Training the Future Cyber Security Specialist: A Novel Approach Fatih Karayumak fatih.karayumak@tubitak.gov.tr

The Norm Universities Training Institutes Standart Curriculums Text-book and partly practiced education Lacking Real-World examples Good in theory No hands-on training Training Institutes Financial Concerns Limited time Crammed-up classrooms Limited Hands-on training

The Aim 3

Needs Analysis Emphasize on Hands-on Experience Why do we need such an environment? Emphasize on Hands-on Experience Measurement of Readiness for Cyber Incidents Train for what Security Technologies / Products Security Monitoring Possible Attack Methods Incident Handling Other Considerations As fast as possible As comprehensive as possible 4

Hands-on Experience Why hackers mostly reach their target? Real World Scenarios Why hackers mostly reach their target? Endurance Non-technical vulnerabilities Think like an hacker and calibrate for the worst case Emulate / simulate your own environment (learn for your system) Put yourself targets as an hacker and try to achieve it Find your way through the complex system 5

Measurement of Readiness How ready are we? Main Motivation is Defence Defending is harder than attacking Technical measures do not help alone How to measure your defensive capability Effectiveness of Defensive Measures Measurement of readiness should be system specific Human (End users and administrators) + Technology + Hardening + Monitoring + Policy 6

Train for What Knowledge and Skills Cyber Security Domain Knowledge and Skills Expertise areas Skills Possible Defensive and Offensive Scenarios Incident Handling and Cyber Security Crisis 7

Our Approach

Conseptual Diagram 9

Building Blocks 10

Source of the Know-How How did we gather the know-how? 26 different governmental entities have been security tested in the last 4 years. Penetration testing of 38 banks in 2011 including the international banks (BDDK- Banking Sector Regulator) Delivered 15 technical courses to 610 personnel from 55 governmental entities Penetration testing of private sector companies (GSM Sector, Insurance etc.) Participated in NATO Locked Shields 2014 in Green and Red Temas Participating in NATO Cyber Coalition Exercices to support TAF CDC 11

Creating the Training

Scenario Module

A Sample Drawing for the Scenarios & Steps 14

A Sample: Expertise and Scenarios Windows OS and Domain Security Some Scenarios Involved Medium Acquiring domain admin rights in a Windows Domain by pyhsically accessing an unprivileged standard domain-enabled PC Medium Acquiring domain admin rights in a Windows Domain by obtaining credentials from a truecrypt file found in an NFS shared folder Hard Acquiring domain admin rights in a Windows Domain by sending a phishing e-mail that includes a malware Hard Bypass the anti-virüs software installed on the Domain Controller …. 15

Training the Skills

A Sample Scenario: The Building Steps Train for the possible attack methods and impact Scenario Acquiring domain admin rights in a Windows Domain by pyhsically accessing an unprivileged domain-enabled PC The steps to accomplish Step 01: Pyhsical access to a PC Step 02: Enunumerate the user accounts from the command line Step 03: Access to company network Step 04: Internal network discovery using NMAP Step 05: Vulnerability scanning using NESSUS Step 06: Find the vulnerable Windows XP machine Step 07: Vulnerability scanning using NESSUS Step 08: Find the vulnerable PC Step 09: Exploit a vulnerability to gain access to the PC Step 10: Get the password hashes of some users Step 11: Access the machine of the domain administrator by opening a meterpreter Shell Step 12: Acquire the clear-text password of the domain administrator 17

Measurable Steps

Monitoring Module

A Sample: Monitoring 20

Fielded Events Cyber Security Summer Camp for University Students In Full Activity Cyber Security Summer Camp for University Students SiberMeydan UNI (Cyber defence contest among all universities in Turkey) National Cyber Security Exercise 21

Work in Progress Separately monitoring defensive and offensive actions SATCOM Terminalleri Separately monitoring defensive and offensive actions Integrate tactical and strategic level events and notifications with the technical scenarios. Hence, get the decision support involved More simulation than emulation Simulation of technical vulnerabilities and/or OS services Use red teams as human-in-the-loop 22