Reference : Network Attacks and Exploitation by Matthew Monte
Failed Tactics
Antivirus and Signature Based Detection
Antivirus: Attacker can buy and test against it.
- Don’t be on the bad list: if the program not on the antivirus list, theres no code signature.
- Can avoid doing bad behavioul: thhrough trial and error or reverse engineering.
- Be stealthy
Signature Based Detection: it does not encounter any strategic principle
- Information of product Defender use can be obtained easily; by release of partnership companies, or through the access, posititon recruiting.
- Predictable schedule of updates sequenece (once a year…)
Password Policies
Both ignore the foundational principle of humanity.
- Choos a strong password - humans are terrible at choosing random passwords (predictable)
- Avoid reusing passwords - no way to enforce and check among users.
User Training
Unless there are real consequnces to user mistakes, it wont work.
Crafting a Defensive Strategy
- Avoid recreating the wheel - Start with following the guides
- Know yourself - what is truly essential.
- Develp data classification system - apply rist management mentality to what is important (determine value, how much worth to spend on it…)
- Prioritize the user base by the sensitivity of the a data they can access.
- Prioritize systems according to how they interact on the network.
Application Whitelisting
Only allowed can play the party
Network Segmentation and Segregation
Segmentation : For attacker has two choices
- Treat as a single network: sucks resources of attacker as it takes great amount of work by treating each segment as a network. It also dramatically increase the exposure of attacker.
- Jump between segments: When cross the segements —> creates perfect choke point. Constraints the ability to move and obstructs attackers ability to communicate. Counters Operational security.
Log Analysis
Questionable for preventing. And attacker will sacrifice one and collect the data. And able to do sidestepping. It is good for Defender after a compromise.
Web Domain Whitelisting for All Domains
Only allowed domain can be visited
- Limits the avenues of infiltration - less vulnerable.
- Limits Attaker’s option for communication after establish the access.
It is against the foundational principle of humanity.
Deny Direct Accees form Workstation
Needs all outbound access through an authenticating choke point. Great for limiting attacker’s access without limiting uesrs much. It needs innovation, but once set it is good. It dircetly encounter attackers strategy on almost every level.
