John Butters Running Tiger Teams 19 September 2018 John Butters Running Tiger Teams - What’s the point?

Outline what we do Do’s and don’ts 19 September 2018 Agenda Outline what we do Do’s and don’ts

19 September 2018 What is it? Using the techniques of hackers or crackers under legitimate and in controlled environment to find and/or exploit security vulnerabilities Includes Internal External Social Engineering War Dialling Wireless Application Vulnerability Scans Typical Findings Technical - missing patches - misconfigurations - no IDS Non-technical - human practices - poor processes to monitor & respond - poor reaction times Trophies - access to wide range of resources sensitive and non-sensitive

Anatomy of a hack

Trace route Password Cracking Bank hack 19 September 2018 Video Clips Trace route Password Cracking Bank hack

19 September 2018

19 September 2018

19 September 2018

War Stories Global Oil Company 19 September 2018 War Stories Global Oil Company Able to administer process control unit for a gas pipeline Global Chemicals Company Access to HR information, strategic merger target information; personal credit card details, secret formulas/recipes Large Utilities Company Control of large portion of network including business critical systems Global Hotel Chain Central reservation system, business plans, board report, executive compensation, guest and credit card details

Why do people buy it? Example one 19 September 2018 Why do people buy it? Example one Buyer - internal audit Objective - 1) To prove inadequacy of security - 2) To score points, personal cudos Scope - known weak application - limited by budget - “safe” targets - single site external attack

19 September 2018 Scenario one - Results Technical report for IT to address (Symptomatic response) Exec summary saying “you’re vulnerable to hackers” Increased distrust and animosity between IT and IA High profile, resulting in total focus on solutions to the findings After actions to address report everyone relaxes because – “we’ve had our security tested and we’ve fixed all the holes. Report to the business customers and the world that we’re OK because we have regular testing and have addressed all the vulnerabilities. Conclusion: The exercise has done more harm than good.

Scenario two Buyer – Global CISO 19 September 2018 Scenario two Buyer – Global CISO Objective – Determine vulnerability of corporate websites to defacement or DoS at time of global launch of brand ($40million spend) Scope - Corporate websites with specific emphasis on vulnerability by external attack to DoS or defacement Result - Some issues to address pre launch - comfort that reasonable steps taken to protect corporate brand during period of launch. Conclusion - Right tool for the right purpose. Happy client.

Pro’s and Con’s Pro’s Cons FUD (fear, uncertainty, doubt) 19 September 2018 Pro’s and Con’s Pro’s Attention & awareness Positive result implies weakness Relatively quick and inexpensive Keeps people on their toes Useful component of overall assurance programme Cons FUD (fear, uncertainty, doubt) Potential agendas, internal conflicts Unbalanced view of security Negative result doesn’t ensure security May be unrelated to business context Highlights problems not solutions Tells techies nothing new Results misused to give false assurance Legal and risk implications Professional ethical hackers don’t know all that the underground hacking world does Focus on perimeter – perimeters are breaking down Like a baseball bat – a useful tool for the right purpose, but more improper than proper uses

Doing it for the right reason 19 September 2018 Doing it for the right reason As part of overall security programme/assurance function or for a specific purpose Clear objectives & scope Report relating to - Objectives - The business - Addressing causes as well as symptoms Consider presentation alterations Clear follow-up actions Manage, politics, legal issues & risk

Scoping & Objectives Business Input Develop Penetration Tests Used By Threat Groups Business Input Remote Dial Up Attack Internet Attack Web Browser Attack Internal Attack Social Engineering Assess Threats Perform Tests Simulating Threat Groups Strategic Actions Short Term Fixes Medium term actions Exposure Feedback

19 September 2018 Questions