SANS Information Security Reading Roomhttps://www.sans.org/reading-room/Last 25 Computer Security Papers added to the Reading RoomKohanaPHPOffensive Intrusion Analysis: Uncovering Insiders with Threat Hunting and Active Defensehttps://www.sans.org/reading-room/whitepapers/threathunting/offensive-intrusion-analysis-uncovering-insiders-threat-hunting-active-defense-37885Today's adversaries are advanced and more capable than ever before. Passive defensive tactics are no longer viable for pursuing these attackers. To compound the issue, the existence of an insider threat creates a challenging problem for the passive defender. One of the largest breaches of classified information was carried out by an insider. Months after the incident had occurred, the Department of Defense (DoD) only began to realize the implications of the leak. The damage did not solely rest with the United States. A cascade of consequences was felt in many parts of the world, resulting from this breach. Techniques like Threat Hunting, attempt to diminish this problem by combating advanced threats with people, also known as Threat Hunters. Although Threat Hunting is proving to be invaluable for many organizations there remains a chasm between detection and disclosure. Offensive Countermeasure tools such as the Web Bug Server and Molehunt can be leveraged as a means to proactively hunt insider threats. To keep up with the continually evolving human adversary, defenders must employ these offensive tactics to annoy and attribute their adversaries.Fri, 21 Jul 2017 00:00:00 +0000Automating Cloud Security to Mitigate Riskhttps://www.sans.org/reading-room/whitepapers/cloud/automating-cloud-security-mitigate-risk-37880As cloud computing services evolve, the cloud opens up entirely new ways for potential attacks. This paper explores the potential security challenges enterprises face as they migrate to any kind of cloud setup and offers guidance to ensure a smooth migration to new solutions.Thu, 20 Jul 2017 00:00:00 +0000Lateral Leadership and Information Securityhttps://www.sans.org/reading-room/whitepapers/networksecurity/lateral-leadership-information-security-37875In almost every company, a defined hierarchy, job description and organizational chart defines who is in charge of a certain issue. Nevertheless, most employees will recall situations, in which teams without a predefined leader had to collaborate. Being able to navigate these settings effectively is extremely helpful for the information security professional. More often than not, different departments and heterogenous groups have to work together to improve the security posture of a corporation. An open mind, real interest in the ideas of colleagues as well as a reasonable distribution of responsibilities and tasks is needed. Well known principles in information security are actually quite well suited for these circumstances.Wed, 19 Jul 2017 00:00:00 +0000Forensicating Docker with ELKhttps://www.sans.org/reading-room/whitepapers/forensics/forensicating-docker-elk-37870Docker has made an immense impact on how software is developed and deployed in today's information technology environments. The quick and broad adoption of Docker as part of the DevOps movement has not come without cost. The introduction of vulnerabilities in the development cycle has increased many times. While efforts like Docker Notary and Security Testing as a Service are trying to catch up and mitigate some of these risks, Docker Container Escapes through Linux kernel exploits like the recent widespread Dirty COW privilege escalation exploit in late 2016, can be disastrous in a cloud and other production environments. Organizations find themselves more in need of forensicating Docker setups as part of incident investigations. Centralized event logging of Docker containers is becoming crucial in successful incident response. This paper explores how to use the Elastic stack (Elasticsearch, Logstash, and Kibana) as part of incident investigations of Docker images. It will describe the effectiveness of ELK as result of a forensic investigation of a Docker Container Escape through the use of Dirty COW.Mon, 17 Jul 2017 00:00:00 +0000Securing Industrial Control Systems-2017https://www.sans.org/reading-room/whitepapers/ICS/securing-industrial-control-systems-2017-37860We annually gather and analyze raw data from hundreds of IT and industrial control systems (ICS) security practitioners. Our mission is to turn these inputs into actionable intelligence to support new developments and address trends in the field to inform the crucial business decisions. Here we report on these trends and other changes that make active use of ICS as a core enabler for business imperatives and provide actionable advice for today's security practitioners.Tue, 11 Jul 2017 00:00:00 +0000Using Docker to Create Multi-Container Environments for Research and Sharing Lateral Movementhttps://www.sans.org/reading-room/whitepapers/testing/docker-create-multi-container-environments-research-sharing-lateral-movement-37855Docker, a program for running applications in containers, can be used to create multi-container infrastructures that mimic a more sophisticated network for research in penetration techniques. This paper will demonstrate how Docker can be used by information security researchers to build and share complex environments for recreation by anyone. The scenarios in this paper recreate previous research done in SSH tunneling, pivoting, and other lateral movement operations. By using Docker to build sharable and reusable test infrastructure, information security researchers can help readers recreate the research in their own environments, enhancing learning with a more immersive and hands on research project.Mon, 03 Jul 2017 00:00:00 +0000Loki-Bot: Information Stealer, Keylogger, & More!https://www.sans.org/reading-room/whitepapers/malicious/loki-bot-information-stealer-keylogger-more-37850Loki-Bot is advertised as a Password and CryptoCoin Wallet Stealer on several hacker forums (carter, 2015) (Anonymous, 2016) (lokistov, 2015) but aside from cheap sales pitches on the black market, not much has been published regarding the details of its characteristics and capabilities. This poses a problem to information security analysts who require such details in order to accurately prevent and/or defend against incidents involving this malware. The primary goal of this paper is to provide a comprehensive resource on Loki-Bot for those looking to better understand its inner workings and to provide contextual knowledge in support of incident response efforts. Contents of this paper will focus solely on characteristics identified during code-level analysis within a debugger. Basic static and dynamic analysis of Loki-Bot will be left as an exercise for the reader.Wed, 28 Jun 2017 00:00:00 +0000Incentivizing Cyber Security: A Case for Cyber Insurancehttps://www.sans.org/reading-room/whitepapers/cyberinsurance/incentivizing-cyber-security-case-cyber-insurance-37845In the wake of recent events-Ukraine, Shamoon v2, WannaCry--providing cyber security continues to be an enigma. Unlike traditional engineering problems, we cannot define the constraints and rules adequately. We lack the data and models to describe the variables, let alone the mathematical function. Read on for ideas on how ICS can benefit from cyber insurance.Tue, 27 Jun 2017 00:00:00 +0000Zero-Touch Detection and Investigation of Cloud Breaches: A Review of Lacework's Cloud Workload Security Platformhttps://www.sans.org/reading-room/whitepapers/breaches/zero-touch-detection-investigation-cloud-breaches-review-laceworks-cloud-workload-security-platform-37840Today's increasingly dynamic cloud environments present new challenges to security practitioners. With security talent in short supply, tailoring old policy-and-logs approaches to the needs of an organization can require time and resources it just doesn't have. In this review, SANS analyst and instructor Matt Bromiley shares his experience using Lacework's new Zero Touch Cloud Workload Security Platform to mitigate these challenges.Tue, 27 Jun 2017 00:00:00 +0000Complying with Data Protection Law in a Changing Worldhttps://www.sans.org/reading-room/whitepapers/analyst/complying-data-protection-law-changing-world-37835Failure to meet legal and political expectations for data security can expose your enterprise to fines, lawsuits, negative publicity and regulatory investigations. These expectations are rapidly evolving across the world, making it difficult for enterprises to effectively protect their brands. This white paper reveals the major steps a large, multinational enterprise can take to assure the public, authorities and business partners that it is behaving responsibly and is on a commendable path of compliance.Tue, 27 Jun 2017 00:00:00 +0000Next Generation Endpoint Protection – CIS Control 8, Malware Defense Effectiveness, Performance Metrics and False Positive Rateshttps://www.sans.org/reading-room/whitepapers/clients/generation-endpoint-protection-cis-control-8-malware-defense-effectiveness-performance-metrics-false-positive-rates-37830The Center for Internet Security (CIS) Critical Security Controls v6.1 is comprised of battle tested and prioritized security controls that significantly reduce the risk to businesses from cyber breach. Endpoint security is the primary objective of Control eight, Malware Defenses which will be analyzed in this study. (Manage Cybersecurity Risk with the CIS Controls). This paper details a handful of real-world testing scenarios to determine which Next Generation Endpoint Security (NGES) products have the greatest effectiveness in blocking file based malware from executing, including freshly minted zero-day variants that have been repacked so they have unique hashes. In addition to measuring efficacy in blocking malware, this paper includes a secondary scope to examine the system resource consumption introduced by these products to give the reader a better understanding of the business impact these products have on the overall end-user experience. A tertiary scope analyzes the false positive rate of NGES with respect to common administrative tools used regularly by IT practitioners on the Microsoft Windows 10 Enterprise and Windows 2012 R2 Server platforms. Tue, 20 Jun 2017 00:00:00 +0000Hacking the CAN Bus: Basic Manipulation of a Modern Automobile Through CAN Bus Reverse Engineeringhttps://www.sans.org/reading-room/whitepapers/awareness/hacking-bus-basic-manipulation-modern-automobile- through-bus-reverse-engineering-37825The modern automobile is an increasingly complex network of computer systems. Cars are no longer analog, mechanical contraptions. Today, even the most fundamental vehicular functions have become computerized. And at the core of this complexity is the Controller Area Network, or CAN bus. The CAN bus is a modern vehicle's central nervous system upon which the majority of intra-vehicular communication takes place. Unfortunately, the CAN bus is also inherently insecure. Designed more than 30 years ago, the CAN bus fails to implement even the most basic security principles. Prior scholarly research has demonstrated that an attacker can gain remote access to a vehicle's CAN bus with relative ease. This paper, therefore, seeks to examine how an attacker already inside a vehicle's network could manipulate the vehicle by reverse engineering CAN bus communications. By providing a reproducible methodology for CAN bus reverse engineering, this paper also serves as a basic guide for penetration testers and automotive security researchers. The techniques described in this paper can be used by security researchers to uncover vulnerabilities in existing automotive architectures, thereby encouraging automakers to produce more secure systems going forward.Tue, 20 Jun 2017 00:00:00 +0000Testing Web Apps with Dynamic Scanning in Development and Operationshttps://www.sans.org/reading-room/whitepapers/cloud/testing-web-apps-dynamic-scanning-development-operations-37820Building secure web applications requires more than testing the code to weed out flaws during development and keeping the servers on which it runs up to date. Public-facing web apps remain the primary source of data breaches. To keep web apps secure, IT ops groups are increasingly adopting Dynamic Application Security Testing (DAST) tools. Learn how DAST tools can reduce dev costs and security flaws; how to avoid organizational gaps between dev and ops that can make remediation difficult; and other AppSec/vulnerability scanning issues.Thu, 15 Jun 2017 00:00:00 +0000The Show Must Go On! The 2017 SANS Incident Response Surveyhttps://www.sans.org/reading-room/whitepapers/analyst/show-on-2017-incident-response-survey-37815Overall, the results of 2017 Incident Response survey were very promising. Organizations are building IR teams that suit their environments and their unique set of issues. Malware still looms as the root cause of a large majority of incidents; and IR teams still suffer from a shortage of skilled staff, lack of ownership and business silo issues. Read on to examine the results of the survey and guidelines and feedback to spur improvements. Mon, 12 Jun 2017 00:00:00 +0000Security by Design: The Role of Vulnerability Scanning in Web App Securityhttps://www.sans.org/reading-room/whitepapers/cloud/security-design-role-vulnerability-scanning-web-app-security-37810The growth in custom applications in the cloud has increased organizations' security exposure. Although more organizations want to test and remediate during development, this doesn't address the thousands of existing, potentially vulnerable, apps already online. Modern web scanners can help by highlighting areas of likely vulnerability. Their speed and automation can make them a valuable part of a multilayered scanning and monitoring program.Wed, 07 Jun 2017 00:00:00 +0000Using Cloud Deployment to Jump-Start Application Securityhttps://www.sans.org/reading-room/whitepapers/analyst/cloud-deployment-jump-start-application-security-37805The cloud has significantly changed corporate application development. Now that releases come every few days rather than once or twice a year, AppSec is now squeezed into tiny windows of time. The speed, repetitiveness and changes in responsibility associated with these changes make it hard for traditional approaches to work. What are the choices and best practices for security within AppSec? How can you leverage the cloud to work for you? Attend this webcast and be among the first to receive access to the associated whitepaper developed by Adam Shostack.Wed, 24 May 2017 00:00:00 +0000Intrusion detection through traffic analysis from the endpoint using Splunk Streamhttps://www.sans.org/reading-room/whitepapers/detection/intrusion-detection-traffic-analysis-endpoint-splunk-stream-37800With technologies such as software-defined wide area networking (SD-WAN) and cloud operations, the traditional scheme of intrusion detection and packet capture at the network perimeter is quickly becoming less viable as a model for network intrusion detection. One alternative is to dynamically collect network traffic at the endpoint using the Splunk Stream and then using Splunk to analyze the traffic for indicators of compromise. This method allows for network-level detection on large, disparate networks which don’t have consolidated egress points for traffic. Wed, 24 May 2017 00:00:00 +0000Network Security Infrastructure and Best Practices: A SANS Surveyhttps://www.sans.org/reading-room/whitepapers/networkdevs/network-security-infrastructure-practices-survey-37795Network infrastructure is the key business asset for organizations that depend on geographically dispersed data centers and cloud computing for their critical line-of-business applications. Consistent performance across links and between locations must be maintained to ensure timely access to data, enabling real-time results for decision making. The following pages provide guidance on how to approach common challenges faced by both the network and security operational teams in managing interrelated security and performance problems.Tue, 23 May 2017 00:00:00 +0000Beats & Bytes: Striking the Right Chord in Digital Forensics (OR: Fiddling with Your Evidence)https://www.sans.org/reading-room/whitepapers/forensics/beats-bytes-striking-chord-digital-forensics-or-fiddling-evidence-37790This paper will present results from a recent survey of DF/IR professionals and seek to provide relevant observations (together with published psychological, sociological, and neurological research) to discuss the similarities and intersections of DF/IR and music, as well as identify potential correlations between being a successful DF/IR professional and playing music. It will also discuss numerous challenges facing DF/IR professionals today and how learning to play and enjoy music can help DF/IR personnel both overcome some of those challenges and be more effective in their chosen field.Mon, 22 May 2017 00:00:00 +0000Future SOC: SANS 2017 Security Operations Center Surveyhttps://www.sans.org/reading-room/whitepapers/policyissues/future-soc-2017-security-operations-center-survey-37785The primary strengths of security operations centers (SOCs) are flexibility and adaptability, while their biggest weakness is lack of visibility. Survey results indicate a need for more automation across the prevention, detection and response functions. There are opportunities to improve security operations, starting with coordination with IT operations. SOCs can improve their understanding how to serve the organization more effectively and their use of metrics.Tue, 16 May 2017 00:00:00 +0000How to Conquer Targeted Email Threats: SANS Review of Agari Enterprise Protecthttps://www.sans.org/reading-room/whitepapers/email/conquer-targeted-email-threats-review-agari-enterprise-protect-37780Why are our traditional email and endpoint security tools failing us? First, most email deployments lack any authentication of outside senders. Given this vulnerability, it’s trivial to execute spoo ng and falsi ed email content that purports to come from a trusted entity the recipient knows and trusts. Second, attackers are using cloud-based email and “detection-busting” techniques such as fake identities, deceptive sender names and phony domains to beat defenses. Clearly, given the prevalence of email-borne threats, protecting email infrastructure and end users needs to be a high priority for all security teams today. To this end, SANS had the opportunity to review Agari Enterprise Protect and the Agari Email Trust Platform.Tue, 09 May 2017 00:00:00 +0000Deception Matters: Slowing Down the Adversary with illusive networks®https://www.sans.org/reading-room/whitepapers/detection/deception-matters-slowing-down-adversary-illusive-networks-37775Deception is an effective defense against targeted attacks that leverages a false map of cyber assets to boost the odds of finding an adversary early and mitigate overall damage. The adversary is tricked into a cyber rabbit hole of fake systems with fake libraries and DNS servers, counteracting the attacker's every move. In this review, SANS Fellow Eric Cole recounts his review of illusive networks' deception and protection capabilities to show cyber deception in action.Mon, 01 May 2017 00:00:00 +0000A New Era in Endpoint Protectionhttps://www.sans.org/reading-room/whitepapers/analyst/era-endpoint-protection-37770Conventional antivirus solutions aren’t keeping pace with today's threats. There's a lot of fear, uncertainty and doubt around replacing antivirus with next-generation antivirus solutions, particularly in legacy environments. Learn what NGAV actually is; where it fits into the IT infrastructure; and how to easily utilize CrowdStrike's Falcon cloud-based services against a variety of threats first-generation AV normally wouldn't catch. SANS analyst Dave Shackleford explains and presents his findings.Wed, 26 Apr 2017 00:00:00 +0000Hunting Threats Inside Packet Captureshttps://www.sans.org/reading-room/whitepapers/threathunting/hunting-threats-packet-captures-37765Inspection of packet captures -PCAP- for signs of intrusions, is a typical everyday task for security analysts and an essential skill analysts should develop. Malwares have many ways to hide their activities on the system level (i.e. Rootkits), but at the end, they must leave a visible trace on the network level, regardless if it's obfuscated or encrypted. This paper guides the reader through a structured way to analyze a PCAP trace, dissect it using Bro Network Security Monitor (Bro) to facilitate active threat hunting in an efficient time to detect possible intrusions. Tue, 25 Apr 2017 00:00:00 +0000The Hunter Strikes Back: The SANS 2017 Threat Hunting Surveyhttps://www.sans.org/reading-room/whitepapers/threathunting/hunter-strikes-back-2017-threat-hunting-survey-37760Threat hunting is a focused and iterative approach to searching out, identifying and understanding adversaries that have entered the defender’s networks. Results just in from our new SANS 2017 Threat Hunting Survey show that, for many organizations, hunting is still new and poorly defined from a process and organizational viewpoint.Tue, 25 Apr 2017 00:00:00 +0000