Think Like an Attacker - #223

You spent years acting like the attacker.

What's one security myth that organizations still believe that drives you absolutely crazy?

Oh, man.

The number of times I have been asked after delivering a report why X or Y product didn't stop me, why didn't insert company name with fancy box title here stop me? And the answer is almost always the same, which is that you put it in there without understanding what it actually does, but more importantly, what it doesn't do.

But I understand what it doesn't do.

And that informed my paths forward.

Right.

So I stepped right past your very expensive box or your very expensive software and did what I needed to do a different way.

Because it was more of a configuration issue than just, you know, rolling it out and having the label there.

Or it doesn't solve as many problems as it was pitched to solve at some point in the sales cycle.

Or if it does try to solve those problems, it doesn't solve all of them very well.

Got it.

When you first gain access during a red team engagement, what are the most common mistakes you see companies making that create the biggest opportunities for attackers?

This is going to be funny for anyone who has ever listened to me talk for an extended period of time, because it's always the same three things.

It's always network segmentation.

It's having an asset inventory and actually knowing what your threat model is.

enough people are doing any of those three things.

So you don't know what you have, so you can't secure it.

You don't know how what you do have can talk to other stuff you have, so you can't keep them from impacting each other.

And you don't even know who is actually trying to get your stuff or encrypt your servers or steal your data or how they're going to do it.

So even if you did know everything you had and how it interacted with the rest of what you had, how do you know what to defend against? And I know all of those things, at least once I get in the environment, because that's my job.

And so oftentimes I come out of environments knowing more about it than the people who run it do.

Because you're really digging into the environment and looking at the gaps.

Usually, even before I start attacking stuff, I'm just figuring out what's there.

But because I have iterated so many times over understanding my situation, we call it situational awareness, that I uncover things that other people don't see and that they might have ignored in their environments for months, years, or longer.