1. Training the Future Cyber Security Specialist: A Novel Approach
Fatih Karayumak

2. The Norm Universities Training Institutes Standart Curriculums
Text-book and partly practiced education
Lacking Real-World examples
Good in theory
No hands-on training
Training Institutes
Financial Concerns
Limited time
Crammed-up classrooms
Limited Hands-on training

3. The Aim 3

4. Needs Analysis Emphasize on Hands-on Experience
Why do we need such an environment?
Emphasize on Hands-on Experience
Measurement of Readiness for Cyber Incidents
Train for what
Security Technologies / Products
Security Monitoring
Possible Attack Methods
Incident Handling
Other Considerations
As fast as possible
As comprehensive as possible 4

5. Hands-on Experience Why hackers mostly reach their target?
Real World Scenarios
Why hackers mostly reach their target?
Endurance
Non-technical vulnerabilities
Think like an hacker and calibrate for the worst case
Emulate / simulate your own environment (learn for your system)
Put yourself targets as an hacker and try to achieve it
Find your way through the complex system 5

6. Measurement of Readiness
How ready are we?
Main Motivation is Defence
Defending is harder than attacking
Technical measures do not help alone
How to measure your defensive capability
Effectiveness of Defensive Measures
Measurement of readiness should be system specific
Human (End users and administrators) +
Technology + Hardening + Monitoring + Policy 6

7. Train for What Knowledge and Skills
Cyber Security Domain
Knowledge and Skills
Expertise areas
Skills
Possible Defensive and Offensive Scenarios
Incident Handling and Cyber Security Crisis 7

8. Our Approach

9. Conseptual Diagram 9

10. Building Blocks 10

11. Source of the Know-How How did we gather the know-how?
26 different governmental entities have been security tested in the last 4 years.
Penetration testing of 38 banks in 2011 including the international banks (BDDK- Banking Sector Regulator)
Delivered 15 technical courses to 610 personnel from 55 governmental entities
Penetration testing of private sector companies (GSM Sector, Insurance etc.)
Participated in NATO Locked Shields 2014 in Green and Red Temas
Participating in NATO Cyber Coalition Exercices to support TAF CDC 11

12. Creating the Training

13. Scenario Module

14. A Sample Drawing for the Scenarios & Steps14

15. A Sample: Expertise and Scenarios
Windows OS and Domain Security
Some Scenarios Involved
Medium
Acquiring domain admin rights in a Windows Domain by pyhsically accessing an unprivileged standard domain-enabled PC
Medium
Acquiring domain admin rights in a Windows Domain by obtaining credentials from a truecrypt file found in an NFS shared folder
Hard
Acquiring domain admin rights in a Windows Domain by sending a phishing that includes a malware
Hard
Bypass the anti-virüs software installed on the Domain Controller …. 15

16. Training the Skills

17. A Sample Scenario: The Building Steps
Train for the possible attack methods and impact
Scenario
Acquiring domain admin rights in a Windows Domain by pyhsically accessing an unprivileged domain-enabled PC
The steps to accomplish
Step 01: Pyhsical access to a PC
Step 02: Enunumerate the user accounts from the command line
Step 03: Access to company network
Step 04: Internal network discovery using NMAP
Step 05: Vulnerability scanning using NESSUS
Step 06: Find the vulnerable Windows XP machine
Step 07: Vulnerability scanning using NESSUS
Step 08: Find the vulnerable PC
Step 09: Exploit a vulnerability to gain access to the PC
Step 10: Get the password hashes of some users
Step 11: Access the machine of the domain administrator by opening a meterpreter Shell
Step 12: Acquire the clear-text password of the domain administrator 17

18. Measurable Steps

19. Monitoring Module

20. A Sample: Monitoring 20

21. Fielded Events Cyber Security Summer Camp for University Students
In Full Activity
Cyber Security Summer Camp for University Students
SiberMeydan UNI (Cyber defence contest among all universities in Turkey)
National Cyber Security Exercise 21

22. Work in Progress Separately monitoring defensive and offensive actions
SATCOM Terminalleri
Separately monitoring defensive and offensive actions
Integrate tactical and strategic level events and notifications with the technical scenarios. Hence, get the decision support involved
More simulation than emulation
Simulation of technical vulnerabilities and/or OS services
Use red teams as human-in-the-loop 22