Operationalizing Ransomware Defense: Tabletop Simulation with MITRE CALDERA & Cisco

Good morning, everyone. Thank you so much for joining us today.00:10Today we are going to talk about the ransomware scenario modelled on attack narrative to test response quality across technical and leadership functions. Our objective is to operationalize incident response. By the end, each team should leave with clear actions, improve detection, coordinate.00:15Containment and recovery.00:36Yeah you able to see my screen? Yes, it's ok. Thank you. Okay, we want this to be an interactive, so please feel free to ask questions throughout this session.00:38Type your questions in the Q and A panel. Make sure to select all panelists in the ask dog ask dropdown list and then click send. In that way you can keep track that your questions have been answered. Our experts are here and ready to answer your questions, so don't hesitate to reach out.00:58Now let me introduce our team today. I will be starting this presentation. My name is. You can call me GD. I'm joined with Hiya, Jeffrey, David, and John. We will be the presenters for today. And on the panelist side, we have Ladamir, Tatiana, Andres.01:17Carlos, Yuri, and Ruben.01:37Now, we come from the security customer success specialist group, where we try to get you the value of the dollar that you've already spent with us. We try to get the adoption of the product. We try help this with adoption consultations, health checks, accelerators, and expert inside series. Now this is part of the expert inside series.01:40This webinar is part of the expert inside series that we are having. You can reach out to us directly by writing to us on our mailer, which is cSS_EMEA_security at cisco.com. It is here on the bottom of the screen CSS eMEA_security at cisco.com.02:00For the agenda today, we would start with the tabletop exercise, what what it is. We'll have a little talk about then we would dive into the attacks flow and we will have some demos to to go along with them. Then we will also show some defense flows and along with the demos. Then we talk about.02:18The importance of telemetry, some services that he could utilize cyber captions and upcoming webinars, and that would be the end of the session today. We would be here 90 min and it is a packed agenda today.02:38Now, in our episode one, we explored the landscape of common cyber threats and mechanics of NTLM relay attacks. In episode two, we examined the critical roles of incident response team and the risk associated with the HTMS modeling.02:52There's a QR code provided to access the recording of the previous sessions. The recording of today's session would also be posted at the same, same link. My colleague has also pasted the link in the chat for everyone to have it. Today's episode, we are shifting our attention.03:09To building ransomware resilience through the structured tabletop exercises. We will map our response strategies directly to the next CSF two.zero framework to ensure industry standard alignment. The session will feature realistic injects designed to protest our decision making capabilities under.03:26Pressure.03:47We'll conclude by establishing clear ownership defining variable outcomes and setting the actionable follow up commitments to strengthen our security posture. Now assuming we all have established an incident response team since our last session, the next critical step is to ensure total alignment. It is a.03:47Mentioned that every member that is from leadership and technical handlers to legal, to HR and the public relations fully understand not only their individual responsibilities, but also how they integrate with the broader teams.04:07During a high pressure cyber incident, there's NO room for ambiguity. Clarity of rules is the difference between a controlled and effective response versus an operational chaos. To validate this readiness, we mo we must move beyond the theory and conduct regular drills. These exercises ensure that every team member is.04:21Prepared to act decisionly when it matters the most.04:41Now, what is the tabletop exercise? Think of it as the tabletop exercise as a fire drill for your cybersecurity response. Rather than figuring out the roles and procedures during the live crisis, we use this discussion based simulation to practice our response again re against realistic tailored.04:46Scenarios in risk free environment.05:05Now why is this exercise crucial? They have the most effective way to expose hidden gaps in the four critical areas. That is 1st is detection. How fast can we identify the threats? 2nd area is communication, that is all are the right stakeholders informed at the right time?05:07Then decision making are, are escalation parts and authorities clearly defined, and finally the recovery. Do our technical steps align with our actual business rules. Now we can generally do this in three formats traditional, which is a structured and guided discussion, gamified.05:27Which is a competitive or point based scenario and finally a hybrid or simulated which is a mix of discussion and live technical triggers. Now, a traditional tabletop exercise is not technical test of our tools, it is a stress test for the people and the processes.05:45Now how does it work? It is a narrative. We walked through a realistic evolving story, not a technical lab. It is a role based, everyone participates in their real world capacity that is from Cisco to legal to comms, they all bring their own lens in there. It is decision purpose. There is NO key.06:02Code activity, we focus entirely on who, what, and when of critical decision making.06:22But why do we map it to the NIST? We align our exercise directly to NIST IF phases to ensure we aren't just talking, we are validating. We systematically check our readiness across the entire life cycle, that is preparation, our plans actually accessible.06:28Can we accurately access the threats? Containment and recovery, do our business and technical goals aligned and post incident.06:49Are we actually capturing lessons to improve? This process turns static policy into organizational muscle memory. It reveals exactly where our coordination might fail before we face a real world event. In a gamified tabletop exercise.06:57It is unlike the traditional tabletop access which is a fire drill. Gamified TTX is a competitive simulation. We introduce game mechanics like scoring, leadership board leaderboards, and time pressure to drive higher engagement and create a more intense.07:16Realistic environment. Now why shift to gamified tabletop exercise? The competitive element forces team to think and act under the genuine pressure that's increasing the intensity of exercise. A red team's facilitator adapts the scenario in real time based upon your decisions, making the.07:33You should feel a lives and dynamic.07:53Scoring provides a hard data on where your teams excel and where they need improved us providing a quantifiable readiness. Now when to use this. I recommend this format for teams that have already mastered the traditional tabletop exercises. It's an ideal next stop.07:56Our next step, when you need to move beyond basic process validation and start mirroring performance, speed, and decision making accuracy under fire. Finally, we have simulated our hybrid tabletop.08:14This is a most immersive exercise bridging the gap between discussion based tabletop and fully scalable life simulation. Now, what makes it different? It is a blended approach where leadership handles the strategy communication and technical teams work in parallel within simulated environment, interacting with.08:31Actual same dashboards, logs are forensic artificate artificates. Why it's the bold standard? Because it, we are not just talking about our tools, we are testing their integration and effectiveness.08:51It forces real time coordination between the technical boots on the ground and business leadership. It validates how incident response handoffs actually function with crisis management and disaster recovery. Now when to use this? This is for a maturity. Use this as your cap Capstone event.09:08To prepare for board level reporting, high stakes compliance audits, and when you need to prove that your technical response and business strategy are perfectly synchronized. Now that we have understood the difference between the tabletop exercises, how do we choose the right tone for our organization?09:26Now this would depend upon the maturity level. For that we have a maturity path, which is foundation. Foundational is where we start with the tabletop access traditional tabletop exercise to establish our baseline, define our roles, and validate our core events and response plans. For developing teams, we add the gamified element to build and.09:44Engagement and start measuring performance.10:04For the advanced teams, we moved to simulated hybrid exercise to challenge the team with hands on technical realism. At the optimized level, we are ready for full scale exercise that tests our end to end capabilities under more realistic conditions that are.10:07Possible.10:27Now regardless of the format we choose, the quality of our output depends upon our execution. For this, we have five pillars to ensure our tabletop exercise delivers a real value. The 1st pillar is preparation. We don't just invite people, we ensure they have access to the dashboards and tools they'll.10:28Need to reference during the exercise.10:47That facilitation, we use a real security tools as source of truth force the tool team to walk through the exact workflows they would use in real crisis. Then the next pillar is audience management. We need to keep the conversation role based. We ensure CISO.10:51The architects and the managers are all contributing for this specific lenses. Then the documentation. This is the most important part. We capture every decision, every gap, and the policy conflict in the real time. If it isn't documented, it didn't happen.11:10Finally, the follow up. A tabletop exercise is useless without any actions. We conduct the tactical debrief immediately after and assigned clear owners to the hardening ways identified during the exercise. The goal is to move from theoretical policy to a practical application by matching the exercise.11:27To your maturity and following this rigorous execution framework, you turn your incident response plan into a proven battle tested capabilities.11:47Now today we will walk through a simulated tabletop exercise reaching a commercial organization targeted by advanced persistent threat group. Our scenario begins with a single compromised VPN account.11:56The result of a successful phishing campaign, then we would before this after this we would be escalating into privilege escalation and then deploy deployment of it. To bring this red team activity to life, we are leveraging Thera octoberation framework which allows us to simulate these attacker movements.12:11With precision and realism. We also have put a QR code and share the URL for the center of internet security, which would give you more examples of the tabletop exercises.12:29To ground our discussion of tabletop exercise in parallel application. I want to introduce a powerful tool that bridges the gap between the theoretical planning and operational reality, which is the mythree, in simple terms, Canada is an open source platform designed for automated adversary.12:48It enables security teams to safe safely and consistently replicate the specific behaviors.13:09Of real world cyber threats within your own environment by moving from a manual supporting testing to this model of continuous defense validation, organizations can significantly improve the security posture. So is built directly on the industry standards that is my career attack framework.13:17It takes theoretical tactics, techniques, and procedures and transforms them into selectable execution plans. This makes it valuable.13:37Tools for performing simulated hands on tabletop exercises. To understand how we Leveragera, we look at its four fundamental pillars that is agents, which are software program that connect back to Thera server. Abilities, which is specifics implementation executed on an.13:46Agent.14:06Then the adversaries, which is a group of abilities representing the tactics, techniques and procedures available to that. Then is the operations, which is the execution phase. This is the life playbook where an adversary profile is deployed against your agent. Acts as a simulation engine.14:07Using intelligent logic to determine the next step based upon the success of the previous action. This creates a dynamic adaptive simulation that mirrors the behavior of a real world fact factor, but also the operations also needs facts, which is the data dependencies.14:27That's are the specific piece of information such as file parts, IP addresses or usernames that are required for an ability to execute successfully. They serve as essential variables that allow the simulation to function. With this, I transfer to Jeffrey who will take you all forward with.14:44The attack demo or he'll talk about the attack and attack demo.15:04Thank you. We're gonna start with the simulated tabletop exercise with the attack them, right? Before showing our simulated tabletop exercise, I would like to start with a disclaimer and it is that our goal for this presentation is to raise awareness and not provide a blueprint for our exploitation. For that we omitted.15:07Specific sensitive attack details. We have our target, the company is dommy Corp. The sector is global Manufacturing and logistics, and it has around 30000 employees worldwide. And our victim victim is Bob Bupson, who is a junior IT specialist.15:27So and this is the slide we map out every recover modern attack progression. Now this we don't start with well they don't start the attacker so doesn't start with the with a highly exploit it started with an access broker, so we're gonna purchase the credentials from an access broker, and also on the on this part.15:471st part we're gonna see ok in use, we're gonna see the different pillars that we talk about, the agents, the abilities, et cetera, right? Now, after that, after we purchase the, the, well, the attackers purchase the credentials, they are gonna successfully add their own MFA using vision. In this case, the attacker use open source intelligen.16:07To know that the victim will deliver a webinar and they see these this is a great opportunity to execute a tag, ok?16:27This marks an entry point to the network giving them a clear VPN login that looks looks completely legitimate to our perimeter defense. From there, the attacker deploys a command and control infrastructure to remotely control the machine. Removing the need of bypassing MFA every time they want.16:35To perform an attack, right?16:54Now, after that we move into the privilege escalation phase, elevating privilege using like techniques like share shadow credentials, and tgts to authenticating the domain. Actually actually during this phase, these two phases privilege privilege escalation.16:57We're gonna see also this phase of movement, and by performing this, oh well we're gonna perform port scanning to map the networks and move it onto other hosts. Finally, the execution of phase, before they ever dropped the ransomware, they blind our security teams by disabling.17:17In EDR and they steal our data for double exech.17:37By the time it ramps through the ransomware actually deploys damage is already done. Now, what we're gonna see in these different demos are two separate attacks. This 1st attack is from the from the access broker perspective.17:41This is a simulation of what we think the access broker obtained the credentials and posted it in the direct for the attackers to file, ok? So that set up.17:58We're gonna start. So in this part we see our victims machine, we have Bob, right? And on the left we have Bob's machine, on the left we have Outlook where he's gonna receive the email and on the right we have PowerShell that we're gonna use later to see the script, ok?18:14Now let's move to the attackers machine. Now on the attackers machine, we're running looks and on the top we are gonna send the email to the click fix and we're gonna see that. And on the bottom we have the HTTP server where the webpage is hosted.18:34Oh, now we talk about right and the 1st thing now we have to do is deploy our agent, so we click on the agent and we're gonna see more information about this. So the 1st thing that you let us let us use is the platform what the what the agent.18:54It's gonna run in this case we're gonna choose window. We can see a lot of information here. We can see the the agent name, which is the agent that the C two client or Beacon will receive.19:14This name is how it will appear in the task manager as well. This is just another name for remote access control, ok? If we scroll a little bit down, we see the information of the script that we are gonna run, right? It's basically just the commands for the agent to be deployed at the machine. Now.19:24How do we get our agent into our biggest machine? That's what actually the click fix or that hack is for, ok? So we're gonna see that and let's move back to the so we're gonna send the email.19:44And see, so we're getting well the attackers, the access worker is gonna impersonate a great place to work service and it's done, email sent, we're gonna see that details later. We have for recipient which is that's.20:00That part is done. Email sent. We have the email, it's opening let's download the pictures and if you see, it looks legitimate, right? But as a fishing email, there's always an urgency, so it's asking to complete the survey before the dead deadline, which is.20:16This tomorrow.20:3605:00 P.M., right? It's gonna open the survey, right? And see that we have more information here. Obviously, the great place to work right is asking for a browser update, which is that's before completing the the survey, and it's asking Bob to.20:37Run the Windows R command and then paste what?20:57We could well but the access worker put on the which is the click fix attack, right? Now, once he do that the PowerShell will be prompt and it will disappear immediately, so I will show you the.21:01PowerShell command that we running. So you remembered the, the script that we saw on what we did here is we we obfuscated it and just in case Bob wants to do it right and copy and see the command, he will see this encoded script.21:19It's so well we see some, some calls here just basically that access the webpage, right? That's cool. And if you see, we didn't have any agent deployed, right? Now it's done. We have our agent and if we access the agent, we will see.21:38More information about it. So in this case we have a lot tons of information here, right? We can see our display name, we can see our domain, the domain that it belongs in this case is we have for privilege privilege which is user.21:55You remember the name, the secutable name? We have super scary, right? And we have the location where this program is being run, ok?22:16Now, let's go to the operations. Now, for this we're gonna create an operation, we're gonna put a name and on the adversaries we will see a lot of abilities. So the abilities are.22:24In the so we put the ability to see the address and we we call it from here for this for this 1st part we're gonna put manual commands just to for you to see how we can run these commands and how we look well after I will show you some.22:38Default operations that has. So I'm gonna let this run, but for instance, we can run a simple simple command for starters it's a who am I, so we will see the, the, the host name of the machine and but basically this will allow the attacker to.22:56To start mechanisms, right? For instance, we can see IMTC. Let's keep moving forward here. So some of them success, some of them fail. Let's take a look at some commands real quick. For instance, one, we can see the IP config also we will see the network in.23:15Interface configuration, right?23:35So we can start the recordings again in the, in the network part, right? So we can move into different hosts. We can see the system info, right? If we want to perform, if the attacker want to perform an attack based on on OS versions, we can start with this information as well.23:37If we can use a net user domain command, this will show us users that belong or exist in this in this domain, right? This is very valuable information from an attacker's perspective, we can do type SRV and this command is used.24:01Still located domain controllers within the active directory. Let's take a look at that. We see that CSS ATDC Communicorp.logo will be that.24:22At DC. We have also IP address, right? In this one we can see who is actually using RTP, who is connecting to this machine using RTP. Now for the, for the sake of the demo, we will see and well of the demo.24:31Is this VPN information. So the attacker in this case the well the access broker privileged as well the VPN get by information. So in this case he's accessing the the folder where the VPN XML profile is and he.24:54Well, he accesses this and he put he gives this information, extracts this information, and he will publish the the VPN gateway information. So the attacker doesn't only have a username and password but VPN gateway information, so he knows where to connect on the VPN, right? And that's where the.25:11Second part is gonna happen, which is the vision. Now, before moving into that, I wanted to show you the process. Remember? Super scary, this is how it looks on the, on on the task manager window? Windows. Same thing.25:30And just to wrap up with you remember that we had, well we create an ability with manual commands, right? But we have some default abilities that come in in for instance, we can talk about credential topic with MPBS five. This is that link that exploged the.25:46Network provided architecture in windows. And what it does is that when a user authenticates locally, the wind login process passes the credentials to all user providers.26:06NTPS by captures a clear text password before it is hashed and locks in into a flat file, right? So we can, we can execute this ability, another one it's dump credential manager using key mHR.ELO.26:16So this leverages the built in windows credential call via legitimate system binaries, and what it does is that it what it does is it it invokes the stored user names and password interface, and in an automated flow, this is used to force an ex an export the.26:33Database which which contains the cache password for browsers, network shares, and outputs.26:54And this is just a quick example, right? Of how could work on a, on a simulated tabletop exercise and and just for a real worst scenario, right? Now moving forward, remember that this on the attack progression.27:01The attacker purchases the credentials on the dark dark part. This is how the attackers saw the post and if you see, it's a domain user access plus the Cisco secure client VPN information, right? So it's the same information that we saw on.27:19Now moving into 2nd part, well, second attack, right? We set up on the 1st attack, we see some things on the attack progression, like the same thing, so we're gonna do it again. Now from the attacker's perspective, that was the access focus perspective, this is the attack, now we purchased the credential, right?27:37What we're gonna see now is a vision attack that takes place to bypass MFA, ok? This is what we're gonna see is a role play from our panelists that you probably didn't know, but.27:57They are actors as well. Just kidding, just kidding, but one thing to mention is that what we're gonna see on the demo is Jenny, ok? Not Bob. So Bob, but this is how Bob's credentials could have been stolen, ok? So to give you more context, the attacker in this case.28:08Oliver did some research and he saw that on LinkedIn, well he performed open source intelligence, right? And he saw that on LinkedIn, Jenny is promoting a webinar that she's delivering on a specific date and time.28:28Oliver waits for the webinar stay and leverage how distractive she is with her presentations and customers, you know, and to to perform this attack. He waits for the 10 min breakout and he calls her, he confuses her with some technical terms that she probably understand or.28:42She doesn't have the time to, to check, right? So she simply wants to get.29:01This over with so she can go back with the presentation, et cetera etc. So Oliver reassures her and show shows empathy towards her, which makes her trust him. Using Denny's credential credentials, right? Oliver?29:06Doesn't only attempt to VPN login to the VPN login, but he tries to access a self service order. What he's gonna do is he's gonna add his own device to use MFA, so he tricks Danny into giving him the digit.29:22That he used to verified push and he uses that to successfully authenticate and at his home phone to prove, to approve any future authentications into the VPN or or other orprotected apps, ok?29:37Oh, let's take a look at that. Hello? This is Jenny. Jenny hi, this is Oliver from Global IT security. I'm so sorry to interrupt. I know you're in a meeting right now, but we have a critical incident and we're seeing your account being used to send a mass.29:55Massive amount of spam and fish enables internally right now. It looks like your credentials may have been compromised about 10 min ago.30:15What? But that's impossible. I'm in the middle of delivering a webinar for more than 50 customers right now. I haven't sent any emails or even logged in. I understand, I understand. And that's exactly why I'm calling you directly instead of instead of locking the account, like.30:23The attacker is likely using a session token they install and we need to verify that it's you and kick them out right now, so this procedure.30:43Oh my god. Okay. Okay. I don't understand what this means, but what do I need to do right now? I'm in the middle of my presentation. I know, I know and this will be quick. 1st we need to stop the blueting, right? So we need to re authenticate you with the new token, and I can do it from my side.30:53So let's see. Do you have your mobile phone with you?31:14Yes, I do. Alright, so let me start the process to re authenticate, ok?31:18Just give me a minute.31:39This won't take long. Okay, I'm really late to my presentation right now.31:41Jeffrey, you're on mute.32:11Sorry guys, sorry, sorry. Thank you. So we, we saw that the attacker is, is logging into the VPN credentials with with the with what they purchased, right? From the access broker. And he chooses to manage devices, right?32:13Instead of just logging in so he he can act his own device in the self service portal. Now, in this case, we can ask because we are on a tabletop, on a simulated tabletop exercise, what does Cisco do log in this authentication part?32:29So I invite you to put on the chat the answer of this question if you want, if you don't mind. So and we will continue with the demonstration. I understand, I understand and this will take won't take long. For instance right now, did you just receive a dual push?32:45Yes yes, I did. Is it asking you for some digits? Yeah, I see like three digits holders. All right, please enter 3535 ok?33:05Okay, alright, ok, so good. So once Oliver's actually logs into the self service portal, as we may see with the help of Jenny, he can add his own two five device following the steps of adding a new.33:22New to your mobile's device and once that's when that is done, he can go back.33:40And logging successfully into the VPN with the solid credentials and recently add MFA device, right? Now with that, we have our entry point for the next phase.33:45Right, now before moving into the the the escalation and mechanisms, which is phase three, right? Let me share with you some definitions, ok?34:01Reverse for instance, is the main authentication protocol in Active directory. When a user logs in, they receive a TGT, which then is used to request a service ticket to a specific resource like servers or applications.34:20Yeah, which is an attack where the attacker requests a service ticket for service accounts and tracks them offline to recover plain text passwords. NTLM hashes are hashed versions of user passwords in Windows.34:36Altas is the Windows process that handles the authentication. Shadow credentials is a technique that allows an attacker to add an alternative authentication material like like certificates to an account enabling access without the original password.34:51And Finallywishers is is a tool that automates this process to make it easy to add shadow credentials to a target in Active directory. Okay.35:07Cool.35:28So now, one thing that is often underestimated is that by default, even a low privileged user, like the one or example has a read access to almost the entire active directory domain. That means that they can read the full AD structure, you know.35:29Default user attributes group memberships are much more.35:49So from an attacker's perspective, this is already a strong starting point. So tools like which is the one that we are seeing on the screen is a tool developed by it will become extremely extremely use powerful, right? Because.35:52Yeah, it will allow the attacker to visualize relationship inside of the domain. For instance, we can run a simple query to enumerate all members on the domain admins group, and this will immediately give us a list of high valuable targets, right?36:11From here, for instance, the attacker could plan a follow up attack such target phishing campaigns against specifically, well again specifically privileged users in our lab, for instance, we have two users with full domain privilege, but we can go for there. We can map the entire active directory structures to understand how.36:31Objects are organized, including which which organization organizational units they belong.36:50To and well and how resources are distributed. E.g., we can see IT organizational unit contains an application server, right? So, because this is a server and not already web workstation.36:57It becomes a particularly available target, right? So let's do a closer inspection inspection yes, we can see details such as subject ID, right? A distinguished name and actually how access control is inheritance.37:13And configure, and we can also see group memberships. In this case, the server belongs to a server's group along with some default groups, ok?37:32Now, one thing that we can do here on the, on the server object, we can see a very important thing as the inbound, inbound object control, ok? This tells which users or group have permissions on this object, and as we, as we take a look, we see that BOM.37:48Is on this list. There it is Bob, right? So let's see what's the relationship between Bob and this application server. So let's do that finding, and we can see that Bob.38:09Doesn't have full control directly over the app server. However, is a member of a group called IT local, which has an extent permission over this server. At this point, that's already enough information to begin developing a privileged escalation path.38:26Now what can we do with this with these permissions? One thing is writing something, and we're gonna move to the Callinux for this. One thing that we can do is bring something called shadow credentials into the object. In this case, the application server.38:48This allows us to effective effectively inject the certificate based authentication into the target, ok? Because of this permission is inherited through the group, we are able to request a certificate on behalf of the application server. Now.39:08Now we're now in this case, we're gonna impersonate a server, right? Another tabletop exercise question will be, who owns the detection here? Is it the identity and access management? Is it sock or both?39:24Let us know what you think on the chat, please. Now remember, this is a key moment in the attack. We're doing all of this with a low privileged user, ok? Not an admin, ok? Now, once we obtain.39:41The certificate for the authentication, we can request A ticket granting ticket or TTT, ok? So that's gonna do that faster here.39:58No, we're gonna do a TGT, ok? No, after a few attempts, we successfully obtained our TGT and what we're gonna do, we're gonna start the ticket cache locally. We're gonna start that locally.40:16Now with this ticket cache, we can request a better service ticket, and we're gonna do is impersonate an administrator on the application server. So in a way we are authenticate authenticating server as as we were the server itself.40:31Right? Now, this doesn't give us full admin privilege yet, but it gives us administrative access to the survey. Now, we're gonna do that.40:46And one thing that we can ask is what are the chances that the administrators has logged into the server before? The answer will be very, very high, right?41:02That means that there is a strong chance that the credentials or whatever other words credentials artifacts are present into the system. E.g., we can extract the security account manager.41:18And the system high from the string, right? There it is, and we can transfer this information offline for processing, right?41:38Now what we can do there is let's do that. Let's copy it ok, we already have some, right? And what we can do with that is that, we can extract the user credential materials, including NTLM password hashes.41:53Right? So let's do that offline there it is, we have the hashes, right? Now.42:10What can we do with these hashes Using, well, at this, this gives us a very strong foother for the privilege escalation, right? And we can take, we can take advantage of this. Now using this extracted credentials, what we can do is we can obtain.42:32And we're gonna elevate our trust in that environment, ok? So let's request the GTT, done. That's the TT, we'll save it.42:52And now with this TGT we can perform some advanced advanced action actions, ok? For instance, or low privileged user right whose passwords we know, we can add him to the domain admin group.43:08And at that point, Bob will become a domain administrator. So let's do that. We have the hash we're gonna authenticate and we're gonna put, well we're gonna put it on the group.43:28There is now we move Bob, we're gonna re authenticate him, and now Bob will become an administrator, ok? Remember Bob was have read.43:48Access user. So once a user is compromised, look what we can do or well an attacker can do, right? Now, what can we do now that Bob is an administrator? Well, he belongs to the domain admin admin group, right?44:00Well, we, we right now have effectively achieved a full domain compromise, but we can go further and with this level of level of access, we can, for instance, dump password hashes from all domain users.44:18There it is. So at this point the attacker has a complete control over the environment and it's done from, from, from the, so we have performed the the mechanisms right and the privilege escalation at this point. So that will conclude our.44:35Or part of the phase work, and now the last one will be the execution and for this John will continue this work. Thanks. All right, thank you Jeffrey. Thank you very much. Please do confirm if you can see my screen.44:54Okay. Yeah, oh good. Thank you very much. All right, so at this point, the threat actor has successfully escalated privileges, right? Now the next step is to deploy a command and control beacon.45:12On the compromise machine, so it can be remotely controlled. Now, at that way, the threat actor would be able to also execute malicious payload from it. Now, in your simulated tabletop exercise, you can achieve this with Cultera, ok? So 1st you would deploy the agent, same as what we said at the beginning of the tag.45:31You would upload your own payload, any of the payloads that Lara will provide you or one that you craft yourself, and then you create an operation execution phase, right? And then you can execute that payload remotely. There will give you the option to delete it automatically afterwards to leave NO trace.45:51However, if we do it like that today, we won't be able to follow along as easily, right? So for the sake of the demo, we have created a simulation script so that we can all see what happens, ok? So let me start off with the.46:10With the setup. Here we have, e.g., the, security providers. We see Microsoft Defender antivitus, the firewall is on. We see some shadow copies for the local disk. See We are focusing on the demo desktop folder. We see some sports.46:26Staff some documents, here's some images.46:45And we have also deployed as the threat actor as the attacker. We have deployed the file server remotely, right? Like out there on the internet that it's how what we're going to use to exfiltrate information. Now, now that we know the setup, let's see how it how it looks like, right? Let's execute that attack.46:48So we're going to execute our simulation script run demo. Those are the keywords to start. And now I want you to look at like immediately on the left of the screen what we see here. So we have a new security provider.47:06We also get right away notification that Windows Firewall is off, is turned off. All of those files have now become encrypted. We, we NO longer can writ them. And then there is now these Written notes, right?47:23Very common ransomware behavior. Now for the local disk, see shadow copies, let me show you, what happened here. So they have been all deleted, ok? And, in addition to that, let's see if we were able to exfiltrate some information.47:40So we refresh this file server and we are able to see that we have data to that zip, we have loot, so yes, we have successfully done that. That data to excel file, we put it on the downloads folder just for you to see it.48:00Normally that would be deleted right away. Now let's go through the output of the script to see what it does, what happened, right? So the 1st thing that happened here is that we have identified the target. We're focusing on just one folder, we don't want to encrypt the whole file system though normally that would be what.48:18Happen. Then this one is defensive, so here we leverage the defend not in a technique in the Windows operating system, there is a built in service called Windows Security Center or WSC, which.48:38Allows 3rd party antibody softwares to register themselves, ok, and automatically disable Windows Defender, Microsoft Defender, and that is done to prevent software conflicts, right? Now Defend not exploits this exact mechanism, right? But if.48:56Registering itself as a legitimate antivital software. Now, that way it prompts of course Microsoft Defender to stand down, right? To apparently avoid any software conflict. However, defend not is nothing more than an empty shell.49:15Leaving the machine completely vulnerable to attacks, right? So in a simulated tabletop exercise, the facilitator will normally ask you at this point, what is our fallback detection method, right? Please let us know in the chat if you know the answer.49:34And then from here we we can do more damage, right? We have privileged access administrator access so we can just set net firewall profile to disable, right? And we turn off the firewall. Then the next phase would be mechanisms and data filtration.49:51Here we'll look for sensitive keywords, passwords, confidentials. Most ransomware that we have analyzed have huge dictionaries tailored to those organizations that they are attacking. So in this case we found a couple of files and we're going to exfiltrate them via.50:10File browser API, ok? We have a staged a couple of those files and then we create a zip, right? A zip file that is going to show up in the downloads folder.50:27Right? Once again just for the demo, this is you would normally be hidden. Then to upload that to finally exfiltrate this, we, we use an encrypted core request in the background nothing fancy, just a core, a post request, and it is just, you know, using TLS so that.50:42It's it's not harder to detect.51:02It goes to the file server that is controlled by the threat act. And that's how we get information out. Now for the demo we are creating a new shadow copy, but at the end, we're deleting them all, ok? We are we're deleting all of those shadow copies effectively inhibiting.51:04The system recovery with the deletion of this. Then we are ready to encrypt everything, everything that we can find on our way, right? So let me go back to the desktop folder, and what you will see here is all of these files were now encrypted.51:23They now have the cybersec EIS file extension that would be like an identificator of the APT group that is attacking you and that README note gets thrown to every single folder, right? With instructions of what to do next.51:38Right, so as you can see, ransomwares, they're very simple in essence, but we all know how destructive they can be, right? Sorry you go. That concludes the execution demo and I'm going to pass it over.51:56To the defense demo. So Hiya. So, so far we have seen how an attack can be driven within our organizations. We have seen how small user mistakes or misconfigured policies or lack of defense layers in our cybersecurity infrastructure can compromise our entire business. Let's go.52:11Us through how we can protect against each one of these attacks in a layered approach.52:31The way Cisco products work together is to protect against attacks in a layered defense model. If an attack succeeds in one part of the network or on one device, organizations still have more defense solutions and techniques in place to stop its propagation into your infrastructure.52:37Following our tabletop simulation, let's hope you answered correctly when guessing the Cisco controls that would protect each one of these attacks. But you can see here on the slide that is not just a list of Cisco solutions, it's a comprehensive zero trust approach to best protect against these.52:57This and other type of attacks. In the remaining part of the session, you will learn about Cisco Duo for zero trust access where it's more than just MFA. We will learn about Cisco Secure Networks analytics for network detections and response, Cisco identity services engine for identity access management and posturing, and last but not least.53:17With Cisco secure Firewall for encrypted visibility and protection.53:37And you can see how we map these Cisco solutions to each attack stage. Starting with Duo. Duo is not just your MFA provider. Duo is now a full identity and access management solution with phishing resistant access capabilities built in.53:42Let's see how we could have prevented the attack that happened today with three different elements. The 1st one is proximity verification as part of our phishing resistant access methods. We're using Bluetooth low energy between your access device, like your laptop and your mobile phone to detect proxim.54:00Through a combination of trust we've established with your devices by them being near each other and a biometric check on Duo mobile, we now have an exceptionally robust combination of factors to prevent phishing. An attacker, Oliver in our case, would literally need to be in the same room with Bob.54:20Stu and sitting on his desk to gain access to their account. As part of our tabletop exercise, we would identify this.54:40To be one of the security controls against the phishing attacks. Instead of talking about this, I want to show you how the attacker from the scenario today wouldn't have been able to log in if proximity push was required in the dual authentication methods policy.54:49So going to the duo admin panel, an administrator can go to the self service portal that the attacker used to add their own two of A device and apply a custom policy. This is a policy that I pre created called the self service portal policy, where I set the authentication methods to require proxy.55:07Verification. So now going back to our attack where the attacker is trying to log in to the VPN.55:27With the stolen credentials, the attacker inputs Bob's email address and their password, and now when they log in and go to the device management portal, we will see how that policy that we put in Duo will not allow that user to log in. So when they select duo push, they.55:33You will see a message that says Bluetooth not supported because this attacker did not know that they need BLE in place and even if Bluetooth was supported and enabled on their machine.55:53When Bob is receiving the duo push and is being tricked into entering a specific digit or into approving the push Bob is not going to be able to do that. So even if he's busy or in the middle of a webinar or wants to get it over with, they cannot. The technology is protected.56:04Expecting this user mistake. So Bob will realize that this does not make sense, so we'll mark it as a suspicious login. Then the administrator.56:24At this organization, we'll see that there was a login that reported as fraud. So the administrator receives an email that says that Bob reported a fraudulent authentication request. Now, notifications to administrators are very key here. The administrator can go to the duo admin panel to Bob's user.56:34And then they can scroll down to see the logs and see which authentication was marked as fraudulent and they can see the date, time, the application that the user was trying to access self service portal in this case, what's the access device that was used.56:54So if we go back to the other methods that we can, if we go back to the other methods that can protect against the attack that we saw today, we can see duo trusted endpoints as one key element in our duo defense. Duo trusted endpoints blocks attackers by allowing.57:11Being only registered and managed devices to gain access to corporate resources. Unknown devices represent the lowest level of trust. These are unregistered or unmanaged devices that are not allowed access and are always blocked. Managed devices represent the highest level of trust. These devices are.57:31Are fully managed by your organization. You have complete visibility and control, so they receive the broadest access to the protected applications. In the preparation phase of the tabletop exercise today.57:51You can configure on the duo admin panel which devices are trusted using the dual desktop agent using the MDM integration that you already have in place or Active Directory domain services to only trust Active Directory domain joint devices.58:03Or you can also manually add a list of devices for your contractors, e.g., that you want Duo to consider trusted. Once that's done, let's see how that helps in protecting against today's attack. Back to the duo admin panel. You, let's go to applications and select the VPN application.58:20Application that the attacker used in their attack today. VPN is a very key application in our organization, so let's apply a specific application policy here that was pre created, and in this policy, the trusted endpoint policy will require endpoints to be trusted. Now we can either add this policy only.58:40On VPN as an application policy or only on a specific group of users just to test it out at 1st or in the global policy for all applications on all your users.59:00Once this policy is added and we save the changes, if we go back to our attack, and let's see the attacker trying to log in VPN again, as they log in with the same stolen credentials, so that part is still there.59:11Once they try to attempt the login to VPN, even before trying to add another device, they will immediately see this notification that says the device is not allowed because we added trusted endpoints policy on VPN, which says our this organization.59:27Requires a managed device to log in. Now, the administrator, again, going back to the logs, the administrator can see in the logs that there was an authentication that was blocked due to a device not being trusted and they can even see, which access device it was.59:45Was the date and time, the IP address of the device that tried to log in as well.01:00:05And that it was an untrusted device. So this is just another method. Another one is, another one is marking notifications as fraud. Now this seems very simple, but user education and administrator logs is very key here.01:00:09Because one of the key phases of our tabletop exercise is detection and analysis. And Duo helps with that through enabling user and admin notifications. Duo gives admins rich context and details about every authentication. And with AI and machine learning, it identifies risk scenarios and attributes at.01:00:29Every authentication and every login.01:00:49You can investigate the duo logs and reports either on the dual admin panel just like we saw in our demos today or you can export the logs into your team like Splunk or any tool that you use, and then you can have more in depth visibility. You can also get more visibility in the Cisco identity intelligence dashboard that is part of Duo.01:00:52One of the settings that we need for today's attack, we need it to be enabled is the email notifications for users and administrators in the dual admin panel global settings. Now let's see how that could help.01:01:12Back to the dual admin panel, but we're going into the settings this time. If we go into notifications and we check these two points email and push notifications. Now what this will do is when the user or when the attacker is logging in and they are using the same self service portal or device.01:01:24Management portal to trick the user, Bob in this case to give in their, to accept the dual push, then the attacker would be in, they'd be inside the the self service portal and they can add their own two of a device for easier access later on. But if that setting is enabled, then once the attacker adds their.01:01:44The two of a device, then the user will be notified. So even if the user is busy at the moment, they will receive an email that says hi Bob, there was an an iPhone that was added to your self service portal from Dubai at this date and time.01:02:04Bob can say that this wasn't him. Also, if Bob was too busy to check their emails, they will receive a duo push or the duo mobile notification of the same. Then an administrator on Duo will receive another notification that says that Bob has reported that a device that was added to their account was a fraudulent activity. Now this is.01:02:20An even more important notification. So when the the admin can go to the user's tab in the duo admin panel.01:02:40They can go to Bob's user and they can scroll down to the logs where they can see which, which event is this? So we can see that at 05:50 A.M. there was an enrolled device. We can see in the phones the exact phone that was added and the administrator can simply remove it.01:02:48Yeah, we wanna go further through the attack flow that we saw today. We want to go further in the tabletop exercise simulation. So let's dive into the execution and the containment phase. What if an attacker.01:03:07It does manage to gain a foothold and could access and could escalate privileges. Essentially grabbing admin control on the host like we saw today. In that case, they might attempt techniques to disable EDR. So let's dive into which security controls will protect against this.01:03:27Let's start with walking through the poster configurations and strategies within Cisco ICE that can help us contain this kind of escalation. Let's take a look at what happens when ICE is doing posture assessment of the compromised host. As you can see.01:03:48See some checks failed and user sees an alert message saying that device has been identified and potentially compromised. Remediation time is set to 5 min and while it's running, we will go through some configured checks on the ICE portal.01:04:06So let's go into our ICE dashboard. We'll start by setting a condition that checks if Defender is installed on the host. This is a standard condition from the catalog where we simply specify Microsoft as the vendor and we specify the EDR product we're assessing, which is the Windows Defender in this case.01:04:21Next, we will define a condition to ensure the Microsoft service is actually running. We'll specify the exact service name and use the operator running in this case and on top of that, we'll confirm that not just the main Defender service is running, but also the network inspection service.01:04:41This is running as well.01:05:00Once we've done that, we will need to set up a few registry conditions to verify deeper system integrity, ensuring that NO tampering has occurred. So one of these checks will confirm the disabled real time monitoring value isn't active and another will confirm.01:05:02We disabled anti spyware value is set to zero.01:05:22As you can see here. So the defender is not being forcefully disabled through the registry or the group policy. And we can also confirm if the tamper protection is enabled as well. After we do that, we can combine all these conditions into a single compound condition.01:05:26So I will show you how that's done. And when we see it in a single compound condition, it is simpler to manage and administer administer. Everything neatly checks out in one place. We'll also set a firewall condition to ensure the Windows firewall is running. This is a predefined.01:05:46Check, so we just specify Microsoft as the vendor.01:06:06And then the firewall version. For this condition we can define an automated remediation action that enables the firewall if it's detected as not running. To re enable the Windows Defender and its services will create a script based remediation. The script will 1st check if another antivirus.01:06:09Different from Defender is registered in the Windows Security Center, and if there's one, then the script will exit immediately and compliance will fail. If not, the script will attempt to re enable the services ensuring Defender protection is restored. We'll bundle these conditions and remediations into three.01:06:29The requirements. So two will focus on defender. One triggers a script and the other one simply shows an alert message. The user, it will alert the user the host was compromised, but then the 3rd requirement is for the firewall.01:06:49Before we move on to the posture policy I want to highlight another condition we use. This one doesn't have a remediation action, it just simply collects information so we can use, we can see which application are installed and running on the host.01:07:05So in the posture policy setup, the 1st policy is purely informational gathering data about installed and running applications on the host, but 2nd one is our main policy, which integrates all these key requirements checking defender status and ensuring the firewall is in place. Together they give us both the visibility and the.01:07:20Control that we need. That was a lot of things that we did on the ICE portal, so let's go to our endpoint. Now that the remediation timer has expired, we can see that the endpoint's marked as non compliant, and we can see it in the notification here. So if we check the live logs.01:07:40We can see that the event sequence is as follows poster redirect, poster pending and then the non compliant. Once the posture status changed to non compliant, a authorization policy for non compliant devices was matched and quarantine authorization profile got applied as well.01:07:56To see which conditions failed, we need to go to reports, select endpoints and users reports, and then the poster assessment by condition. In this case, both the firewall and the defender running the checks have failed, and we can see it here.01:08:15Now, we can go to the context visibility menu to get more information of the endpoints. So from this page, we can go directly to the context visibility menu, and then we can see in the applications tab a list of installed applications on the host. So we can see.01:08:32Which applications are running processes at the moment. We can collect this information every 5 min and we can adjust this time of course in the general posture settings, and we might spot tools that shouldn't be there or confirm that all expected security software is running. So this helps us see if remediation steps actually work.01:08:51Or if anything suspicious pops up, we can also see it here.01:09:11From here, we can select an application. E.g., we'll select Skype for this scenario, and from that same interface, we can, from that same interface, we can name the compliance and we can also set the conditions as.01:09:15Check if the application is installed or running, and then we can apply a remediation action to uninstall or kill the process. That way the system can automatically enforce compliance and remove the software that shouldn't be there. So once we've defined that condition, we can go into the policy posture again and we will see it there. So next time the.01:09:35Endpoint is evaluated.01:09:55If that specific application Skype in our case is found, the remediation task will run immediately. Now, we need to go furthermore on execution and containment. We need to speak about protecting the company infrastructure even further. When we speak about.01:09:57Protecting the company infrastructure and defending against threats. We usually rely on different types of detection. They're signature based or behavior based. And as we saw on our attack today, attackers are increasingly using valid windows or Linux tools for their actions during exfiltration, privilege escalation or recon activities. It is so diffic.01:10:17Difficult to rely solely on signature based tools for this.01:10:37So with cisco's secure network analytics, we can now detect and respond to threats based on network events and host behavior. By using your network as a sensor, we provide deep visibility, advanced threat detection, and streamlined response capabilities. Empowering your security operations team to stay.01:10:40Ahead of evolving threats. We'll also see how integrating with Cisco ICE, we can offer a three 60 degree view of your network ecosystem. So let's explore how ICE and SNA work together in this following demo.01:11:00So in secure network analytics, we have custom security event policies where we can trigger actions based on network observations. Let's say there's an unprivileged network segment, so if someone tries to connect to our servers from this segment, it will trigger a sequence of actions.01:11:17Identify the security host groups, the peer hosts, and the protocol in this condition, which we used RDP in this case. The security event is not based on malicious application detection, but rather on unexpected behavior in the network.01:11:37Sorry. All right, so back here. Let's move to the response management part of the configuration. On the SNA dashboard, we can go to response management and see the rule that we created there. As a condition of our rule, we set it to be triggered by the custom security event for the untrusted segment.01:11:54That we just created and we set the action to notify ICE with an adaptive network control policy change.01:12:14Request and we request to place the subject of our custom security event into a quarantine group by assigning a specific security group tag. So now in ICE, if we wanna look at the ANC configuration on ICE, it's quite straightforward. We already created.01:12:22The security group that's called quarantine. So now in the policy list, we can explore the quarantine SGT policy.01:12:42We also created an authorization rule with an authorization profile. So let's explore that now. So this authorization profile for endpoints that match the ANC conditions, this specific profile can include a dynamic access list or a VLAN to limit access for that endpoint.01:12:49So now that the configuration is done, we can check out the attackers demo again or the attacker flow again. Just remember what attacker did was that after the privilege escalation, they could compromise Bob's account. So let's see how they did it.01:13:10So the attacker is, trying to log in with this stolen credentials from Bob and compromising their account even further by successfully connecting remotely to one of the PCs that Bob uses. Then they moved laterally to the admin domain controller from Bob's PC because it's in the same.01:13:30Active directory domain they could successfully authenticate as Bob with an already escalated role as a domain admin.01:13:49So after the password is put in right now, the connection will go through. However, with the controls that we just put in place right after the connection is made, it disconnected. The attacker got suddenly disconnected and they could not reconnect again.01:13:58Telemetry for this traffic appears in SNA. And what happened is that it triggered a response action according to what we configured, and once triggered, the attackers got instantly disconnected. They lost not only the connection to the AD domain controller, but also to the initially infected PC because it is now in a quarantine VLAN.01:14:16You can also add additional actions in response management to inform SOC or the incident response teams regarding such concerning events in addition to the NC policy.01:14:36In the SNA dashboard, we can see the policy violation and the alerts. We can also see the custom security event for the unauthorized access related to the infected host, and we can see the assigned quarantine SGT for this particular host. On the other.01:14:47On the other side, if we go to the ICE side or the identity services engine site, if we check the live logs there, we can see that the victim's PC has triggered an authorization rule which we set with a quarantine profile.01:15:05So in this type of attack, our tools successfully identified an anomaly. We identified the affected host and the network segment, and we automatically took action to mitigate the threat by blocking the malicious action and quarantining the device involved. All this while keeping clear.01:15:21Logs for our teams to follow and investigate after the fact. Now I'll hand it over to David to take us through the Cisco secure Firewall and our last defense of the day. Great, thanks here. Can you see my screen and hear me? Yes. Perfect.01:15:41So, now we talk about some of the defense features offered by the secure firewall in relation to the attack that we've seen and specifically encrypted visibility engine protection, which amongst other things can protect against exfiltration.01:16:02So with over 90 % of network traffic now encrypted, enterprises face a critical visibility gap. If their employees are interacting with encrypted traffic, then this means that the enterprise doesn't have visibility of what traffic is entering or leaving their network. Making it difficult to enforce security policy.01:16:20Government applications which are allowed on the network and protect the network from attack from forms such as malware.01:16:40There are effective methods to decrypt traffic at the firewalls, however, these are resource intensive on the firewalls and require a lot of heavy lifting, which can cost performance and create privacy conundrums if you think of such things as banking and health.01:16:47So encrypted visibility engine or Eve, on the firewall enables an organization to look at the fingerprint of an encrypted traffic flow to determine whether the degree of confidence the application which is running inside the encryption to then use in policy enforcement.01:17:02Which primarily tabletop exercise could protect against exfiltration. Eve can also be used to understand the likelihood if a flow contains malware and block it at the firewall. We're not breaking the encryption, we're only reading the intent.01:17:18And this can all be enabled for approximately an average of less than 1 % CPU increase on the firewall. So how do we calculate the TLS fingerprint and map to process? So the client hello for a process initiation in a TLS handshake is inters.01:17:33By the firewall. The client hello contains specific parameters such as cypher suites and extensions giving a specific indication as to what the process or application might be. However, due to applications saying the same encryption libraries, this on its own isn't normally enough.01:17:53So the information learned from the current Hello is further enhanced with attributes learned from the destination server name, destination IP, and destination port, acting as a reliable behavioral fingerprint. So in this example in the bottom right here, the TLS fingerprint is the same for Chromium, Slack.01:18:10And the MS Visual Studio processes et cetera. However, out of these connections, 73 % are always from Chromium browser, and 99 % of these connections with this TLS fingerprint which connect to accounts.google.com are made with Chromium browser.01:18:28And a hundred percent of connections with this TLS fingerprint to the IP address, 142-25-0102 dot 84 are made from Chromium browser. And 73 % of connections with this TLS fingerprint which used port 443 are Chromium browser.01:18:44So we can say with a high degree of confidence that the process using this connection is chromium browser. The beauty is that there are billions of possible combinations given us the insight into many encrypted applications and processes flowing through the firewall. And as we'll see on the next slide, the Eve engine has identified over 10000.01:19:00Some of these client processes which are mapped for applications that can be used in FTD access control policy.01:19:20So where does the Eve data come from? We have over 10000 label fingerprints or processes. This data has come daily from about 80000 Cisco endpoints. Aggregated data from over 30 global DCs.01:19:31Which approxim which process approximately a billion sessions and 29 billion connections per day. We also have data from over 10000 sandbox malware samples each day. This data is then collected, normalized, and passed through a machine learning process.01:19:46Where the fingerprints to applications are mapped by Cisco. These fingerprints and their mappings are then delivered in regular updates via the firewall of VDB packages, which are typically sent out every two to three weeks. The data is continuously trained and improved on with real world connections and traffic flows. So it's important to keep the VDB.01:20:03Actually is up to date on the firewalls.01:20:23So how do we enable this? It's, it's fairly simple, fairly straightforward. So here we've got a firewall FMC where we've got this access control policy, if we go into that for the firewall, go into more, go into advanced settings down at the bottom.01:20:25We've got an encrypted visibility engine widget. So we turn that on, also turn on application detection, and then we can also turn on the blocked malware processes. So once that's turned on, we can then click that to ok, save that to the policy.01:20:45And once I saved, we then deploy that across to the firewalls. So that'll deploy to the firewalls which will take a moment or two. And then what we'll do from here is we'll go to the attack machine, which will run an encrypted curl process.01:21:03And this will run the encrypted call process and this will come back although it says four oh one unauthorized that has actually made a connection, it's gone through the firewall just there isn't any credentials at the other end. So this is the logs on the firewalls that we see. The most important thing that we've got there is the E fingerprint.01:21:25Which does all of the mapping and all of the magic to what that processor application could be. We have got some process names and they're not important for this demonstration at the moment. So if we go back into the policy.01:21:43I've got a rule configured already that's blocking curl and Curl as an application shouldn't be allowed through this customer's network. But for the purpose of this demo I've got this rule set up. It's all set up.01:21:59From the the attacker to the the victim with curl as the application that shouldn't be allowed. So that set up will apply that and we'll then save that to the policy and then again we'll do another deployment.01:22:14So this will take a moment or two to deploy across to the FTD, and then once that's deployed, we'll then go back to the attack machine and run that kill process again. So that will take say a moment or two.01:22:34Right, so that's now completed. Let's go back to the attack machine and run that curl process again, that encrypted curl process. So that's now running, that will take a bit longer this time because a, it's not making a connection to the server and B, the firewall is also intercepting it and doing the.01:22:56Processing and mapping it to curl and blocking it at the firewall level. So that should come back as a blocked or a reset connection in a moment or two. So yeah, so it's come back as a reset connection. So if we go back into the logs of the firewall, we can see that we've got that same connection flow, but it's now blocked.01:23:16Yeah exactly the same fingerprint those say as I say, we've got the threat confidence scores but they're not important this demo's the fingerprint. So if we dive into the more details for this, that actual process, that actual connection, we can see lots of information here that.01:23:39Source IP, destination IP, destination ports, the zones that has gone through, the interfaces that it's going through. Also we can see some of the information, the fingerprints, and then, but what's most important from this is.01:23:54Eve has managed to map that process to curl. And so now that we've added it as a rule on the firewall to block it, that is then stopping that encrypted connection, not being able to pass through the firewall.01:24:11And so stopping that exfiltration attempt. So yeah, so it's all fairly simple to, to set up as we can see from that demonstration and all for the, all for the extra addition of about 1 % CPU on the firewall.01:24:28So, now that's the end of our attack and defense demo, and there's been lots of great engagement during the talk today looking at all the questions that have come in over the chat. So thanks for everyone for taking part.01:24:45And I'd like to move on and talk briefly about some of the next steps you can take to increase your security posture starting with telemetry and the benefits that it would give you in your business from an operational and security perspective. Many of you have it enabled on your products, so this should aid as a refresher, for those that don't, it will help in understanding the advantages it provides and how you can enable it.01:24:59So when we talk about telemetry, we're talking about proactive intelligence. By transmitting and collecting product data, we are able to provide you with actionable insights that allow you to anticipate issues before they impact your environment. Aiding an operational efficiency.01:25:22Identifying unused features that can drive more value from your existing investment and giving you a quicker time to value. Ultimately, this is what allows us to improve the product experience ensuring your infrastructure is not just running but optimized. And you're likely wondering what exactly is being collected.01:25:37To be clear, we're focused on the metadata that finds your environment's health and posture. This includes device specific data, software versioning, licensing status, and uptime metrics. We're not looking at your traffic payloads, we're looking at the health of the system itself.01:25:55For those of you who want to dive into the granular details, I've added links to the slides on the data which is collected. And of course we securely handle your telemetry data. Every bite of data is securely encrypted both in transit and at rest within the cloud.01:26:11We adhere to rigorous data handling practices to ensure that your operational information remains private and protected. We encourage you to review our specific data handling guides. These documents detail the protocols we have in place to ensure your data remains secure and compliant with global standards.01:26:27So how do we enable this? And again, it's quite simple. For the firewalls, if you go to the MSC, go to integration, go to Cisco Security Cloud and select Enable Cisco Success Network.01:26:48That enables it on the FNT, which then can pushed out to the firewalls. For secure network analytics, go to configure essential management from here go to inventory SLA manager and then actions, edit appliance configuration.01:27:02Then go to general external services and select enable customer success metrics. And then for ice, again, quite simple, go to administration, go to settings, network success diagnostic.01:27:20Telemetry and select enable telemetry. So thanks for staying with us while we've discussed telemetry and the benefits it gives our customers in improving their operations. Now that we are wrapping up our talk.01:27:35I'd like to discuss one more thing, and that's security services with Talos. Talos is Cisco's threat intelligence team and is one of the largest non government threat intelligence teams in the world who provide industry leading security intelligence and rapid response to protect organizations from evolving cyber threats.01:27:51So cisco's telus retainer services provide organizations with a partnership with cisco's world class threat intelligence and incident response team. By securing retainer, organizations ensure that they have immediate prioritized access to expert resources when they need them the most, rather than attempting to engage services during the middle of a crisis.01:28:12The retainer gives 24 by seven, 365 days a year access to the emergency incident response team, giving expert remediation guidance to your company security incident. As well as purple team threat hunting, cyber range training, tabletop exercise, and incident response plan and playbook services.01:28:32And two of the services that may have particular interest to your organization following our talk today maybe the tabletop exercise and cyber range training which is available as part of the Talos instant response retainer. The tabletop services range from traditional to gamified.01:28:53And the cyber range training provides your team with a training experience that is designed and delivered by incident response experts. Enabling your team to increase their competency in readiness in the event of an incident response. Please visit the links above to learn more about the incident response retainer.01:29:11Or please speak to your Cisco sales team. And to finish I'd like to discuss some of the free education services that we provide in Cisco up providing customer success.01:29:29One of these is cyber capsules that offers a series of concise videos packed with expert recommendations typically lasting between ten and 20 min. The videos are aimed at significantly enhancing our client security posture around a particular product and at least one of its key features.01:29:47We currently have over 30 of these videos available to view with the plan to add lots more in the coming months. Please use the QR code to visit the site. And if you found today helpful, want to learn more from us and the rest of our customer success colleagues.01:30:03Please see some of the upcoming sessions that we have on ICE secure firewall, and Duo to name just a few. If you haven't received any invitation, then don't worry, you can use the registration link above. And it's important to us the feedback that we receive from our.01:30:23Our customers because this helps us to shape future sessions that they are aligned with your needs and the topics that are most important to you. Once this webinar concludes, the survey will automatically open your browser for you to complete. We really appreciate your input.01:30:42And lastly, we'd like to say a big thank you to all of you for your time and attention today. We hope that you've picked up some important knowledge which will help improve your security posture. It's been a real pleasure to have you join us. And with that, I say goodbye and wish you a great rest of the day.01:31:02Just a final note before we close, we noticed that due to a time change issue during registration, some participants may have joined 1 h later than planned. We sincerely apologize for any inconvenience. The full recording will be available on our community page.01:31:20In the next couple of days. And if you have any questions or issues, please feel free to contact our team via email. Our team has put a great deal of effort into preparing this webinar and we genuinely hope you found it valuable and your feedback means a lot to us. So we would greatly appreciate your thoughts in the survey. Thank you.01:31:38