SANS 2016

Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show True Risk

• Beau Bullock
• Wednesday, March 16th, 8:15pm - 9:15pm

Your vulnerability scanner reports that there are no issues on your network. A pentester has spent the last week trying to exploit every system your organization owns with no luck. The check box for this yearâs compliance audit has been checked. While it is good that these things occurred, they do not complete the picture in regards to true risk.

Real attackers do not solely rely on software exploits to compromise an environment. In almost every breach you hear about the root of the compromise came from a phishing attack. This is why additional tests, post-infection, should be performed to assess just how far an attacker can go after gaining a foothold into your environment.

What command and control channels are available for an attacker to utilize to communicate with your internal systems? How easy is it for an attacker to move laterally within your environment and gain access to other systems? What are your detection capabilities when it comes to sensitive data being exfiltrated out of your environment? How do you test these attacker techniques using open-source tools?

This lecture will address these questions and more, including a showcase of attacker methodologies.

Speaker Bio:

Beau Bullock is a Senior Security Analyst at Black Hills Information Security. Prior to joining BHIS, Beau's primary role was implementing security controls to protect information and network assets. He has held information security positions in the financial and health industries. Beau has experience with all aspects of enterprise network security including penetration testing, vulnerability analysis, data loss prevention, wireless security, firewall management, and employee security training. In his spare time, he hosts the HackNaked.TV information security webcast and presents at conferences.

Beau holds a B.S. in Information Technology and has also obtained multiple industry certifications including OSCP, OSWP, GCIH, GCFA, GSEC, GPEN, GXPN.