SCYBERAddress an urgent need.

Today’s Agenda

• State of Security Today

• Solutions to the Problem

• SCYBER• Key Differentiators• Course Details• Course Comparison

1994

2014

20 YEARS IN THE MAKING

AGENDA

A GLOBAL CHALLENGE.

The global economy loses up to $1 trillion per year

due to malicious cyber activity.

COMPLEX PROBLEMS, REAL COSTS

In 2013 alone, 552 million records were exposed due to data breaches.

The annual cost to an individual business due to cyber crime can range from $1M to $52M, on

average.

• Malicious traffic was visible on 100% of networks sampled

• Nearly 70% of respondents have been identified as issuing DNS queries for DDNS

• There is a need for visibility-driven, threat-focused, and platform-based security solutions

• Before• During• After

2014 Cisco Midyear Security Report: Threat Intelligence & Industry Trends

THREAT INTELLIGENCE

Method Threat Description Findings

DDNSDDNS is used by adversaries since it allows botnets and other attack infrastructure to be resilient against detection.

Nearly 70% of respondents issue DNS queries for DDNS.

MiTBPalevo, SpyEye, and Zeus are malware families that incorporate MiTB functionality. DNS lookups for hosts compromised by them are considered a high threat.

More than 90% of customer networks observed have traffic going to websites that host malware.

Java Java’s extensive attack surface and high ROI make it a primary target for exploitation.

Java exploits represented 93% of IOCs as of May 2014.

Source(s): Cisco 2014 Midyear Security Report

MALWARE ENCOUNTERS BY VERTICAL

Spending Priority RankMedia & Publishing 1Pharmaceutical & Chemical 2Aviation 3Transportation & Shipping 4Manufacturing 5Insurance 6Agriculture & Mining 7Professional Services 8Electronics 9Food & Beverage 10Retail & Wholesale 11Utilities 12

Source(s): Cisco 2014 Midyear Security Report

• The business community is increasingly reliant on the use of data.

• The need to secure critical data

is paramount to day-to-day operations.

• Regulations and penalties for security violations are increasing.

THE CURRENT THREAT LANDSCAPE IS LIMITING BUSINESS GROWTH

• Security is becoming a bigger concern in the boardroom• Identifying the personal and professional liability in

failing to secure networks

• As cyber threats become part of the business landscape, more will put an emphasis on sound security practices

• Organizations must align cyber security and business performance• Shift IT from facilitator to driver of business outcomes

THE VIEW FROM THE TOP

Source(s): EY, Beating Cybercrime (2013)

What measures are

in place?

SOLUTIONS TO THE PROBLEM

Hardware

Software

People

Process

Hardware

Software

People

Process

Hardware

Software

People

Process

BEFORE DURING AFTER

How are security events detected?

What is the cleanup process?

• Nearly 1M unfilled jobs in the field

• Critical in the SOC• Analyze network alerts and detect APTs• Characterize and analyze network traffic to identify

anomalies and potential network resource threats• Perform event correlation analysis to determine the

effectiveness of observed attacks

• Key areas of competency• Ability to identify security incident as it happens• Experience in implementing appropriate plan of

action quickly to minimize cost/damage

HELP WANTED: SECURITY ANALYSTS

HOW TRAINING IS FALLING SHORT

• Focused on building static defenses• No detection or response plan in place

• Few paths to train IT personnel to recognize security risks and respond

• Not enough hands-on practice to implement the theory being taught

• No ability to practice responding to actual, real-life attacks on real-life equipment

SCYBER addresses this issue.

Designed to develop the skills necessary to proactively detect

and combat cyber threats

4 Major Competencies

1. Monitor security events

2. Configure and tune security event detection and alarming

3. Analyze traffic for security threats

4. Respond appropriately to security incidents

5 Key Differentiators

1. System Agnostic

2. Lab-Heavy

3. Inside-Out vs. Outside-In

4. Ease of Entry

5. Understand the “Why?”

SYSTEM AGNOSTIC

• Though training is provided by Cisco, course does not focus solely on Cisco products

• Prepares students to operate a variety of systems

• Can train security professionals to “guard the castle,” with no additional infrastructure investment

60%Of course time spent in a lab environment

Monitor, analyze,

and respond to actual

cyber attacks

• Train your SOC staff• Cross-train your IT staff on how to recognize

security incidents and how to work with the SOC team

• Great starting point for IT staff looking to migrate to security

Ease of Entry for Security Professionals

• Develops the skills necessary to effectively operate within an SOC

• Process• Hardware• Software

• Identify threats, but also understand why something

is a threat

Moving Beyond the “How”

SCYBER CCNA Sec. CCNP Sec. CCIE Sec. Security + CEH

Pre-Req. N/A IINS/CCENT CCNA Sec./CCIE N/A N/A N/A

Experience 0-2 Years 0-2 Years 4-6 Years 7+ Years 2-3 Years 2+ Years

Sample Job Security Analyst System Admin. Network

Security Eng.Network Security Eng. System Admin. Ethical Hacker

Focus Event Detection

SystemAdministration

Building Infrastructure Management System

AdministrationPenetration Testing

Instruction 1 Week 2 Weeks 4 Weeks Varied 1 Week 1 Week

Exam (s) 1 Exam 2 Exams 4 Exams 2 Exams 1 Exam 1 Exam

DoD 8570 Pending Yes No No Yes Yes

CERTIFICATION COMPARISON

SCYBER No Prerequisites

Understanding of TCP/IP and a working knowledge of

CCNA is highly recommended

TECHNICAL DETAILS

Prepares students to take the Cyber Security Specialist Certification Exam

600-199 SCYBER

ILT course covers 12 modules over 5 days

Day 1 Day 2 Day 3 Day 4 Day 5

Course Introduction

Module 1:Attacker

Methodology

Module 3:Defender Tools

Module 5: Network Log

Analysis

Module 7: Incidence Response

& Preparation

Module 8: Security Incident

Detection

Module 10: Mitigations & Best

Practices

Module 2: Defender

MethodologyModule 4:

Packet Analysis

Module 6: Baseline Network

Operations

Module 7: Incidence Response

Preparation

Module 8: Security Incident

Detection

Module 9: Investigations

Module 11: Communication

Module 12: Post-Event Activity

Course Schedule

AM

PM

Cyber Attack Model

OSI Model TCP/IP Model

7

6

5

4

3

2

1

Application

Presentation

Session

Transport

Network

Data Link

Physical

Network Interface

Application

Transport

Internet

MITM (Intercept, Modify),

DoS, RF (Jam, Replay)

Session Hijacking and Spoofing (Intercept, Modify, Bypass Network

Security), DoS

Malware, OS, and Application level; Remote and Privilege Escalation

exploits, Bots, Phishing

RF, Fiber, Copper

IP Transport Cyber Attack Vectors

Network and System Architecture- Centralized, Distributed, Redundant- Physical and Logical

Transport Network - RF, Fiber, Copper

Network Protocols- Routing, Switching, Redundancy- Apps, Client/Server

Client/Server Architecture

HW, SW, Apps, RDBMS- Open Source- Commercial

Trust Relationships- Network Management and Network

Devices- Billing, Middleware, Provisioning

Common HW/SW configuration settings

Transport Network Infrastructure Cyber Attack Tree

Network InfrastructureAttack Vectors

SNMP Community String Dictionary Attack

with Spoofing to Download Router\

Switch Configuration

Build New Router Configuration File to

enable further privilege escation

Upload New Configuration File

Using Comprimised SNMP RW String

UNIX NetMgt Server Running NIS v1

Ypcat -d <domain> <server IP> passwd Grab shadow file hashes

Crack Passwords

Access Server Directly

Exploit ACL Trust

RelationshipAttack SNMP\Telnet\SSH

Find NetMgt

passwords and SNMP config files

Discover Backup HW Configs

Crack Passwords

HP OpenView ServerEnumerate Oracle

TNS Listener to Identify Default SID’s

Further Enumerate Oracle SID’s to Identify Default

DBA System Level Accts\Passwords

Login to Oracle DB with Discovered DBA

Privilege Account

Run Oracle SQL CMDs

Execute OS CMDs Add New

Privileged OS Account

Crack Passwords

Further Enumerate Oracle SID’s to

Identify User Accts.

Perform Dictionary Attack

Execute OS CMDs from Oracle PL/SQL

Attack Network from DB

Run Oracle SQL CMDs Execute OS CMDs

Find NetMgt Passwords, SNMP info, OS password

files

Network Mgt Application

Attempt to Login Using Default Login\Password

Reconfigure Router or Switch

MITM ARP Poisoning

Sniffing

Capture SNMP Community Strings and Unencrypted

Login\Passwords, Protocol Passwords

Configure Device for

Further Privilege

Escalation

Telnet\SSHDictionary Attack Router\Switches\NetMgt Server

Inject New RoutesOr Bogus Protocol

Packets

Use New Privileged OS account to

Escalate Privileged Access to Network

Own Network Infrastructure

Own Network Infrastructure

Own Network Infrastructure

Own Network Infrastructure

Own Network Infrastructure

Own Network Infrastructure

Build New Router Configuration File to

enable further privilege escation

Attack Vectors - Deny, Disrupt, Delay, Intercept, ExploitMan in the Middle Attacks (MITM) Network ProtocolsIP Spoofing Apps/RDBMS/NetMgt Traffic Analysis

In-Band Network Management

Network Management Protocols• SNMP• Telnet• HTTP/s - XML• TFTP• TL1• SSH

Users

NOC

Business and Network Management Traffic Uses Common Infrastructure

Network Management Security• Access List• Firewalls• VPN• IDS/IPS• AAA• Trust levels

Data Center Resources

User VLANs

VLAN Trunks

Trust Model – Defines Security Posture

- Network management features are vulnerabilities (provides configuration and access information)

- Security policies define trust model - Users access- Customer access- Vendor/Mfg local/remote tech support

access- NOC/Tech support staff- Secure visualization and

instrumentation - Internal, Customer, Management

operations in separate IP subnets/VLANs/PVCs, etc., over shared network infrastructure.

- Log everything- 2-Factor authentication

Management VLANM

M

M M

M M

M M

M

Utilize MPLS VPNs and VRFs for Management Network

Prevalent Layer 2 Security Issues

Routers

Rogue InsiderCrafted HSRP coup packet with

higher priority

• STP/BPDU• VTP• VLAN Hopping• ARP Poisoning• FHRP• Rogue DHCP Server• Horizontal and Vertical Pivoting

Common Issues Suggested Remediation

• BPDU and Root Guard• Secure VTP • Disable Dynamic Trunking• Dynamic ARP Inspection• Limit MACs per Port• Secure FHRP• DHCP Snooping, Disable DHCP Trust• PVLANs, VACLs, DHCP Option 82• L2 NetFlow• Secure Information Flow Trust

Relationships

Network Visualization and Instrumentation

Whitelist the Network Trust Relationships

Whitelist Trusted Information Flows in Monitoring

Q & A

THANK YOU