December 23

Webinar takeaway: Discussing Implications of the SolarWinds Breach(es)

Security

0  comments

My key takeaways

  • stop panicking, the Solarwind hack is over. C2 channels are dead. Party is over.
    • don't poke at the IOC's *
    • focus on the fundamentals and how to avoid it happen again
  • Fundamentals:
    • DNS most valuable hunting artefacts
    • Know what you have where
    • Know all your software
    • Where are the blind spots? <- detect anomalies
    • Doesn't have to be expensive: SecurityOnion is free
  • Should there be a council enforcing higher standards for critical infrastructure or supliers for critical infrastructure?
    • probably to come
    • national software like OS in North Korea or Email clients in Russia indicate how serious other nations take also the suply chain
    • certifing people improved quality incrementaly
    • Software might benefit as well
  • Do a due diligence for software to be installed as you would do for a merger
  • More "boxes" (security hardware) wont help
  • Having a CISO in a company will not avoid being hit from events like Solarburst
  • Continous churn of Director of security / CISO -> sign for dumpster fire
  • Director of security / CISO stays for 15 years? <- uhuh, probably excuse role
  • Don't use it as an excuse to NOT patch!
    • Antivaxer - Antipatcher
  • who already practices incident response round tables knows where he stands right now
*) IOC
indictaors of compromise

Env

additional links

Photo by Kym MacKinnon on Unsplash

Tags

solarburst, threathunting, webinar takeaway

You may also like

Webinar takeaway – Applying The Threat Hunter’s Runbook

My key takeaways threat hunting runbook Identify connection persistency Identify if there is a business need Protocol analysis Investigate external IP address Investigate internal IP address Threat hunting is stealthy only when in IR mode, the adversary should be allowed to notice we are after him set the TCP timeout from 5min to 1h in

Read More

Webinar takeaway – The Ins and Outs of RITA

My key takeaways RITA is made to detect beacons and long connections open source tool Signature based detection of malicious code is outdated Average detect time is over 6 month > 50% of compromised systems are detected by outsiders RITA is behaviour based Needs a bunch of pakets to work on min 1h, default 24h

Read More
Leave a Comment