Women in ICT and Newbie Night August 15 Introduction Statistics - PowerPoint PPT Presentation

Women in ICT and Newbie Night August 15

Introduction… Statistics • Who here is from some form of social media? • Who here is a developer? • Cyber Security FM (Women in ICT and Newbie Night) August 15

Cyber – Governance, Risk and Compliance Cyber Security FM (Women in ICT and Newbie Night) August 15

Cyber Security can be difficult to define.. Integrity Auditability Confidentiality Cyber Security FM (Women in ICT and Newbie Night) August 15

Cyber risk - Think business risk, not IT Technology People Process • Firewalls • Employees • Incident Management • Anti-virus • Contractors • Change Management • DLP (Data Loss Prevention) Vendors Patch Management • • device Cyber Security FM (Women in ICT and Newbie Night) August 15

NSA Data Breach Firewall An American computer professional, former CIA employee, and former government contractor. He leaked classified information from the U.S. National Security Agency (NSA) in 2013 to reveal secrets about NSA Are we secure surveillance programs. yet? Cyber Attack on US Military Security The attackers used a spear-phishing e- Breach mail to penetrate the system and gain access to sensitive information. This attack was made possible by poor human performance. Cyber Security FM (Women in ICT and Newbie Night) August 15

Threat elements of a Cyber attack Motive Property Description Examples  Hackers  Actor Person at the source of an attack with specific goal and motivation. Employees  Third Parties  To steal personal information Motive Deliberate or accidental  Damage reputation  Sensitive data Assets which the threat actor intends to steal or affect in some way to achieve  Asset Mail server their goals.  Staff member  Disclosure of Information Outcome The effect of an attack.  Service Disruption Cyber Security FM (Women in ICT and Newbie Night) August 15

Threat Scenario – Company X Data Breach PII (Personally Identifiable Personal information stored Company X (Healthcare Backup tapes stolen during in backup tapes transferred Data), PHI (Personal Health transportation Service Provider) Information) to a bank safe Risk Actor Asset Risk Impact Mitigating Controls What is the attacker What is the business risk? Who performs the attack? What is the potential impact? What can we do to mitigate the risk? targeting? Data Breach – Company X  Employee Sensitive data Loss of confidential or People is breached and sensitive  PII (Personally sensitive data resulting in  Security training and awareness information is stolen. Identifiable Data) financial, reputation or for third party service provider  PHI (Personal Health compliance impact. Information) Process  Safe transportation of back up tapes Technology  Encryption of backup tapes Cyber Security FM (Women in ICT and Newbie Night) August 15

Security Assessment / Pentest Cyber Security FM (Women in ICT and Newbie Night) August 15

Pentest Try to break into things • Single, “point -in- time” check • As much coverage as we can Provide invalid input • Is an application expecting a number? Give it ‘ OR ‘1’=‘1 • Is an application expecting a filename? Give it ../../../etc/passwd • Is an application expecting a URL? Give it file:// or supply a hostname and a port number Cyber Security FM (Women in ICT and Newbie Night) August 15

Demo - SQLi Cyber Security FM (Women in ICT and Newbie Night) August 15

Demo - SQLi Try using a single quote for a password: Cyber Security FM (Women in ICT and Newbie Night) August 15

Demo - SQLi query expression 'username = 'admin' AND password = ''''. query expression 'username = 'admin' AND password = ''''. query expression 'username = 'admin' AND password = '1' OR '1'='1''. Huzzah ! Cyber Security FM (Women in ICT and Newbie Night) August 15

“The Magic” Carefully passed down through generations of pentesters • Single quote: breaks SQL statements • Percent sign: breaks SQL LIKE • Double quote: breaks DOM attributes, string concatenation • Angle bracket: breaks DOM when inserted directly into DOM • ../: breaks when string is part of the filename • Semicolon: breaks shell/interpreters, breaks when string is a filename (and filtering for ../) • Asdf: Invalid syntax, designed to trigger an error • Double forward slash, double hyphen, # sign: Comment. Invalidates rest of original command I will give you $10 if you enter this into every field for a week and nothing breaks. Cyber Security FM (Women in ICT and Newbie Night) August 15

Using “The Magic” Proxy • Intercept traffic, manually replace parameters • Burst (https://github.com/tweksteen/burst) • Burpsuite In-browser • Put things in the URL • Write a browser plugin • Developer tools (to reveal hidden fields) Cyber Security FM (Women in ICT and Newbie Night) August 15

If you’re interested… Wargames • Google Gruyere • Exploit-exercises.com • Vulnhub • Bugcrowd Tools and techniques • Learn systems very thoroughly • Learn a low-level programming language • Learn something like Perl – flexibility is awesome Cyber Security FM (Women in ICT and Newbie Night) August 15

Thank you! Cyber Security FM (Women in ICT and Newbie Night) August 15