Instructor: Training and testing. 2 2
The last thing we have to focus on in our preparation 3 3
is training and testing. 4 4
And there is a difference between those two things. 5 5
First, let's talk about training. 6 6
Training is education to ensure employees 7 7
and staff understand your processes, procedures 8 8
and priorities during an incident response. 9 9
By conducting training, 10 10
you're going to make sure that your people are ready to respond 11 11
when something bad happens. 12 12
Training should be provided to all employees 13 13
with a relevant perspective and focus based on their needs 14 14
because not everyone is going to get the same training. 15 15
For example, if you're a responder, 16 16
you need training in a technical capacity. 17 17
What are the procedures you're going to follow? 18 18
How do you re-image a machine? 19 19
How do you remove malware? 20 20
How do you change configuration settings? 21 21
All of that stuff is part of your responding training. 22 22
Now, if you're a manager or an executive, 23 23
you're going to have different training requirements. 24 24
You're going to be focused more on risk versus reward. 25 25
You're going to be focused more on managerial decision making 26 26
and communication across the organization 27 27
and outside the organization 28 28
with law enforcement and the media as well. 29 29
And finally, we have our end users. 30 30
And our end users need to be trained as well. 31 31
They need to be trained on the way to report 32 32
if they suspect an incident is occurring. 33 33
For instance, as an end user, 34 34
if I open up my email and I see a phishing campaign, 35 35
how do I report that to the service desk? 36 36
If I went and clicked on one of those links, 37 37
I'm going to need remedial training to know 38 38
how to identify that in the future 39 39
and make sure I don't fall for that again. 40 40
This is the idea of your end user training. 41 41
They need training on how to be a better user 42 42
and how to prevent incidents 43 43
from occurring in the first place. 44 44
Now, when you're providing training, 45 45
one of the things you want to make sure you're capturing 46 46
is lessons learned from previous incidents, 47 47
and you want to bring those back up during training. 48 48
Because when you have a lessons learned 49 49
that means it's something that went wrong in the past. 50 50
And how we can do it better in the future 51 51
is by training people on those lessons learned. 52 52
If we just write down those lessons learned 53 53
and nobody reads it again and nobody gets training on it, 54 54
then we're going to be doomed to repeat those things. 55 55
And so we want to make sure we're preventing that. 56 56
Remember, when you're doing training, 57 57
it's not just about technical skill here. 58 58
You also need to include soft skills 59 59
and relationship building within your teams, 60 60
because that is important as well 61 61
if you want a high functioning CSIRT. 62 62
Next, let's talk about testing. 63 63
Now, testing is the practical exercising 64 64
of incident response procedures. 65 65
With training, we're going to teach you what to do, 66 66
in testing, we're going to make sure you know how to do it. 67 67
Now, when we're dealing with testing, 68 68
we'll often conduct a test 69 69
to simulate a significant incident. 70 70
Now, the challenge with this is doing this is very costly 71 71
and it can be a complex event. 72 72
For example, I've been involved 73 73
with a lot of testing over the years. 74 74
One such test was a full scale exercise 75 75
that showed exactly what we would do 76 76
in the event that we had a large scale data breach. 77 77
Now, this went across multiple sites around the world 78 78
and it cost us hundreds of thousands of dollars to do, 79 79
but it made sure everyone knew what they were doing 80 80
and that we could actually go through those actions 81 81
and get a bad guy out of our systems. 82 82
Now, when you're designing your test, 83 83
you can do it in one of two major ways. 84 84
The first is a tabletop 85 85
and the second is a penetration test. 86 86
Let's talk about both of these. 87 87
When we're dealing with a tabletop exercise or a TTX, 88 88
this is an exercise that uses an instant response scenario 89 89
against a framework of controls or a red team. 90 90
Now, the reason we call it a tabletop exercise 91 91
is because we're doing it on a tabletop 92 92
and we're not physically doing it in our networks. 93 93
In a tabletop, we might gather experts around the table 94 94
and we'll start presenting scenarios. 95 95
For instance, if I was leading the tabletop, we could say, 96 96
you have an indication of a data breach. 97 97
It's occurring on this database server. 98 98
What do you do? 99 99
And then the defenders would start saying 100 100
what they're going to do, and they would each take turns, 101 101
almost like they're role-playing, 102 102
what they would do in the case of this particular scenario 103 103
as they work through that event. 104 104
Now, the benefit of doing a tabletop is 105 105
it's a lot less expensive than a full-blown exercise, 106 106
but there are some negatives to it in the fact 107 107
that you can't get this hands-on experience 108 108
because you're not physically doing the things 109 109
on the keyboard and making actions happen on the network. 110 110
So it's really more of a theoretical exercise here. 111 111
Now, another way you can do this 112 112
is you can break people up into red teams and blue teams. 113 113
Now the red teams are the attackers 114 114
and the blue teams are the defenders. 115 115
And so you can actually take turns saying, 116 116
okay, here's a scenario, 117 117
blue team this is what you detect, what do you do? 118 118
And then based on what they say 119 119
the red team then says, 120 120
okay, we would then do X, Y, and Z. 121 121
And then the blue team would say, 122 122
well, then we would see this and respond in A, B, and C. 123 123
And they'll go back and forth 124 124
through several rounds to hit and attack and defend 125 125
and go back and forth until we can see what the effects are. 126 126
The benefits of doing it as a red team 127 127
versus blue team type scenario 128 128
is that you're going to get live people thinking 129 129
through both the attacker side 130 130
and the defender side to help you come up 131 131
with a better solution 132 132
and how you can figure out better controls 133 133
to protect your network. 134 134
Now, another way you can do this 135 135
is by actually getting people on the network. 136 136
And this is done through a penetration test. 137 137
Now, a penetration test occurs 138 138
when a red team attempts to conduct an intrusion 139 139
onto the network using a specific scenario based 140 140
on threat modeling. 141 141
Now, this is an important concept here 142 142
when we're talking about penetration testing, 143 143
because we're not just doing something against the network 144 144
to see what we can do to get in. 145 145
We have a specific goal in mind. 146 146
So, if my goal is to go after the database server, 147 147
I'm not going to throw a distributed denial of service attack 148 148
at you. 149 149
That wouldn't be a valid pen-test. 150 150
So instead, we have a specific scenario based 151 151
on threat modeling, 152 152
meaning we know what a regular adversary would do, 153 153
and we're going to base our actions on that. 154 154
Now, when you're dealing with a penetration test, 155 155
you always have to agree on a clear methodology 156 156
and rules of engagement before that penetration test 157 157
is performed. 158 158
This is critically important 159 159
because there are rules to these things. 160 160
Like I said, I'm not just going to throw 161 161
a distributed denial of service attack at you 162 162
because that would probably be against 163 163
the rules of engagement. 164 164
Now, if they're in my rules of engagement, 165 165
then that would be fair game, but in most cases, 166 166
that's not going to be in there. 167 167
Now, penetration testing is covered in much more depth 168 168
if you take the CompTIA pen-test plus exam. 169 169
The reason for this is 170 170
that certification is all about red teaming. 171 171
It is all about being a penetration tester. 172 172
Whereas here in CySA, we are more focused on defense. 173 173
But as a defender, you should be familiar 174 174
with at least a couple of tools 175 175
that are used by pen-testers. 176 176
Some of the most common ones you're going to see 177 177
are things like Metasploit, Cobalt Strike, Kali Linux, 178 178
ParrotOS and Commando OS. 179 179
As a defender, if you ever see these tools 180 180
or operating systems on your network, you should be thinking 181 181
about the fact that they are penetration testing tools 182 182
which could be used as part of a penetration test 183 183
or even worse by an attacker, 184 184
because most of these are open source tools 185 185
that anyone can download and use.