notes that I was
Speaker 1: a little worried about mention a specific detail from listeners
Speaker 1: source material related to human element of security, right.
Speaker 2: And the OSS TMM gives you a framework to think
Speaker 2: about those very concerns and actually figure out some strategies
Speaker 2: to address them.
Speaker 1: Okay, that's reassuring.
Speaker 2: All right, let's shift gears a little bit.
Speaker 1: Okay, let's talk about physical security fiochy s se al.
Speaker 2: Right. This is all about those you know, tangible.
Speaker 1: Barriers, the stuff you can actually touch.
Speaker 2: Yeah, the locks, the fences, the cameras, yeah, the guards,
Speaker 2: all of that.
Speaker 1: Okay, So, like the classic security measures, how does the
Speaker 1: OSTMM approach this differently?
Speaker 2: Well, it really makes you think like an attacker, Okay,
Speaker 2: you know, forces you to consider all the weaknesses in
Speaker 2: your physical defenses.
Speaker 1: It's the stuff you might overloko if you're not thinking carefully.
Speaker 2: Yeah, Because it's not just about having a lock on
Speaker 2: the door. It's about how easy would it be for
Speaker 2: someone to.
Speaker 1: Pick that lock right, or just break the door down.
Speaker 2: Exactly or find another way in. Yeah, you mentioned in
Speaker 2: your notes that you mentioned a specific detail from Listener's
Speaker 2: source material related to physical security. Yeah, so the Oasis
Speaker 2: TMM would say, Okay, how easy would it be for
Speaker 2: someone to like tailgate you tailgate right? Or are there
Speaker 2: any blind spots in your security camera coverage.
Speaker 1: Okay, yeah, this is kind of making me nervous now
Speaker 1: a little bit, right, but better to know now than later, right, Oh? Absolutely,
Speaker 1: all right, So let's talk about wireless security spec SIIC
Speaker 1: spec SEC. Okay, this one seems super relevant these days.
Speaker 1: Oh yeah, everyone's on Wi Fi, right, my dog's on
Speaker 1: Wi Fi.
Speaker 2: But spec SC isn't just about your home WiFi. Okay,
Speaker 2: we're talking about Bluetooth RFID tags, even things like microwave ovens.
Speaker 1: Hold on microwave oven.
Speaker 2: They EMIT signals.
Speaker 1: So my kitchen appliances are a security risks, maybe at
Speaker 1: your microwave specifically, But the point is SPETS recognizes that
Speaker 1: wireless signals are everywhere they are, yeah.
Speaker 2: And those signals can be vulnerable. Oh you know, someone
Speaker 2: could be eavesdropping. There could be interference.
Speaker 1: So it's not just about having a strong Wi Fi password.
Speaker 2: It's about the bigger picture. Okay, yeah, have broader risks
Speaker 2: of wireless technology.
Speaker 1: I see a pattern here. The os STMM is all
Speaker 1: about thinking holistically absolutely. Okay, what about telecommunications security?
Speaker 3: Come s e come se Okay, this one might seem
Speaker 3: a little outdated, right, yeah, but it's all about those
Speaker 3: systems we sometimes forget about, okay, phone lines, voicemail, even
Speaker 3: fax machines.
Speaker 2: Oh right, they can still be vulnerable.
Speaker 1: Fax machines. I totally forgot about those. We're so focused
Speaker 1: on our computers and our networks. But these other communication channels, yeah,
Speaker 1: they could be weak points too, Exactly.
Speaker 2: You got to think about all of it, okay. And
Speaker 2: then finally there's data network security. Okay, this is probably
Speaker 2: what most people think of when they hear cybersecurity. Yeah,
Speaker 2: the main event, right, all about securing the networks, the servers, the.
Speaker 1: Data, So firewalls, intrusion detection, encryption, all that stuff.
Speaker 2: All that.
Speaker 1: Yeah, okay, but what makes the ostmm's approach to this different.
Speaker 1: I mean, it seems like everyone's got a cybersecurity solution
Speaker 1: these days.
Speaker 2: The OSSTMM doesn't just tell you what to do. It
Speaker 2: teaches you how to think about security.
Speaker 1: Okay.
Speaker 2: It's a methodology, a framework for actually assessing your network,
Speaker 2: got it, understanding the risks, and then figuring out what
Speaker 2: controls you need.
Speaker 1: So it's like giving you the knowledge to be your
Speaker 1: own security expert.
Speaker 2: Exactly. You take control, okay, instead of just blindly following
Speaker 2: someone else's checklist.
Speaker 1: I like that taking control. That's good. This has been Wow,
Speaker 1: this has been an eye opener.
Speaker 2: There's a lot to take in.
Speaker 1: Yeah. I thought I was pretty good with security, you know,
Speaker 1: strong passwords, anti virus. I thought I was all set right,
Speaker 1: But there's so much more to consider.
Speaker 2: It's a whole world out there.
Speaker 1: Yeah. Yeah, it is, and we've only scratched the surface,
Speaker 1: just the beginning. So there are seventeen modules in the
Speaker 1: OSSTMS seventeen Yeah, okay, So that's where the rubber meets
Speaker 1: the road.
Speaker 2: That's where it gets practical.
Speaker 1: Okay. So you take all this information and then you
Speaker 1: actually turn it into action.
Speaker 2: Yeah. The modules are like your toolbox Okay, for actually
Speaker 2: implementing these principles.
Speaker 1: Gotcha. So like a mix a match.
Speaker 2: Yeah, you can choose which modules make sense for your situation.
Speaker 1: Customized security checkout exactly. Okay, I like that. I like that. So,
Speaker 1: for example, you mentioned the compliance verification module that helps
Speaker 1: you make sure you're meeting all the legal and industry
Speaker 1: standards and knowing the rules right right, which is a
Speaker 1: big one for me.
Speaker 2: Yeah, you mentioned that you were concerned about reference a
Speaker 2: compliance related detail from the listener's source material.
Speaker 1: Exactly, got to make sure I'm taking all the.
Speaker 2: Right boxes, right. But the OSSTMM goes beyond just ticking boxes.
Speaker 1: Okay.
Speaker 2: Good. It's about understanding why those regulations exist and then
Speaker 2: achieving real security, not just compliance for compliance's.
Speaker 1: Sake, right, because at the end of the day, it's
Speaker 1: about actually being secure.
Speaker 2: Absolutely.
Speaker 1: Okay. So another example, Let's say I'm worried about the
Speaker 1: physical security of my home office, which i am. Yeah,
Speaker 1: you mentioned that in my notes I did.
Speaker 2: Yeah. So the OSSTMM has this module called Physical Security
Speaker 2: Verification okay, and it walks you through this process of
Speaker 2: assessing your vulnerabilities.
Speaker 1: Like are there any easy access points?
Speaker 2: Exact?
Speaker 1: Could someone tamper with my equipment? Or my cameras actually
Speaker 1: pointed in the right direction?
Speaker 2: All good questions.
Speaker 1: Okay. So it's like having a security expert looking over
Speaker 1: your shoulder.
Speaker 2: Yeah, pointing out the things you might miss.
Speaker 1: Yeah. Yeah. But it's not just about finding the problems,
Speaker 1: it's about fixing them too.
Speaker 2: Absolutely. Each module gives you recommendations best practices okay, and
Speaker 2: then it takes it even a step further with this
Speaker 2: thing called characterizing results.
Speaker 1: Characterizing results, what's that?
Speaker 2: So you've done your security test. You found some issues,
Speaker 2: but now you've got to figure out what did those
Speaker 2: results actually mean. It's not just oh we found a vulnerability,
Speaker 2: it's how serious is this vulnerability? How likely is it
Speaker 2: that someone's going to try to exploit it? Right?
Speaker 1: And if they do exploit it, what's the impact going
Speaker 1: to be?
Speaker 2: So you're putting the findings into context exactly, prioritizing the risks,
Speaker 2: got it? Not just finding every little problem but figuring
Speaker 2: out which problems are the biggest.
Speaker 1: You got to focus on the big ones first.
Speaker 2: Yeah, that makes sense. Yeah, this is one of the
Speaker 2: things that makes the OSSTMM so powerful.
Speaker 3: Yeah.
Speaker 2: It helps you make informed decisions about security based on evidence,
Speaker 2: not just fear.
Speaker 1: You're not just guessing.
Speaker 2: Okay, but let's be real, a lot of this sounds
Speaker 2: pretty technical.
Speaker 1: It is. Yeah.
Speaker 2: Is the OSSTMM really something that the average person can
Speaker 2: use or is this just for you know, the security pros.
Speaker 1: That's one of the great things about it.
Speaker 2: Okay.
Speaker 1: It's designed to be accessible, Okay, no matter what your
Speaker 1: technical skill level is.
Speaker 2: Okay.
Speaker 1: It uses clear language, real world examples to explain these
Speaker 1: complicated concepts.
Speaker 2: So even if I'm not a security expert. I can
Speaker 2: still use this to improve my security absolutely. Okay. That's
Speaker 2: good to hear. And in fact, one of the core
Speaker 2: principles of the OSSTMM is that security should be a
Speaker 2: collaborative effort. Okay, it's not just about one person.
Speaker 1: Or one team, right, We're all in this together.
Speaker 2: Everyone needs to work together, okay, to make things more
Speaker 2: secure for everyone.
Speaker 1: That's reassuring, right, Yeah. Yeah, I gotta admit I'm still
Speaker 1: a little intimidated by all this.
Speaker 2: I get it.
Speaker 1: It's a lot to take it.
Speaker 2: Yeah, it's a dense document. Yeah, there's a lot to.
Speaker 1: Learn, but I don't need to master every detail.
Speaker 2: You don't have to know everything, Okay, even just understanding
Speaker 2: the basic principles and applying a few the key concepts
Speaker 2: that can make a huge difference.
Speaker 1: Okay, that's good to hear. Right, Yeah, yeah, but let's
Speaker 1: not sugarcoat it, Okay. Implementing the OSSTMM. It takes work.
Speaker 2: It does.
Speaker 1: Yeah, it's not just reading the manual and calling it
Speaker 1: a day. It's not magic, no, No, it takes effort,
Speaker 1: it takes commitment.
Speaker 2: It takes a willingness to actually change how you think
Speaker 2: about security. But the rewards are worth it. The OSSTMM
Speaker 2: can help you build a more secure organization, protect your
Speaker 2: valuable assets, and it can even give you a competitive edge.
Speaker 1: Okay, all right, I'm sold. I'm ready to dive in
Speaker 1: good But where do I even begin?
Speaker 2: Well, the OSSTMM has this thing called a posture review.
Speaker 2: It's the first step, and that's where you gather all
Speaker 2: the information about your organization. What are your assets, what's
Speaker 2: your security environment like?
Speaker 1: So you're taking stock of the current situation exactly.
Speaker 2: You got to know where you're starting from before you
Speaker 2: can figure out where you're going.
Speaker 1: Okay, I get that. What happens after the posture review?
Speaker 1: When does the actual testing start.
Speaker 2: That's where the logistics phase comes in.
Speaker 1: Logistics, Okay, this.
Speaker 2: Is where you plan and prepare for the assessment. You're
Speaker 2: defining the scope, You're picking the target systems and networks.
Speaker 2: You're choosing your tools and techniques.
Speaker 1: So it's like creating a battle plan exactly.
Speaker 2: Okay, you've got to have a plan. Good logistics are
Speaker 2: key to making sure the assessment is done thoroughly and efficiently.
Speaker 1: Makes sense. Okay, So we've got the posture review, We've
Speaker 1: got the logistics phase, right, what's next? In the OSSTMM
Speaker 1: methodology flow.
Speaker 2: Next comes the active detection verification phase.
Speaker 1: Okay, active detection.
Speaker 2: This is where you're actually testing your security. You know,
Speaker 2: how good are you're monitoring and detecting capabilities?
Speaker 1: So are my alarms actually working?
Speaker 2: Yeah? And are you actually paying attention to those alarms? Right?
Speaker 1: Right?
Speaker 2: This involved things like testing your intrusion detection systems okay,
Speaker 2: looking at your security logs, seeing if you're analyzing them properly,
Speaker 2: even simulating incidents to see how quickly you can respond.
Speaker 1: So it's about being proactive at testing things before an
Speaker 1: actual attack happens exactly. Okay, that makes sense. But what
Speaker 1: if we discover during this phase that our detection capabilities
Speaker 1: they're just not up to snuff. What happens?
Speaker 2: Then that's where the OSSTMMS recommendations come in.
Speaker 1: Okay.
Speaker 2: It gives you guidance on how to actually improve your security.
Speaker 1: Based on the findings.
Speaker 2: Yeah, based on what you've learned.
Speaker 1: Okay.
Speaker 2: It might involve upgrading your security tools okay, refining your processes,
Speaker 2: maybe providing more training for your team.
Speaker 1: So the OSSTMM doesn't just point out.
Speaker 2: Problems, it helps you find solutions.
Speaker 1: Okay, I like that it's a practical guide, not just
Speaker 1: theoretical exactly. Okay, so we've got active detection verification. What's
Speaker 1: the next step in this methodology flow.
Speaker 2: That's where we get into channel and vector verification.
Speaker 1: Channel invector.
Speaker 2: Remember we talked about those security channels earlier.
Speaker 1: Yeah, yeah, human security, physical security, all that exactly. Those
Speaker 1: were eye.
Speaker 2: Opening, they were, right. Yeah. So in this phase, you're
Speaker 2: assessing the controls for each relevant channel and vector.
Speaker 1: So you're making sure that you've got the right security
Speaker 1: measures for all the different ways that your assets could
Speaker 1: be attacked.
Speaker 2: You got it. It's a comprehensive security checkup, okay, making
Speaker 2: sure you're protected from every angle like that.
Speaker 1: So, for example, we'd be analyzing firewall rules, testing our
Speaker 1: intrusion prevention systems, evaluating access control mechanisms, making sure our
Speaker 1: wireless networks are secure, reviewing physical security measure It's a.
Speaker 2: Lot, it's a lot, yeah, but it's important.
Speaker 1: Okay. So it's a thorough process. But how do we
Speaker 1: even know which channels and vectors are relevant to our organization?
Speaker 1: I mean, there's so many potential attack vectors out there.
Speaker 2: That's where that posture review comes in hand. Remember, we
Speaker 2: gathered all that information about the organization, their assets, their environment.
Speaker 2: That helps you figure out which channels and vectors you
Speaker 2: should be focusing on.
Speaker 1: Okay, so it's all connected. The information from the early
Speaker 1: stages actually informs the later stages exactly. That's good. The
Speaker 1: OSSTMM is really systematic and methodical. It's designed to make
Speaker 1: sure that you don't miss anything important thorough Yeah. Okay,
Speaker 1: so we've got active detection verification, we've got channel in
Speaker 1: vector verification. What comes next in the OSSTM methodology flow.
Speaker 2: Next is process verification process verification. Yeah, this is where
Speaker 2: you look at the organization's processes and procedures and you're
Speaker 2: asking are they actually effective?
Speaker 1: So are people actually following the security policies exactly? Do
Speaker 1: they know what to do if something bad happens?
Speaker 2: You got it? So you're reviewing those policies and procedures.
Speaker 2: You're actually watching people seeing how they work. You're interviewing them,
Speaker 2: asking them about their understanding of security.
Speaker 1: So it's not just about having rules on paper, it's
Speaker 1: about security being part of the culture.
Speaker 2: It's got to be ingrained.
Speaker 1: Yeah. Yeah, But how do you assess something like organizational
Speaker 1: culture that seems kind of fuzzy?
Speaker 2: It can be. Yeah, but the OSSTMM gives you some guidance.
Speaker 2: You look for evidence of security awareness training. Are they
Speaker 2: doing incident response drills? Is there a clear way to
Speaker 2: report security incidents?
Speaker 1: So you're looking for concrete that they're taking security seriously.
Speaker 2: Yeah, it's got to be more than just words.
Speaker 1: Yeah, to be actions.
Speaker 2: Actions speak louder than words, exactly.
Speaker 1: Okay. So process verification it's about making sure everyone's.
Speaker 2: On the same page, everyone working together. Yeah.
Speaker 1: Yeah, what's next in the osstmmflow.
Speaker 2: Next up is configuration and training.
Speaker 1: Verification, configuration and training Okay.
Speaker 2: This is where you look at the organization systems okay,
Speaker 2: and their training programs.
Speaker 1: So are our systems set up properly? And do people
Speaker 1: know what they're doing exactly?
Speaker 2: So you're reviewing system settings, you're checking password policies, ok
Speaker 2: and you're evaluating those training programs.
Speaker 1: So it's making sure that our technical defenses and our
Speaker 1: human defenses are both up to par. Got to have both, Okay,
Speaker 1: But how do we know what a secure configuration even
Speaker 1: looks like? I mean, there are so many different settings
Speaker 1: and options and it can.
Speaker 2: Be overwhelming, yet it can be That's where the OSTMM
Speaker 2: comes in handy again.
Speaker 1: Okay.
Speaker 2: He gives you specific guide good based on industry best
Speaker 2: practices and the needs of your organization.
Speaker 1: So it's not just a generic checklist. It's about tailoring
Speaker 1: things to your specific situation.
Speaker 2: You got it.
Speaker 1: Okay, that makes sense, And the same goes for the training,
Speaker 1: right Exactly. The OSSTMM encourages organizations to make the training
Speaker 1: relevant engaging for the employees.
Speaker 2: Yeah, you don't want those boring, sleep inducing training sessions, right.
Speaker 1: Because then no one remembers anything exactly. Okay. So we've
Speaker 1: got configuration and training verification. What's next in the OSSTMM methodology.
Speaker 2: Now we're getting into privileged escalation verification.
Speaker 1: Privilege escalation, yep, this.
Speaker 2: Is where uss how vulnerable you are to attacks that
Speaker 2: try to gain unauthorized privileges.
Speaker 1: So making sure attackers can't like level up and get
Speaker 1: access to stuff they shouldn't exactly.
Speaker 2: Okay, So you're trying to find those vulnerabilities. You're testing
Speaker 2: your access controls, you're looking at your monitoring and logging processes.
Speaker 1: So it's about being proactive absolutely understanding how attackers might
Speaker 1: try to escalate their privileges so we can stop them exactly. Okay,
Speaker 1: but how do you even begin to identify those vulnerabilities.
Speaker 1: It seems like looking for a needle in a haystack.
Speaker 2: It could be tough. Yeah, but the OSSTMM gives you
Speaker 2: some pointers okay. It talks about common techniques and vulnerabilities okay,
Speaker 2: and it encourages you to use tools like vulnerability scanners, right,
Speaker 2: penetration testing, So.
Speaker 1: A combination of manual and automated techniques.
Speaker 2: You got it. You got to use all the tools
Speaker 2: at your disposal.
Speaker 1: Okay. And once you've found those vulnerabilities, then you.
Speaker 2: Fix them right right, Patch your systems, tighten up those
Speaker 2: access controls.
Speaker 1: Okay. So you're constantly finding problems and fixing them.
Speaker 2: It's an ongoing process.
Speaker 1: Okay. So we've got privileged escalation verification. What's next on
Speaker 1: the OSSTMM list.
Speaker 2: Next is containment and egress verification.
Speaker 1: Containment and egress.
Speaker 2: This is where you assess your ability to you know,
Speaker 2: contain security incident okay, and prevent data from leaking out.
Speaker 1: So if an attacker gets in, can we limit the
Speaker 1: damage exactly?
Speaker 2: Can you stop them from making off with all your
Speaker 2: sensitive data?
Speaker 1: Okay?
Speaker 2: That's crucial it is, So you're testing your incident response plans. Okay,
Speaker 2: you're looking at your data laws prevention mechanisms, and you're
Speaker 2: checking your network segmentation strategies.
Speaker 1: So it's about having a plan in place and making
Speaker 1: sure we can protect our valuables.
Speaker 2: You got it. Now, what if those controls aren't good enough?
Speaker 1: Right? Good point?
Speaker 2: What do you do? Yeah?
Speaker 1: What then?
Speaker 2: The OSSTMM gives you more recommendations okay, best practices for
Speaker 2: improving those controls.
Speaker 1: Okay.
Speaker 2: Maybe you need to develop a more robust incident response
Speaker 2: plan okay, or implement data loss prevention solutions, or maybe
Speaker 2: you need to strengthen your network segmentation okay.
Speaker 1: So you use the findings to drive security improvements exactly.
Speaker 1: The OSSTMM is really a cyclical process.
Speaker 2: It is you assess, you find weakness, you make improvements,
Speaker 2: and then you assess again. You just keep going, you
Speaker 2: keep going.
Speaker 1: Okay. So we're constantly evaluating, evolving our.
Speaker 2: Security posture, always evolving.
Speaker 1: Okay, what's next on the list?
Speaker 2: All right, Now we're getting into denial of service verification.
Speaker 1: Denial of service.
Speaker 2: This is where you see how vulnerable you are to
Speaker 2: those denial of service attacks d dos.
Speaker 1: Yep, those are the ones where they flood a system.
Speaker 2: With traffic, they try to overwhelm it.
Speaker 1: Yeah, make it unavailable to legitimate users exactly. Okay, those
Speaker 1: sound like a nightmare.
Speaker 2: It can be really disruptive. Yeah, people can't access websites, applications,
Speaker 2: even entire networks can go down.
Speaker 1: Okay, So what do you actually do during denial of
Speaker 1: service verification?
Speaker 2: Well, you're trying to figure out how could someone launch
Speaker 2: a d DOS attack against you? Right, You're testing how
Speaker 2: resilient your network is, and you're seeing if you have
Speaker 2: any d DOAS mitigation strategies in place.
Speaker 1: So you're basically trying to figure out how to survive
Speaker 1: a DDAs attack.
Speaker 2: You got it? Okay, you want to build a network
Speaker 2: that can withstand that kind of pressure, sure.
Speaker 1: Right, right? Okay, so we've covered denial of service verification.
Speaker 1: What's next on the OSTMM agenda.
Speaker 2: Next up is business disruption verification Business disruption. This one's
Speaker 2: interesting because here you're looking at attacks that go beyond
Speaker 2: just technical disruptions.
Speaker 1: Okay, So it's not just about taking down a website.
Speaker 2: It's about disrupting the organization's ability to function. Wow, So
Speaker 2: we're talking about things like ransomware attacks that encrypt your data,
Speaker 2: d tos, attacks that cripple your online services, even physical
Speaker 2: attacks oh right, damage your facilities.
Speaker 1: So these are attacks that really impact the bottom line exactly. Okay,
Speaker 1: what kind of tasks are involved in business disruption verification?
Speaker 2: Well, first you got to figure out what are the
Speaker 2: organization's critical business processes? Okay, what are their most important assets.
Speaker 2: Then you think about, okay, what would happen if those
Speaker 2: were disrupted? Okay, what's the impact going to be?
Speaker 3: Right?
Speaker 2: And then you see do they have any plans in
Speaker 2: place to recover?
Speaker 1: So you're thinking about business continuity, disaster recovery exactly.
Speaker 2: You want to make sure the organization can keep running even.
Speaker 1: If something bad happens, to be prepared. Okay, So business
Speaker 1: disruption verification it's about building resilience, being able to bounce
Speaker 1: back from those disruptions.
Speaker 2: You got it.
Speaker 1: Okay, what's next on the OSSTMM checklist?
Speaker 2: All right, now we're getting into social engineering verifications engineer yep,
Speaker 2: this is where you assess how vulnerable the organization is
Speaker 2: to those sneaky attacks.
Speaker 1: Those attacks that prey on human psychology. Exactly, the trickery,
Speaker 1: the deception, it's all.
Speaker 2: About manipulating people, getting them to do things they shouldn't.
Speaker 1: Give up sensitive information or.
Speaker 2: Click on a malicious link, right right, social engineering attacks
Speaker 2: can be really effective.
Speaker 1: Yeah, because people want to be helpful.
Speaker 2: Exactly, a trust people and attackers exploit that.
Speaker 1: So what do you actually do during social engineering verification?
Speaker 2: Well, you might do some simulations see how susceptible employees are, right.
Speaker 2: You might even do some penetration testing okay. But it's
Speaker 2: also about looking at the training programs, right, are they
Speaker 2: actually teaching people about social engineering?
Speaker 1: Okay?
Speaker 2: And then you look for ways to improve your policies
Speaker 2: and procedures.
Speaker 1: So it's about understanding the tactics, training people to resist
Speaker 1: them exactly, and putting safeguards in place.
Speaker 2: I have multiple layers of defense.
Speaker 1: Okay. So social engineering verification it's all about building a
Speaker 1: security aware culture.
Speaker 2: You got it?
Speaker 1: Okay, what's next on the OSDMM agenda?
Speaker 2: Next up is physical security verification Physical security. Yeah, this
Speaker 2: is where you assess those physical controls.
Speaker 1: So we're talking locks, fences, cameras, guards.
Speaker 2: All that, all of that. Yeah. It's easy to overlook
Speaker 2: physical security.
Speaker 1: These days, right, Yeah, with everyone focused on cyber but it's.
Speaker 2: Still essential, it is. Yeah, you can have the best
Speaker 2: cybersecurity in the world. But if someone can just walk
Speaker 2: into your building and steal your servers, game over exactly.
Speaker 1: Okay, So what kind of tasks are involved in physical
Speaker 1: security verification.
Speaker 2: You're testing your access control systems, You're looking at your
Speaker 2: surveillance coverage, you're assessing your security personnel, and you're reviewing
Speaker 2: those environmental controls and disaster preparedness plans.
Speaker 1: So you're making sure those physical defenses are just as
Speaker 1: strong as your digital defenses.
Speaker 2: Got to have a balanced approach.
Speaker 1: Okay, makes sense. So we've covered physical security verification. What's
Speaker 1: next on the OSSTMM roadmap.
Speaker 2: Now we're moving on to wireless security verification.
Speaker 1: Wireless security.
Speaker 2: This is where you assess the security of all those
Speaker 2: wireless networks.
Speaker 1: Wi Fi, Bluetooth, RFID, all that good stuff, all of it. Okay,
Speaker 1: wireless security is crucial these days, absolutely, I mean everyone's
Speaker 1: connected wirelessly, exactly.
Speaker 2: So what do we do during wireless security verification?
Speaker 1: What do we do?
Speaker 2: We test those security settings. We try to break into
Speaker 2: those networks.
Speaker 1: Right, We try to break into those networks.
Speaker 2: Yectly, quite a reagular. We see how strong those encryption
Speaker 2: protocols are, and we check if there are any intrusion
Speaker 2: detection or prevention systems in place.
Speaker 1: So we're basically trying to find any weaknesses in our
Speaker 1: wireless defenses.
Speaker 2: Exactly. You got to be proactive.
Speaker 1: Yeah, Okay, Wireless security verification, that's all about building a
Speaker 1: secure wireless environment.
Speaker 2: Keeping your data and your devices safe.
Speaker 1: All right. What's next on the OSSTMM agenda.
Speaker 2: Next is telecommunications security verification.
Speaker 1: Telecommunications security.
Speaker 2: This is all about those traditional telecommunication.
Speaker 1: Systems, so like phone lines, voicemail, fax machines, all that.
Speaker 2: All of that. Yeah, those systems can.
Speaker 1: Still be vulnerable, right, Yeah, we tend to forget about those.
Speaker 2: We focus so much on the cyber stuff. Yeah, that
Speaker 2: we forget about the old school stuff, but it's still
Speaker 2: important absolutely. So during telecommunications security verification, you might test
Speaker 2: the security of your voicemail systems. Okay, you might try
Speaker 2: to eavesdrop on phone com wow. You might check the
Speaker 2: physical security of your equipment.
Speaker 1: So it's about making sure our phone calls are private
Speaker 1: and our voicemail messages are secure.
Speaker 2: Exactly. You don't want anyone snooping on your conversations, right right.
Speaker 1: Okay, so we've covered telecommunications security verification. What's Next on
Speaker 1: the OSSTMM checklist.
Speaker 2: All right, now we're getting to data networks security verification.
Speaker 1: Data networks okay, that's the big one. Yeah, the heart
Speaker 1: of cybersecurity.
Speaker 2: This is where you're assessing the security of your networks
Speaker 2: and your systems.
Speaker 1: So protecting our computers, our servers, our data, whole nine yards.
Speaker 2: The whole nine yards. Yeah, all right.
Speaker 1: What kind of tasks are involved in data networks security verification.
Speaker 2: Oh, we're talking penetration testing, okay, vulnerability scanning, configuration reviews,
Speaker 2: security log analysis.
Speaker 1: Wow, it's a lot, it is.
Speaker 2: Yeah, but it's all about finding those weaknesses before the.
Speaker 1: Attackers do exactly. Okay. So data networks security verification, it's
Speaker 1: about building a really strong network infrastructure, you.
Speaker 2: Got it, protecting your data from all those cyber threats.
Speaker 1: Okay, so we've covered data networks security verification. What's next
Speaker 1: on the OSSTMM agenda?
Speaker 2: All right, Next up is compliance verification.
Speaker 1: Compliance.
Speaker 2: This is where you make sure you're following all the rules, okay,
Speaker 2: meeting those legal and regulatory obligations.
Speaker 1: So ticking all the right boxes. It's making sure we're
Speaker 1: not going to get in trouble with the authorities. Okay,
Speaker 1: that makes sense. But how do we even know which
Speaker 1: compliance requirements apply to us? I mean, there's so many
Speaker 1: laws and regulations and standards out there.
Speaker 2: It can be overwhelming. Yeah, but THESTMM gives you some guidance.
Speaker 1: Okay.
Speaker 2: It helps you figure out which rules apply to your
Speaker 2: specific situation.
Speaker 1: Okay, So it's about doing our research making sure we're
Speaker 1: following the right rules exactly.
Speaker 2: Compliance is an important part of security. Okay.
Speaker 1: So we've covered compliance verification. What's the final step in
Speaker 1: the OSSTMM methodology flow.
Speaker 2: The final step is the survey, alert and log review.
Speaker 1: Okay, so it's like the wrap up phase exactly.
Speaker 2: Exactly. This is where you look at all the findings
Speaker 2: from your assessment, you analyze the results, and you come
Speaker 2: up with your recommendations for improvement.
Speaker 1: So we're putting all the pieces together, making sense of
Speaker 1: the big picture.
Speaker 2: Exactly. This is where you turn all that data into action.
Speaker 1: Okay, that makes sense. But what kind of tasks are
Speaker 1: involved in this final review?
Speaker 2: Well, you're reviewing all the findings from those different modules, right,
Speaker 2: You're looking at the security logs, the incident reports. You're
Speaker 2: trying to find any gaps or weaknesses that you might
Speaker 2: have missed, and then you come up with a list
Speaker 2: of recommendations, okay, and you prioritize those recommendations so.
Speaker 1: If we find a lot of vulnerabilities, we don't have
Speaker 1: to try to fix them all at once.
Speaker 2: Exactly. You focus on the most critical ones first.
Speaker 1: Okay, that makes sense. So it's about focusing on the
Speaker 1: biggest risks and then working our way down the list.
Speaker 2: You got it. And remember security is an ongoing process.
Speaker 1: Yeah, it's not a one time fix.
Speaker 2: It's a journey, right right.
Speaker 1: We're constantly assessing, identifying weaknesses, making improvements, and then assessing again.
Speaker 1: It's a cycle, a cycle of continuous improvement.
Speaker 2: Exactly.
Speaker 1: This has been incredible. This deep dive into the OSSTMLS
Speaker 1: a lot to take in, yeah, it is, but it's
Speaker 1: been so insightful. It's really given me a whole new
Speaker 1: understanding of how security works. That's the goal, yeah, and
Speaker 1: a framework for actually managing security in a smart way.
Speaker 2: It's about being strategic, right right.
Speaker 1: And you know one thing that keeps coming back to
Speaker 1: me is this idea of the movie's.
Speaker 2: Defense, the defense.
Speaker 1: Yeah, you described it as a security perimeter with no
Speaker 1: inside or outside, right, which honestly, sounded kind of mind
Speaker 1: blowing at first.
Speaker 2: It's a different way of thinking about things.
Speaker 1: Yeah, it is. Can you break that down a bit
Speaker 1: further from me, How does that actually work in practice?
Speaker 2: So the Movie's Defense is really about recognizing that the
Speaker 2: old way of thinking about security, Okay, with that hard
Speaker 2: perimeter right the castle walls, Yeah, it just doesn't work anymore.
Speaker 1: Yeah, no more motes, No more motes.
Speaker 2: We're living in a world where information is constantly flowing.
Speaker 1: Right across boundaries exactly.
Speaker 2: You're accessing data in the cloud, you're connecting to public
Speaker 2: Wi Fi, you're sharing information across all these different devices.
Speaker 1: So there's no clear line to defend anymore exactly.
Speaker 2: So the movie is Defense is about shifting from that static,
Speaker 2: perimeter based approach to something more dynamic, more fluid.
Speaker 1: So instead of trying to build an impenetrable.
Speaker 2: Wall, which is impossible.
Speaker 1: Yeah, you can't keep everything, you can't.
Speaker 2: The Movie's Defense is about defense in depth. Defense in
Speaker 2: depth oka distributing those security controls across multiple layers.
Speaker 1: So it's about being flexible, resilient, being able to adapt.
Speaker 2: The threat landscape is always changing, so your security.
Speaker 1: Has to adapt to So it's not about preventing breaches altogether.
Speaker 2: You can't prevent everything. Yeah, it's about minimizing the impact,
Speaker 2: containing the damage, recovery quickly.
Speaker 1: Okay. So it ties back to what we were talking
Speaker 1: about earlier, understanding our trusts, managing risk, not eliminating it.
Speaker 2: It's exactly, you got to be smart about it.
Speaker 1: Okay. This is really making me rethink my whole approach
Speaker 1: to security.
Speaker 2: It's a different way of thinking about things, it is.
Speaker 1: Yeah, you know, you mentioned in my notes that I
Speaker 1: was worried about mention a specific concern from the listener's
Speaker 1: source material that relates to the Mobius.
Speaker 2: Defense, right, and the movie's defense would say, Okay, don't
Speaker 2: try to prevent that specific threat. Okay, think about how
Speaker 2: you can build a more resilient system, Okay, a system
Speaker 2: that can.
Speaker 1: Adapt, right, so even if that happens, we can bounce
Speaker 1: back exactly. Okay, this is giving me a lot to
Speaker 1: think about. I'm starting to see how the OSSTMM is
Speaker 1: not just a.
Speaker 2: Set of rules. It's more than that.
Speaker 1: Yeah, it's a way of thinking about security. It's a framework, right,
Speaker 1: a framework for developing a smarter, more nuanced approach.
Speaker 2: You got it.
Speaker 1: But honestly, it's a bit daunting, I get it. Where
Speaker 1: do I even begin?
Speaker 2: Well, the good news is the OSSTMM is practical.
Speaker 1: Okay.
Speaker 2: It gives you a step by step process for assessing
Speaker 2: your security, finding those vulnerabilities, and fixing them. And you
Speaker 2: don't have to do it all at once. Start with
Speaker 2: the areas that are most important to you, Okay, build
Speaker 2: from there.
Speaker 1: So take it one step at a time, exactly, prioritize
Speaker 1: the risks. Don't be afraid to ask for help.
Speaker 2: There are resources out there.
Speaker 1: Okay, that sounds manageable.
Speaker 2: It is.
Speaker 1: Yeah, But you know one thing that really sticks with
Speaker 1: me is this idea that security is a journey, not
Speaker 1: a destination.
Speaker 2: It's an ongoing process.
Speaker 1: Yeah, it's something we need to be thinking about all
Speaker 1: the time. How do we stay ahead of the curve
Speaker 1: when the threats are constantly changing.
Speaker 2: That's the challenge it is, yeah, but it's also what
Speaker 2: makes it so interesting. Right. The OSSTMM is all about
Speaker 2: continuous learning, continuous improvement.
Speaker 1: So you've got to stay informed about new threats. Yeah,
Speaker 1: new vulnerabilities.
Speaker 2: You gotta be curious, okay, try new things, challenge your assumption.
Speaker 1: So it's about being proactive, curious and adaptable, embracing the
Speaker 1: fact that security never stands still.
Speaker 2: It's always evolving.
Speaker 1: This has been a fantastic deep dive into the OSSTMM.
Speaker 2: It has.
Speaker 1: It's given me so much to think about and a
Speaker 1: whole new way of looking at security.
Speaker 2: I'm glad to hear that.
Speaker 1: Yeah, it's not about fear or paranoia. It's about understanding
Speaker 1: the risks, taking action, and working together.
Speaker 2: We're all in this together exactly.
Speaker 1: Thanks for guiding me through this exploration of the OSSTMM.
Speaker 2: It's good my pleasure.
Speaker 1: I feel like I've gained a valuable new set of
Speaker 1: tools and perspectives. Excellent, And to our listeners, we encourage
Speaker 1: you to check out the OSSTMM. Yeah, see how its
Speaker 1: principles can help you navigate this crazy world of security.
Speaker 2: It's a great resource.
Speaker 1: Remember, knowledge is power.
Speaker 2: It is.
Speaker 1: The more you understand the threats, the better decisions you
Speaker 1: can make. Absolutely, and together we can build a more
Speaker 1: secure future. That's the goal for ourselves in our communities.
Speaker 2: I think that's a great place to wrap things up.
Speaker 1: Yeah, I think so too.