WEBVTT 1 00:00:00.120 --> 00:00:03.160 Welcome to the deep dive. Our mission here is well 2 00:00:03.200 --> 00:00:06.320 pretty simple. We take your sources, peel back the layers, 3 00:00:06.320 --> 00:00:09.080 and pull out the most important insights. It's basically a 4 00:00:09.119 --> 00:00:12.759 shortcut to being really well informed. Today we're plunging into 5 00:00:12.800 --> 00:00:17.320 the complex and constantly shifting world of cybersecurity. We're drawing 6 00:00:17.320 --> 00:00:20.760 our insights from this incredibly practical book, Cybersecurity, Attack and 7 00:00:20.800 --> 00:00:25.160 Defense Strategies by Uri Diogenes and erdal Askaya. Our goal 8 00:00:25.199 --> 00:00:27.679 for this deep dive it is to truly understand that 9 00:00:27.760 --> 00:00:32.479 intricate dance between cyber attackers and the defenders. We'll explore 10 00:00:32.479 --> 00:00:35.479 how cyber criminals think, dig into their sophisticated methods, and 11 00:00:35.520 --> 00:00:38.960 then pivot to understanding the robust strategies and essential tools 12 00:00:38.960 --> 00:00:42.399 that organizations and importantly you can use to protect against them. 13 00:00:42.640 --> 00:00:44.799 You might actually be surprised to discover just how often 14 00:00:44.840 --> 00:00:47.960 some of the most devastating attacks are based on surprisingly 15 00:00:48.000 --> 00:00:50.039 old techniques fill with the modern twist. 16 00:00:50.320 --> 00:00:53.759 Yeah, and what's truly critical, I think, from the author's perspective, 17 00:00:53.799 --> 00:00:57.359 is this A strong security posture isn't just about building 18 00:00:57.399 --> 00:01:01.960 walls anymore, not at all. It's equally about having robust 19 00:01:02.000 --> 00:01:05.439 ways to detect when those walls are breached, and then 20 00:01:05.439 --> 00:01:08.760 crucially rapidly respond. So this deep dive it should offer 21 00:01:08.840 --> 00:01:11.760 you a complete picture, helping you grasp not just what 22 00:01:11.799 --> 00:01:14.439 attacks look like, but why they manage to succeed, and 23 00:01:14.439 --> 00:01:17.799 then how truly effective defenses are actually constructed. 24 00:01:17.879 --> 00:01:21.560 Okay, so let's unpack this. Then why has cybersecurity become 25 00:01:21.640 --> 00:01:24.359 such an enormous challenge right now? What are the big 26 00:01:24.439 --> 00:01:25.799 shifts really driving this? 27 00:01:26.040 --> 00:01:27.959 Well, if we zoom out look at the bigger picture, 28 00:01:28.040 --> 00:01:30.719 it really boils down to two sort of seismic shifts 29 00:01:30.719 --> 00:01:33.719 in how we work and live digitally, First the explosive 30 00:01:33.760 --> 00:01:36.719 growth of remote work and second the widespread adoption of 31 00:01:36.760 --> 00:01:39.840 cloud computing. The book actually highlights that nearly half of 32 00:01:39.879 --> 00:01:42.879 employed Americans are now working remotely, and often they're using 33 00:01:42.920 --> 00:01:45.640 their own devices, their home networks, which means that old 34 00:01:45.640 --> 00:01:48.840 idea of a secure office perimeter it's practically gone. The user, 35 00:01:49.280 --> 00:01:52.560 you sitting at your home computer, you become the frontline target. 36 00:01:52.719 --> 00:01:55.280 That's a huge shift. So what does that actually mean 37 00:01:55.359 --> 00:01:58.959 for individuals? For companies trying to stay secure? If our 38 00:01:59.040 --> 00:02:02.959 traditional boundary are blurring, where is the new perimeter? 39 00:02:03.359 --> 00:02:06.239 Well, it leads to a fundamental rethink, doesn't it. If 40 00:02:06.280 --> 00:02:09.159 identity is now the new perimeter, how are we protecting it? 41 00:02:09.439 --> 00:02:11.919 And the book lays out or really stark statistic from 42 00:02:12.759 --> 00:02:18.000 Verizon's twenty seventeen data breach investigations report, stolen credentials are 43 00:02:18.000 --> 00:02:22.599 the go to attack method for financially motivated cyber criminals. Really, Yeah, 44 00:02:22.680 --> 00:02:26.919 accounting for a staggering sixty three percent of confirmed data breaches. 45 00:02:27.120 --> 00:02:30.240 We're talking weak passwords, default passwords, stolen passwords. 46 00:02:30.360 --> 00:02:30.560 Wow. 47 00:02:30.800 --> 00:02:34.319 Things like users re using passwords across personal and work accounts. 48 00:02:34.680 --> 00:02:39.080 And here's where it gets maybe surprising. Even two factor authentication, 49 00:02:39.159 --> 00:02:42.240 which we rely on so heavily, it can be bypassed 50 00:02:42.520 --> 00:02:47.560 clever social engineering like that Deraymakissen simswap example. Attackers just 51 00:02:47.599 --> 00:02:50.680 tricked his phone carrier, got his number transferred, and intercepted 52 00:02:50.719 --> 00:02:51.120 his codes. 53 00:02:51.240 --> 00:02:53.520 So they didn't even need a technical exploit exactly. 54 00:02:53.599 --> 00:02:56.879 Sometimes they just exploit human trust. It shows vulnerability isn't 55 00:02:56.879 --> 00:02:57.680 always technical. 56 00:02:58.000 --> 00:03:01.520 Wow, that's a powerful example of Yeah, human vulnerability. Okay, 57 00:03:01.520 --> 00:03:04.360 beyond our login details, what about all these new apps 58 00:03:04.360 --> 00:03:07.439 we use and just the sheer volume of data we're generating, 59 00:03:07.680 --> 00:03:09.479 are they also major targets. 60 00:03:09.639 --> 00:03:13.639 Oh, absolutely, applications, especially those cloud based software as a 61 00:03:13.639 --> 00:03:17.120 service you know, sauce apps. They're evolving incredibly fast. But 62 00:03:17.199 --> 00:03:20.680 the question is how secure are they? And just as importantly, 63 00:03:21.039 --> 00:03:23.840 how secure are the apps employees are using without it 64 00:03:24.120 --> 00:03:27.039 even knowing this whole shadow it thing shadow ike, right, 65 00:03:27.159 --> 00:03:31.199 employees using unapproved apps like personal cloud storage, maybe uploading 66 00:03:31.199 --> 00:03:34.719 confidential work documents. The Cloud Security Alliance found something like 67 00:03:34.800 --> 00:03:37.439 ninety two percent of companies don't actually know the full 68 00:03:37.520 --> 00:03:38.759 scope of their shadow it. 69 00:03:39.280 --> 00:03:40.840 Ninety two percent. That's huge. 70 00:03:41.039 --> 00:03:44.560 It's a massive blind spot, a huge risk for data leakage. 71 00:03:44.879 --> 00:03:46.919 And then there's the data itself, you know, whether it's 72 00:03:46.919 --> 00:03:49.080 just sitting there on a server at rest or zipping 73 00:03:49.080 --> 00:03:53.759 across the Internet in transit. Each state needs specific defenses 74 00:03:53.879 --> 00:03:56.240 like encryption because it presents unique threats. 75 00:03:56.439 --> 00:03:59.120 Okay, here's where it gets really counterintuitive for me. The 76 00:03:59.120 --> 00:04:03.120 book says the biggest, most costly data breaches often stem 77 00:04:03.159 --> 00:04:07.439 from old attack methods just applied with new sophistication. That 78 00:04:07.479 --> 00:04:08.680 feels like a contradiction. 79 00:04:08.919 --> 00:04:11.719 It does, doesn't it, But it's absolutely true. Despite all 80 00:04:11.719 --> 00:04:14.199 the advanced threats we hear about, the top causes for 81 00:04:14.280 --> 00:04:18.759 breeches are still you know, viruses, basic malware, trojans, but 82 00:04:18.920 --> 00:04:23.480 also lack of diligence, untrained employees, phishing, social engineering. These 83 00:04:23.519 --> 00:04:24.480 are still at the top. 84 00:04:24.600 --> 00:04:25.759 Really still. Yeah. 85 00:04:25.879 --> 00:04:29.399 Take the wantacry ransomware attack in twenty seventeen. It infected 86 00:04:29.519 --> 00:04:33.800 hundreds of thousands of machines globally, how by exploding a 87 00:04:33.839 --> 00:04:37.279 vulnerability that Microsoft had already released a patch for almost 88 00:04:37.319 --> 00:04:38.480 two months prior. 89 00:04:38.319 --> 00:04:40.439 Fifty nine days. Yeah, that's incredible. 90 00:04:40.519 --> 00:04:43.279 It is. The truly stunning insight here is that despite 91 00:04:43.319 --> 00:04:46.480 all the cutting edge tech, our most persistent vulnerabilities remain 92 00:04:46.639 --> 00:04:50.040 remarkably basic human oic sight, failing to apply fixes that 93 00:04:50.079 --> 00:04:51.240 have existed for ages. 94 00:04:51.319 --> 00:04:54.079 So the basics still matter a lot, immensely. 95 00:04:54.519 --> 00:04:58.199 It's a reminder that even in cybersecurity, the simplest fixes 96 00:04:58.240 --> 00:05:01.079 are often the most overlooked. And we're also seeing this 97 00:05:01.360 --> 00:05:06.199 chilling shift towards government sponsored cyber attacks, you know, data 98 00:05:06.240 --> 00:05:09.879 as a weapon aiming to steal info for geopolitical advantage. 99 00:05:10.079 --> 00:05:13.839 Think Cozy Bear and Fancy Bear targeting the DNC network. 100 00:05:14.199 --> 00:05:16.759 Right, So, if these old attacks are still so effective 101 00:05:16.800 --> 00:05:19.920 and human factors are so critical, how do we even 102 00:05:20.000 --> 00:05:24.439 begin to defend ourselves. The book suggests starting by thinking 103 00:05:24.519 --> 00:05:28.560 like the attacker. It introduces something called the cybersecurity kill chain. 104 00:05:28.800 --> 00:05:29.720 What is that? Exactly? 105 00:05:29.839 --> 00:05:32.639 The kill chain? It's essentially a step by step roadmap 106 00:05:32.680 --> 00:05:36.279 that most cyber attackers follow. It outlines the typical phases 107 00:05:36.279 --> 00:05:38.519 they go through to achieve their goals, and it all 108 00:05:38.600 --> 00:05:43.000 kicks off with reconnaissance, which is basically their intelligence gathering phase. 109 00:05:43.000 --> 00:05:45.079 Okay, reconnaissance like spying. 110 00:05:44.879 --> 00:05:48.120 Pretty much, it can be external reconnaissance happening outside your 111 00:05:48.160 --> 00:05:52.240 organization's network, sometimes surprisingly low tech, like dumpster diving for 112 00:05:52.319 --> 00:05:56.399 discarded documents. People still do that, oh yeah, But more commonly, 113 00:05:56.519 --> 00:06:02.000 it leverages publicly available info, especially social media. Attackers scour 114 00:06:02.079 --> 00:06:05.800 social media for personal details, birth dates, pet names, family info, 115 00:06:05.959 --> 00:06:09.199 anything that might give clues for passwords or security questions. 116 00:06:09.279 --> 00:06:11.600 So if we all put online exactly. 117 00:06:11.240 --> 00:06:14.480 And this lets the craft highly convincing spear phishing attacks 118 00:06:14.519 --> 00:06:17.600 tailored just for you, like that Pentagon official who clicked 119 00:06:17.600 --> 00:06:21.680 a malicious holiday package post. Social engineering is key here too, 120 00:06:22.160 --> 00:06:27.480 Exploiting human psychology are liking things, respecting authority, social validation, 121 00:06:28.240 --> 00:06:33.279 using techniques like pretexting, making up elaborate lies, phishing fraudulent 122 00:06:33.360 --> 00:06:37.360 emails or even phone calls. That's vishing and water holing, 123 00:06:37.480 --> 00:06:39.519 infecting websites. Their targets visit. 124 00:06:39.360 --> 00:06:41.360 Often, so they poison the well basically. 125 00:06:41.079 --> 00:06:45.439 Precisely, and don't underestimate physical methods like tailgating just walking 126 00:06:45.480 --> 00:06:47.839 in right behind someone with legitimate access. 127 00:06:47.879 --> 00:06:50.199 Wow, it's a lot of ways to gather intel without 128 00:06:50.199 --> 00:06:52.879 even touching a keyboard. Okay, So once they have all 129 00:06:52.879 --> 00:06:56.160 this information, maybe even a physical foothold, what happens next 130 00:06:56.160 --> 00:06:57.800 in this kill chain? How do they get deeper? 131 00:06:58.000 --> 00:07:01.720 That's when they move to internal reconnaissance. Once they're inside, 132 00:07:01.720 --> 00:07:04.160 they use specialized tools to map the network from the 133 00:07:04.199 --> 00:07:08.600 inside out. They'll use network scanners like endmap to identify 134 00:07:08.600 --> 00:07:13.160 connected devices, open ports, operating systems, maybe check firewall. 135 00:07:12.800 --> 00:07:14.199 Rules seeing what's connected. 136 00:07:14.360 --> 00:07:17.800 Yeah, they might deploy packet sniffers like wire shark to 137 00:07:17.879 --> 00:07:23.360 capture an analyzed network traffic, looking for say, insecurely exchanged passwords. 138 00:07:23.800 --> 00:07:26.480 Then they use hacking frameworks metasploit is a big one. 139 00:07:26.480 --> 00:07:29.279 It's like a toolkit full of various exploits and payloads. 140 00:07:29.800 --> 00:07:34.120 Other tools target wireless network specifically, or identify misconfigurations and 141 00:07:34.160 --> 00:07:38.160 missing patches or driving still happens too looking for unsecured WiFi. 142 00:07:38.319 --> 00:07:40.800 Okay, so they've gathered their intel map the network. Now 143 00:07:40.839 --> 00:07:42.959 what this is where they actually try to break in, 144 00:07:43.040 --> 00:07:44.079 right exactly. 145 00:07:44.439 --> 00:07:47.720 The next critical phase is compromising the system. This is 146 00:07:47.759 --> 00:07:51.199 where they actively try to exploit those vulnerabilities they found 147 00:07:51.240 --> 00:07:55.000 during reconnaissance. And we're seeing definite trends here. Things like 148 00:07:55.079 --> 00:07:59.639 extortion attacks, ransomware like wannacrize the classic example, but also 149 00:07:59.800 --> 00:08:02.560 threats to leak sensitive data if you don't pay up, 150 00:08:02.560 --> 00:08:04.920 like what happened with Ashley Madison or that charge of 151 00:08:04.959 --> 00:08:05.639 bank incident. 152 00:08:05.720 --> 00:08:06.759 Right the extortion angle. 153 00:08:06.959 --> 00:08:10.120 Then there are data manipulation attacks. The goal isn't just 154 00:08:10.199 --> 00:08:15.040 stealing but altering information. Think Chinese spies allegedly altering US 155 00:08:15.120 --> 00:08:18.680 defense blueprints or that hack of the Associated presss TWITTER 156 00:08:18.720 --> 00:08:22.480 that caused a huge stock market dip. Scary stuff absolutely, 157 00:08:22.879 --> 00:08:26.079 And with the explosion of connected devices, IoT device attacks 158 00:08:26.079 --> 00:08:30.399 are surging, creating massive networks of compromised devices, bought nets 159 00:08:30.399 --> 00:08:34.000 for things like DDAs attacks often just exploiting default passwords. 160 00:08:34.039 --> 00:08:35.399 Default passwords against. 161 00:08:35.159 --> 00:08:38.039 Still a huge issue. We're also seeing persistent use of 162 00:08:38.159 --> 00:08:41.559 back doors, often hidden in legitimate software hardware, and a 163 00:08:41.600 --> 00:08:44.120 big increase in attacks targeting mobile devices. 164 00:08:44.399 --> 00:08:46.519 And a lot of our systems and data are in 165 00:08:46.600 --> 00:08:49.600 the cloud. Now does that make them more or less secure? 166 00:08:49.960 --> 00:08:50.960 How does that factor in? 167 00:08:51.120 --> 00:08:53.639 That raises a really important question, doesn't it? If everything 168 00:08:53.720 --> 00:08:55.879 is shared in the cart, what does that mean for security? 169 00:08:56.639 --> 00:09:00.879 The book emphasizes this shared responsibility model. The cloud provider 170 00:09:00.919 --> 00:09:03.600 handles a lot, sure, but the customer, you still hold 171 00:09:03.639 --> 00:09:07.720 significant responsibility, especially for what you put into the cloud. 172 00:09:07.799 --> 00:09:08.960 How you can figure it so. 173 00:09:08.919 --> 00:09:10.480 It's not just handed over and forget it? 174 00:09:10.559 --> 00:09:14.320 Definitely not, and many organizations simply aren't ready for this. 175 00:09:14.519 --> 00:09:19.000 We've seen high profile breaches target Home Depot, Sony Pictures, 176 00:09:19.080 --> 00:09:22.480 even the Irs, where initial compromises were leveraged to steal 177 00:09:22.600 --> 00:09:27.080 data from cloud servers. Microsoft's own security intelligence report noted 178 00:09:27.120 --> 00:09:29.799 a three hundred percent increase in cyber attax on cloud 179 00:09:29.799 --> 00:09:32.840 based Microsoft accounts in just one year from Q one 180 00:09:33.000 --> 00:09:35.200 twenty sixteen to Q one twenty seventeen. 181 00:09:36.159 --> 00:09:36.399 Wow. 182 00:09:36.519 --> 00:09:40.799 Yeah. And often attackers exploit zero day vulnerabilities. These are 183 00:09:40.840 --> 00:09:43.320 the really dangerous ones. Flaws unknown to the vendor, so 184 00:09:43.320 --> 00:09:44.720 there's no patch available yet. 185 00:09:44.840 --> 00:09:45.720 How do they find those? 186 00:09:46.039 --> 00:09:50.799 Through techniques like fuzzing? Basically throwing unexpected data at software 187 00:09:50.840 --> 00:09:54.879 to see if it breaks, or by meticulously analyzing publicly 188 00:09:54.879 --> 00:10:00.480 available source code, or using reverse engineering tools like idaprro Okay, So. 189 00:10:00.480 --> 00:10:03.480 Let's say they've gotten in compromise a system using one 190 00:10:03.480 --> 00:10:06.519 of these methods, it's not overright, how do they typically 191 00:10:06.600 --> 00:10:08.960 maintain that access and then spread out correct? 192 00:10:09.200 --> 00:10:13.000 That leads to two interconnected phases, really chasing a user's 193 00:10:13.000 --> 00:10:17.679 identity and lateral movement. After getting that initial foothold, often 194 00:10:17.759 --> 00:10:21.120 with just a low level standard user account, their next 195 00:10:21.159 --> 00:10:24.679 goal is to gain a deeper, more persistent presence. Even 196 00:10:24.759 --> 00:10:28.559 after a successful initial breach, attackers or red teams in 197 00:10:28.600 --> 00:10:31.960 a testing scenario will study how legitimate users operate to 198 00:10:32.039 --> 00:10:35.559 try and blend in emulate their patterns, blend invite, and surprisingly, 199 00:10:35.679 --> 00:10:38.480 one of the most successful entry points even now is 200 00:10:38.519 --> 00:10:41.919 still the well crafted phishing email, often tailored using that 201 00:10:42.000 --> 00:10:45.159 social media intel we talked about earlier, matching the target's 202 00:10:45.159 --> 00:10:46.279 hobbies or interests. 203 00:10:46.279 --> 00:10:47.440 This is much more convincing. 204 00:10:47.759 --> 00:10:51.600 Exactly so, once they're in lateral movement means moving from 205 00:10:51.639 --> 00:10:55.120 that initial compromise system to other systems within the network. 206 00:10:55.320 --> 00:10:57.600 This allows them to strengthen their hold, maybe find more 207 00:10:57.639 --> 00:11:00.919 valuable data or get closer to critical system and they're 208 00:11:00.960 --> 00:11:03.519 often using legitimate Windows tools for this. 209 00:11:03.759 --> 00:11:05.200 Built in tools, yeah. 210 00:11:05.000 --> 00:11:09.320 Things like PowerShell utilities from the SUS internal suite like PSZX, 211 00:11:09.720 --> 00:11:15.240 Windows Management Instrumentation WMI Scheduled Tasks tools admins use every day. 212 00:11:15.519 --> 00:11:17.879 They might even use a technique called pass the hash. 213 00:11:18.039 --> 00:11:20.679 They don't need your actual password, they can pass a 214 00:11:20.759 --> 00:11:25.200 stored encrypted version of it to authenticate as you sneaky, 215 00:11:24.840 --> 00:11:28.960 They'll target core network services like active directory to gain 216 00:11:29.000 --> 00:11:32.279 broader control, and sometimes they even hide their malicious files 217 00:11:32.320 --> 00:11:35.919 inside legitimate Windows files using something called alternate data streams 218 00:11:36.440 --> 00:11:40.480 ADS makes them incredibly hard for standard anti virus scans 219 00:11:40.480 --> 00:11:41.080 to spot. 220 00:11:41.200 --> 00:11:43.519 Wow, Okay, so they have access. They're moving around using 221 00:11:43.600 --> 00:11:46.919 legitimate cools. Their next goal is usually getting higher level privileges. 222 00:11:46.960 --> 00:11:48.879 Isn't it admin rights exactly? 223 00:11:49.000 --> 00:11:52.600 That's privilege escalation and it's absolutely crucial for them. Most 224 00:11:52.639 --> 00:11:56.639 systems are built with the least privilege principle right users 225 00:11:56.679 --> 00:11:59.320 only have the minimum access needed for their job, so 226 00:11:59.360 --> 00:12:02.799 attackers need to escalate their privileges from that compromised low 227 00:12:02.879 --> 00:12:06.559 level account to an administrative or even a system level account, 228 00:12:06.559 --> 00:12:08.440 which is basically full control. 229 00:12:08.600 --> 00:12:09.360 How do they do that? 230 00:12:09.799 --> 00:12:13.120 Well, there's horizontal escalation, which is simpler, maybe they just 231 00:12:13.159 --> 00:12:17.120 find and use stolen administrator credentials directly. But then there's 232 00:12:17.200 --> 00:12:20.639 vertical escalation, which is more complex that requires hacking tools 233 00:12:20.679 --> 00:12:24.240 to gain that system level access. This often involves exploiting 234 00:12:24.320 --> 00:12:27.440 unpatched machines. Again Eternal Blue used by WannaCry as a 235 00:12:27.440 --> 00:12:28.320 classic example. 236 00:12:28.480 --> 00:12:31.080 Unpatched machines still a theme a. 237 00:12:31.120 --> 00:12:34.559 Huge theme, or they use specialized tools like power up. 238 00:12:35.039 --> 00:12:39.200 Sometimes it's even physical tricks like exploiting Windows accessibility features, 239 00:12:39.600 --> 00:12:43.080 sticky keys, Utoleman dot ex right at the login screen 240 00:12:43.120 --> 00:12:46.559 if they have physical access. More advanced methods involve subtle 241 00:12:46.639 --> 00:12:50.919 techniques like application shimming or DLL injection or dilib hijacking 242 00:12:50.960 --> 00:12:55.360 on max basically tricking legitimate processes into running malicious code 243 00:12:55.360 --> 00:12:56.440 with higher privileges. 244 00:12:56.919 --> 00:13:00.679 So they've gained access escalated privileges. They're moving freely within 245 00:13:00.720 --> 00:13:04.360 the network using legitimate tools. What's the endgame? What are 246 00:13:04.399 --> 00:13:05.279 the ultimate goals? 247 00:13:06.000 --> 00:13:10.120 The ultimate goals usually fall into sustainment and assault. Often 248 00:13:10.159 --> 00:13:14.279 the immediate goal is data expltration, simply stealing sensitive data. 249 00:13:14.799 --> 00:13:17.919 Think about the huge Yahoo and LinkedIn breaches. Millions of 250 00:13:17.960 --> 00:13:21.759 user accounts stolen. The impact is massive. Attackers might also 251 00:13:21.799 --> 00:13:24.600 aim to erase or modify files like the threat's. 252 00:13:24.240 --> 00:13:26.639 Apple face right sealing or destroying data. 253 00:13:26.679 --> 00:13:30.360 And there's sustainment. Here, attackers install persistent malware, things like 254 00:13:30.440 --> 00:13:34.000 rootkits designed to remain hidden undetected. This ensures they have 255 00:13:34.039 --> 00:13:37.000 continuous access, buying them time for more damaging attacks down. 256 00:13:36.840 --> 00:13:39.120 The line, keeping the door open exactly. 257 00:13:39.360 --> 00:13:43.039 And then there's the most feared stage assault. This is 258 00:13:43.080 --> 00:13:47.679 where the attacker directly damages physical hardware or infrastructure. The 259 00:13:47.679 --> 00:13:51.480 infamous stucksnet attack on Iran's nuclear facility is the terrifying 260 00:13:51.720 --> 00:13:55.480 real world example. Here, Stuck's neet, a digital weapon, lived 261 00:13:55.480 --> 00:13:56.919 in their network for a year. 262 00:13:57.159 --> 00:13:58.320 A year undetected. 263 00:13:58.519 --> 00:14:02.720 Undetected, it infected air gap systems, systems not even connected 264 00:14:02.720 --> 00:14:06.919 to the Internet using USB drives. Then it subtly manipulated 265 00:14:06.960 --> 00:14:11.120 Siemens software, causing centrifuges to spin wildly out of control 266 00:14:11.200 --> 00:14:12.679 and literally self destruct. 267 00:14:12.759 --> 00:14:14.080 Physical destruction from code. 268 00:14:14.200 --> 00:14:16.960 Yeah, it showed the world that a cyber attacker's goal 269 00:14:17.039 --> 00:14:19.559 can move far beyond just stealing data. It can be 270 00:14:19.720 --> 00:14:22.799 actual physical destruction, chill and stuff. 271 00:14:22.480 --> 00:14:25.120 That is truly sobering. Yeah, okay, so how do we 272 00:14:25.200 --> 00:14:29.519 possibly counter such sophisticated, evolving threats. The book talks about 273 00:14:29.519 --> 00:14:33.600 strengthening your security posture through three foundational pillars. What are those? Right? 274 00:14:33.600 --> 00:14:37.559 These pillars are absolutely foundational, protection, detection, and response. Historically, 275 00:14:37.639 --> 00:14:40.399 organizations poured most of their budget into protection, you know, 276 00:14:40.440 --> 00:14:44.440 building firewalls, installing anti virus, rolling the walls higher exactly. 277 00:14:44.919 --> 00:14:47.679 But the way threats are shifting now means we absolutely 278 00:14:47.720 --> 00:14:51.759 need balanced investment across all three. Protection is still vital, 279 00:14:52.039 --> 00:14:54.879 but you have to assume you'll be breached eventually, so 280 00:14:55.039 --> 00:14:58.159 detection and response become critical. This is where the Red 281 00:14:58.159 --> 00:15:01.600 and Blue team concept comes in, bringing theory into practice. 282 00:15:01.919 --> 00:15:05.519 It's a simulation like military wargames, designed to test an 283 00:15:05.559 --> 00:15:07.799 organization's actual defenses in a real. 284 00:15:07.639 --> 00:15:09.399 World way, right versus Blue yep. 285 00:15:09.840 --> 00:15:13.120 The Red Team acts as the adversary, the attackers. They 286 00:15:13.159 --> 00:15:17.919 perform realistic penetration tests trying to break through controls, find vulnerabilities, 287 00:15:18.200 --> 00:15:21.799 often following that kill chain we just discussed. The Blue Team, 288 00:15:21.840 --> 00:15:24.600 on the other hand, is the defender. Their job is 289 00:15:24.639 --> 00:15:28.279 to secure assets, rapidly fix vulnerabilities found by the Red team, 290 00:15:28.320 --> 00:15:31.000 and critically document everything they learned. 291 00:15:30.759 --> 00:15:32.559 So they learned from the simulated attack. 292 00:15:32.399 --> 00:15:36.120 Precisely and full open collaboration between these teams is vital. 293 00:15:36.320 --> 00:15:39.200 It's not about winning or losing, it's about improving. They 294 00:15:39.240 --> 00:15:42.480 focus on key metrics like ETTD estimated time to detection 295 00:15:42.600 --> 00:15:45.799 and ETTR estimated time to recovery. How fast can we 296 00:15:45.799 --> 00:15:47.639 spot them? How fast can we kick them out and 297 00:15:47.679 --> 00:15:48.279 fix things? 298 00:15:48.559 --> 00:15:53.000 Makes sense. The book really emphasizes incident response too, calling 299 00:15:53.039 --> 00:15:56.919 it primordial for companies. What does a solid, effective incident 300 00:15:56.960 --> 00:15:59.960 response process actually look like when an attack hits, For. 301 00:16:00.600 --> 00:16:03.440 It has to be a clearly documented process. You can't 302 00:16:03.440 --> 00:16:05.600 figure it out on the fly when alarms are blaring. 303 00:16:05.879 --> 00:16:08.879 It's about having a plan for handling security incidents and 304 00:16:08.919 --> 00:16:13.000 responding rapidly. The Wanna cry outbreak is a perfect real 305 00:16:13.000 --> 00:16:16.480 world example. Again, when users at a company suddenly saw 306 00:16:16.480 --> 00:16:19.440 those ransomware screens, the security team had to move fast. 307 00:16:19.600 --> 00:16:23.519 They needed to rapidly identify the threat, use available threat intelligence, 308 00:16:23.639 --> 00:16:27.200 find the right patch MS seventeen zero ten in that case, 309 00:16:27.240 --> 00:16:29.799 and apply it. They worked on trying to break the encryption, 310 00:16:30.200 --> 00:16:34.159 identifying all the vulnerable systems, managing communication internally and. 311 00:16:34.240 --> 00:16:37.080 Externally, coordinated effort, absolutely. 312 00:16:36.600 --> 00:16:39.080 And the critical part often missed is that the process 313 00:16:39.120 --> 00:16:42.240 doesn't end when the incident is resolved. It continues after 314 00:16:42.320 --> 00:16:46.080 with crucial lessons learned, documentation, what went wrong, How can 315 00:16:46.120 --> 00:16:48.639 we prevent this specific thing again? How can we improve 316 00:16:48.679 --> 00:16:49.720 our response next time? 317 00:16:49.879 --> 00:16:51.759 Continuous improvement exactly. 318 00:16:51.799 --> 00:16:55.639 And in the cloud, incident response involves that shared responsibility again. 319 00:16:56.320 --> 00:16:59.200 With sauce apps, the provider handles most of it. With 320 00:16:59.320 --> 00:17:02.879 infrastructure as a service, where you're renting servers, you the customer, 321 00:17:03.039 --> 00:17:06.319 have far more responsibility for incident response on those systems. 322 00:17:06.400 --> 00:17:10.160 Got it? So, given all this, what are the foundational 323 00:17:10.160 --> 00:17:13.799 strategies for actually building this strong defense that companies need? 324 00:17:14.000 --> 00:17:15.799 Where do they start? It? 325 00:17:15.839 --> 00:17:18.759 Really all begins with a well defined security policy. And 326 00:17:18.799 --> 00:17:21.599 this isn't just some dusty document sitting on a shelf. 327 00:17:21.640 --> 00:17:24.359 It has to be a living document. It needs constant review, 328 00:17:24.799 --> 00:17:29.599 constant updates, incorporating the latest industry standards, clear procedures, clear guidelines, 329 00:17:29.680 --> 00:17:34.000 and m'st clearly define its scope. Who does it apply to? Employees, contractors? Everyone? 330 00:17:34.359 --> 00:17:37.319 Living document? Not set and forget definitely not. 331 00:17:37.440 --> 00:17:40.640 And this raises that crucial point again. If the end 332 00:17:40.759 --> 00:17:43.960 user is often called the weakest link. How do we 333 00:17:44.000 --> 00:17:49.480 strengthen them? The book strongly emphasizes continuous security awareness training, 334 00:17:49.640 --> 00:17:53.480 but not just boring lectures right. Real world examples show 335 00:17:53.519 --> 00:17:56.960 people what a phishing email actually looks like. Simulate a 336 00:17:57.039 --> 00:18:00.319 fake social media campaign targeted at them. That's stuff far 337 00:18:00.359 --> 00:18:03.279 more effective than just reading texts. Make it real. It 338 00:18:03.319 --> 00:18:07.240 also means clear social media security guidelines. What's appropriate business 339 00:18:07.319 --> 00:18:11.559 behavior online? What are the potential disciplinary actions for, say, 340 00:18:11.759 --> 00:18:14.920 defamatory or hostile posts. It all needs to be clear. 341 00:18:15.400 --> 00:18:18.519 Then these policies need to be enforced holistically, not just 342 00:18:18.559 --> 00:18:24.319 on individual computers and servers, but network devices too, routers, switches, firewalls, everywhere, everywhere. 343 00:18:24.480 --> 00:18:28.160 For Windows systems, you can use Group Policy objects GPOs 344 00:18:28.240 --> 00:18:32.039 to deploy policies centrally. Tools like AppLocker can whitelist only 345 00:18:32.079 --> 00:18:35.559 authorized applications based on their publisher or digital signature. Stopping 346 00:18:35.640 --> 00:18:39.559 unknown stuff from running. Hardening systems is also key. Applying 347 00:18:39.599 --> 00:18:44.759 industry guidelines like CCE, Common Configuration Enumeration and security baselines. 348 00:18:45.279 --> 00:18:48.799 Often using tools like Microsoft Security Compliance Manager or the 349 00:18:48.839 --> 00:18:52.279 old EMAT, which tried to block new threats by anticipating 350 00:18:52.319 --> 00:18:53.559 attacker actions. 351 00:18:53.160 --> 00:18:55.160 And enforcing isn't enough, right, you have to. 352 00:18:55.240 --> 00:18:58.759 Check exactly you must monitor for compliance. There are dashboard 353 00:18:58.839 --> 00:19:01.880 tools as your Security sets, OMS, Security and Audit Solution 354 00:19:01.960 --> 00:19:05.720 where examples that show your security posture across systems Windows 355 00:19:05.839 --> 00:19:10.119 and Linux. They identify non compliance and even suggest countermeasures 356 00:19:10.279 --> 00:19:12.000 based on those CCE guidelines. 357 00:19:12.039 --> 00:19:14.640 Okay, what's fascinating here too is the idea of physically 358 00:19:14.680 --> 00:19:18.559 and virtually segmenting networks. It sounds like creating internal walls 359 00:19:18.559 --> 00:19:19.519 within the organization. 360 00:19:19.920 --> 00:19:23.880 Precisely. Network segmentation is a core defense in depth approach. 361 00:19:24.279 --> 00:19:26.200 Think of it like the layers of an onion. You 362 00:19:26.240 --> 00:19:29.599 want multiple layers of protection. You protect data as it 363 00:19:29.640 --> 00:19:33.559 moves across networks in transit using encryption like IPsec. You 364 00:19:33.680 --> 00:19:36.640 protect it at the end points, separating corporate and personal 365 00:19:36.680 --> 00:19:41.319 data on devices, OS hardening storage encryption, and you protect 366 00:19:41.359 --> 00:19:45.920 within your core infrastructure layer upon layer exactly for existing 367 00:19:45.920 --> 00:19:49.559 physical networks, just understanding the complex layout the topology can 368 00:19:49.599 --> 00:19:52.279 be a challenge for the blue team. Tools like solar 369 00:19:52.279 --> 00:19:56.480 Wind's Network Performance Monitor Suite help discover the network. Physical 370 00:19:56.519 --> 00:20:01.200 segmentation often uses vlan's Virtual Local Area Network, basically carving 371 00:20:01.279 --> 00:20:04.720 up your physical network into separate broadcast domains. Often with 372 00:20:04.799 --> 00:20:09.160 port security and access list controlling traffic between them. Virtual 373 00:20:09.200 --> 00:20:11.920 network segmentation, whether it's on your own premises or in 374 00:20:11.960 --> 00:20:15.680 a hybrid cloud, involves isolating virtual networks and using routing 375 00:20:15.720 --> 00:20:19.279 services or virtual firewalls between them. AZ your security center 376 00:20:19.279 --> 00:20:22.039 helps assess virtual network security in the cloud. It's all 377 00:20:22.079 --> 00:20:25.119 about compayment. If one part gets breached, you limit the blast. 378 00:20:24.880 --> 00:20:29.079 Radius, right, contain the damage? And how do active sensors 379 00:20:29.200 --> 00:20:31.759 fit into this picture? That sounds like more than just 380 00:20:31.839 --> 00:20:33.720 your basic antivirus software. 381 00:20:33.880 --> 00:20:36.759 You're absolutely right. Active sensors go well beyond simply looking 382 00:20:36.759 --> 00:20:40.240 for known virus signatures the old way. Modern detection aims 383 00:20:40.240 --> 00:20:42.960 to add context to data, which helps reduce those annoying 384 00:20:43.039 --> 00:20:47.119 false positives. They look for indicators of compromise or IOCs. 385 00:20:47.240 --> 00:20:50.839 These are like patterns of behavior or specific digital footprints 386 00:20:50.920 --> 00:20:53.880 left by threats. Think of it like the PETI ransomware 387 00:20:53.920 --> 00:20:56.960 always running a specific command. That command becomes an IOC, 388 00:20:57.279 --> 00:21:01.160 a tilltale sign exactly. Organizations can you shared resources like 389 00:21:01.200 --> 00:21:04.640 open IOC to track and contribute these IOCs, helping everyone's 390 00:21:04.640 --> 00:21:07.759 spot threats faster. Then we talk about IDs versus IPS 391 00:21:08.240 --> 00:21:12.720 Intrusion detection systems IDs simply detect potential intrusions and alert you. 392 00:21:13.240 --> 00:21:17.519 Intrusion prevention systems IPS actively take action, block the traffic, stop. 393 00:21:17.319 --> 00:21:19.720 The process, detect versus prevent right. 394 00:21:19.839 --> 00:21:22.519 They can be host based at each ships running on 395 00:21:22.559 --> 00:21:27.559 individual machines, or network based and idsmpmes. Watching traffic flow, 396 00:21:28.200 --> 00:21:31.559 IPS operates in rule based mode, following specific rules like 397 00:21:31.839 --> 00:21:35.920 block traffic, matching the snort rule for WannaCry, or anomaly 398 00:21:35.960 --> 00:21:36.720 based mode. 399 00:21:36.839 --> 00:21:38.440 Anomaly based How does that work? 400 00:21:38.519 --> 00:21:41.799 That's where it gets much more sophisticated. Anomaly based systems 401 00:21:41.880 --> 00:21:44.359