Hey everyone and welcome to another deep dive.
Today we're diving into the world of cybersecurity.
It's a critical topic these days.
That's for sure.
Not just about protecting gay anymore.
Right. It's everything.
It really is the foundation of our digital lives now.
Could new green more.
And that's what makes this document we're looking at today.
So relevant.
Oh yeah. What have we got?
002, Chris domain 7, section 2 dot PDF.
It outlined some of the real world strategies used every single day
to combat cyber threats.
Real world stuff.
I like it.
Get's right to the point.
So HECTION 1, understanding the fundamentals, intrusions and
defensive measures.
The fundamentals are key.
Absolutely.
Okay.
Picture this.
You're at a packed concert.
Okay.
I'm picturing it.
The bands about to start.
Everyone's hyped.
Suddenly you see someone trying to sneak past security.
Ah, no, no, no.
No ticket, no shame.
That is a great analogy for an intrusion actually.
Trying to get into a system, get that data without authorization.
And just like at that concert, you've got security guards right.
Well, organizations have intrusions, detection systems,
IDSs or intrusion prevention systems.
Yeah.
IPSs.
So it's like a layered approach.
You've got security guards, AMD.
You've got the ticket checkers.
Precisely.
And these IDS and IPSs, they're like the first line of defense
constantly on the lookout for anything suspicious.
Exactly.
But when something happens, how do organizations react in real
time?
Yeah, that's the critical moment.
That's where science come in.
Security information and event management systems.
Science.
Think of it like a high-tech command center.
Instead of generals, you've got analysts,
monitoring a massive screen.
Okay.
And the science, the system, is pulling in data from everywhere.
Firewalls, servers, applications, everything.
Wow.
So it's like the central nervous system for cybersecurity.
You got it.
But, you know, a command center is only as good as the people
making the decisions right.
That's true with everything.
The human element.
You need skilled analysts to interpret that data to connect the dots.
You'd be surprised.
Sometimes it's seemingly minor alert.
Like what?
Something like a log in from an unusual location at an odd hour.
Could be nothing or wrong.
Or it could be the first sign of a major breach.
Exactly.
I remember early in my career, we had this one alert.
It seems so insignificant at first.
What happened?
It ended up being a really sophisticated fishing attack,
aimed at a high-level executive.
But because we had that robust sign system in place,
and a sharp analyst who knew what to look for, you caught it.
We stopped it before any sensitive information was compromised.
Wow.
That just shows you even with all the technology in the world.
You need the human expertise.
It all comes back to that.
So, signs, clearly critical, but also incredibly complex.
That's fair.
What's with all this aggregation, normalization, correlation, stuff?
It's a lot.
Imagine you're trying to solve a puzzle.
But the pieces are scattered everywhere, and some are even written in different languages.
That's what a sum does.
It gathers all these security logs and events.
Okay.
Put some in a common language that's normalization part, and then tries to find the connections
between them.
Correlation.
To reveal the bigger picture.
Okay, so it's like piecing together clues in a digital detective story.
But how do they even begin to make sense of all that data?
Well, that's where aggregation comes in.
The CM doesn't just dump all of this information on analysts at once.
It aggregates or groups, similar events and data points together.
So analysts can quickly identify those patterns anomalies.
So it's really about identifying those red flags early on.
Yes.
But then what happens next?
This is where it gets interesting.
This is where it gets even more interesting, and that's where we'll pick up next time.
With a deeper look at SOAR, security orchestration, automation, and response.
Ooh, SOAR sounds intriguing.
Can't wait to dig into that.
Okay listeners, you heard it here first.
We're about to take this deep dive to the next level.
Don't touch that dial.
We'll be right back.
All right.
So before the break, we're really getting into the nitty gritty of seams.
Those cybersecurity command centers.
But you left us hanging with that cliffhanger.
Soar.
Ah, yes.
So, security orchestration, automation, and response.
The ACM is fantastic at collecting analyzing data, but it doesn't actually do anything
about the threats it uncovers.
That's where SOAR comes in.
Takes those alerts from the sign and helps automate the response.
So it's like having what pre-programmed responses for different security events.
So if the sum sees something suspicious happening, SOAR can just automatically take action.
Exactly.
Let's say you're a sign to text a fishing attack in progress.
Or can automatically start blocking those malicious emails, quarantine any accounts that
might be affected, even start tracing that attack back to its source.
Wow.
All without a human analyst having to even lift a winger.
That's incredible.
It's like having a whole team of security experts working around the clock, but it's
automated.
That's the beauty of it.
It frees up those human analysts to focus on the really complex stuff.
The things that need that human intuition, human expertise, threat hunting, incident response.
Right.
But even with a sign, even with SOAR.
That's really just the beginning.
Our source material is 002, Chrispoke, domain7section2.pdf.
It really emphasizes this continuous monitoring.
Yeah, because it's not a set it and forget it, kind of deal.
The threat landscape is constantly changing.
New vulnerabilities pop up all the time.
All the time, new threats emerging every day.
Like imagine training a team of athletes.
You wouldn't just train them once and then expect them to go out and win championships
year after year.
Right.
See that ongoing coaching, the practice, the feedback to really stay at the top of
their game.
Okay, I like that analogy.
So how does continuous monitoring actually work in practice?
Our source material hit outlines a six step process, a cyclical process, which is key
here.
It's defined, established, implement, analyze, respond, review.
Okay, so break that down a little bit.
So first, you've got to define your objectives.
What are you trying to protect?
What are your biggest threats?
Then establish your monitoring infrastructure.
What tools, what procedures you're going to use, then of course you got to implement them.
And then continuously analyze that data you're collecting.
If there's an incident, you respond accordingly.
And then review the whole process to see what worked, what could be improved, always learning,
always adapting.
It's that feedback loop that's so crucial.
Exactly.
And a big part of that analyze phase.log analysis.
Okay, log analysis.
Starting through all those digital trails that every user, every system, leads behind.
Precisely, every action taken on a network, it gets recorded in logs, every log in attempt,
every file access, every email sent.
Log analysis is about making sense of all that data.
Connecting the dots, looking for those patterns, those subtle anomalies, that might just
point to a threat.
It's like those crime dramas, right?
They're analyzing phone records, piecing together, someone's movements.
Exactly.
A single log entry might not tell you much on its own.
And when you start correlating events across multiple systems, across time, you start to see
the bigger picture.
Let's say you see a user downloading a huge amount of data at 30 AM.
Maybe not that unusual on its own, right?
But what if that same user just minutes before, accessed a sensitive database for the first
time ever?
Okay.
And what if their login location shows there suddenly in a different country?
Now, you've got a pattern.
Something worth investigating.
Exactly.
We've talked a lot about intrusions, right?
People trying to get it, I am.
But what about data getting OUT?
Egress monitoring, right?
Egress monitoring.
All about controlling the flow of data leaving your network.
Uh-huh.
Imagine setting up a custom's checkpoint, but for all data leaving your organization.
Okay.
So if someone tries to, I don't know, sneak out of flash drive full of sensitive information.
Yeah, out the back door.
Egress monitoring should be that a catch it.
So, about setting those rules, those policies for what data can leave when and who we can
go to.
So it's like a security guard checking your bag on the way out of a museum, making sure you're
not walking away with any priceless artifacts.
Exactly.
And attackers, they're becoming more creative.
Data loss prevention techniques, DLP, or becoming essential.
These technologies can actually identify sensitive data.
Think credit card numbers, intellectual property, things like that.
Okay.
And then block any unauthorized attempts to send it outside the network.
So it's like what a super sniffer dog at that custom's checkpoint able to sniff out even
the most cleverly hidden contraband?
Love the analogy.
But even DLP isn't foolproof.
Attackers are always finding new ways to get around those security measures.
One method that we see a lot is steganography.
Steganography, that's a good one.
It's like hiding in plain sight, right?
Exactly.
Hiding a secret message in an image file.
You got it.
It's like digital camouflage for data.
And while it can be used for perfectly legitimate purposes, it's also a favorite tool for
cyber criminals to try and sneak that stolen data past the security checkpoints.
So that's why organizations are using specialized diginography detection tools.
They analyze those files no matter how well disguised and try to uncover any hidden messages.
It's a constant arms race, isn't it?
Always one step ahead.
The security experts build the walls higher and the attackers just find craftier ways to
tunnel through them.
It really is a means you think of those old spy movies.
It does.
Which speaking of spies brings us to another critical aspect of cyber security.
Threat intelligence.
Knowing your enemy.
Oh, yes.
Tell us more.
So threat intelligence.
Knowing your enemy.
How do organizations actually get that intel?
It's a process.
A combination of things really.
There's open source intelligence.
Things like keeping an eye on hacker forums, monitoring malware campaigns, staying
up to date on the latest vulnerabilities that are being exploited.
You know, that kind of thing.
Okay.
But then there's also closed source intelligence.
This is stuff that comes from security vendors, government agencies, organizations that
have dedicated teams who are tracking these threats.
So it's like having this global network of informants feeding you information about what's
happening.
And what do organizations actually do with all this intelligence?
Well they use it to anticipate.
To try and get ahead of those threats, mitigate them before they even happen.
Proactive.
Exactly.
It's about understanding the tactics, the techniques these attackers are using.
And then strengthening their defenses accordingly.
And I'm guessing this is where the cyber kill chain comes in.
Absolutely.
We touched on it earlier, but I think now is a good time to really kind of dive in a
little deeper.
Yeah, good idea.
Yeah.
So the cyber kill chain is developed by Lockheed Martin.
And it breaks down a cyber attack into seven stages.
So for instance, reconnaissance, weaponization, delivery, exploitation, installation, commanding control,
and then finally actions on objective.
Seven stages.
Okay.
And by understanding each of these stages, organizations can then start to identify their own
weaknesses and build better defenses to address them.
So it's like a playbook in a way you can anticipate the attackers moves.
Yes, exactly.
So like, let's take reconnaissance for example.
What actually happens during that phase?
So reconnaissance, this is all about gathering information.
Think of it like, you know, casing a bank before robbing it.
Okay.
The attackers, they might be scanning your website looking for vulnerabilities, maybe searching
for employee information online, even trying to gain access through fishing emails.
Yeah.
Just to see what they're dealing with.
So if organizations can recognize those signs that reconnaissance happening early on,
they might be able to stop that attack before it even really gets started.
Wow.
That's the power that cyber kill chain framework.
It gives you that roadmap for understanding how attackers think and how to disrupt them.
It's amazing how much strategy goes into this.
It really is like a chess match, isn't it?
It really is.
Both sides constantly trying to outmaneuver each other.
And we've talked a lot about these external threats, hackers, you know, outside the organization
trying to break in.
But what about the threats that come from inside an organization?
The insider threat.
Ah, yes.
The insider threat.
That's a whole other ballgame.
That's where it gets really tricky.
Because how do you even begin to address that?
Well, this is where user-in-ended behavior analytics comes in.
We call it UEBA.
UEBA.
So most security tools, they focus on those known threats, those known vulnerabilities.
UEBA.
It's about understanding what's normal behavior within an organization and then identifying
anything that deviates from that norm.
Because it's like having what a security camera that's not just recording what people are doing,
but also analyzing their behavior.
To see if anything is out of character.
Perfect analogy.
So for example, let's say you have an employee and they normally only have our access
marketing documents.
But suddenly, they're downloading huge amounts of financial data in the middle of the night.
Red flag.
Exactly.
Or imagine a user's account and it's exhibiting unusual activity, maybe they're
logging in from multiple locations at the same time.
Or accessing systems they've never even touched before.
These are things that might indicate something's up.
It's like in real life, right?
And you notice someone's acting out of character.
It might not be anything nefarious, but it's worth at least a second look.
But how do you even teach a system what normal is in the first place?
That's the thing with UEBA.
It learns over time.
It builds up this baseline of normal behavior for every user, every entity on that network,
just by analyzing all the historical data.
And then it's constantly looking for those anomalies.
Anything that deviates from the baseline, it flags it for the security team so they
can investigate.
Wow, so this is like having a digital detective constantly on the lookout.
Pretty much.
That's amazing.
But this is incredibly complex stuff.
I mean, what kind of expertise goes into building and managing these systems?
Well, you've got your security analyst, of course.
They're modern, the alerts, they're investigating incidents responding to threats as they
happen.
Then you've got security engineers.
They're the architects.
They build these security systems.
Configuring firewalls, implementing intrusion detection systems, setting up those seam and
sore platforms, the whole nine yards.
Right, it takes a team.
And then you have your security researchers who are constantly probing for those new vulnerabilities,
developing new techniques, trying to stay one step ahead of the bad guys.
This is a whole ecosystem of people working together.
Absolutely.
And it's not just technical skills either.
It's that communication, that collaboration.
It's all critical.
Right, because you could have the most sophisticated security systems in the world, but if someone
leaves their password on a sticky note.
Exactly.
Or falls for a fishing scam.
It's all for nothing.
It's about layers.
You need the technology.
You need the people and the processes to make it all work.
Well said, we've covered a lot of ground in the steep dive from the front lines, intrusion
detection, all the way to the nuances of user behavior analysis.
And it's clear, cybersecurity.
It's not a one-size-fits-all solution.
It's this multifaceted, always evolving field.
Oh, we evolving.
That requires vigilance adaptability.
A real deep understanding of both the technical and human elements.
Significent, I bet, or myself.
And you know, if there's one thing I hope our listeners take away from this deep dive,
it's that staying informed is key.
The more you know about the latest threats, the mitigation strategies, the better equipped
you'll be to navigate this digital world safely, securely.
Could an agree more?
Sir, dear listener, as you go about your digital day, remember the lessons we've talked about.
Cyber security, it's not just about protecting data.
It's about protecting our interconnected world, ensuring a safer, more resilient, digital
future for everyone.
Until next time, stay curious, stay vigilant, and stay secure.