Master class it's December 1st, 2022.
And we have or presenters. Tonight we have Robin Clark,
Lauren Galvin, White nap and Michael Huskin.
Robin, if you are ready.
You can.
Lead us off.
Awesome.
Alrighty, let me get this going.
I can see your screen.
Awesome.
So welcome to my master class keys to implementing a
vulnerability management program. Or is that like to call
it the CD underbelly of vulnerability management?
A Phoner ability management program is a framework for
managing risk in the detection of vulnerabilities throughout
the environment. The aim is to secure the organization's assets
against malicious actors, accidental and intentional, to
alter, destroy, still proprietary and sensitive data
of the organization. It's clients and partners by
proactively protecting.
Protecting against the exploitation of existing
security flaws and vulnerabilities.
This concerted effort includes the regular expeditious patching
of software, vulnerabilities, hardening and securely
configuring devices for starters.
Many organizations are at a loss when it comes to how best to
build and implement a vulnerability management program
that can comprehensively secure their environment.
Many think they have nothing as cyber criminal once. However,
how will those cyber criminal know that to be the case without
breaking in and taking a look around that very thinking and
the reality are what makes a vulnerability management program
a necessity for business regardless of size and industry?
This talk aims to be a road map focusing on key components of
establishing and maturing of vulnerability management
program.
The common reasons for filled implementations.
Usually start with the 3P's policy process and people. As
with most things, the top sets the tone, and if there's a
lackluster support or buy in from the executives, then this
endeavor will fail. If there are no approved policies and
procedures that leaves room for errors, gaps in security,
inability to scale or repeat processes, and is not conducive
to automation.
Or there is a lack of baselines or metrics and goals are not
defined or are incomplete. The lack of technical know how at
any level will lead to gaps in the scanning of the environment.
The vulnerability management program cannot be treated as a
one and done effort. It needs to be continuous, sustained effort
with an eye towards always improving.
Tell your to clearly define roles and responsibilities.
Leads to 0 accountability. So in the time of need, no one knows
where to go to and that leads to frustrations and finger
pointing, which then leads to an absence of transparency and
communication between IT and cybersecurity teams, as well as
the teams responsible for remediation of vulnerabilities.
All involved must speak the same language and be comfortable in
knowing the difference between vulnerabilities, exploits and
threats.
Vulnerability is a weakness that exist in software, hardware
configurations, and physical security, and sadly, people are
the weekly pill.
Exploits are the methods used by cyber criminals to leverage and
twist the vulnerability to their benefit.
And the threat is the hypothetical damage that will
result from a successful cyber attack exploiting the
vulnerability.
Now, how will you identify risk in which controls will be
implemented to mitigate them?
In order to identify risk, you need to know your baselines and
which threats are actually applicable to your environment.
Once those are identified, then the team can plot out which type
of controls will be needed.
The vulnerability management program must be run as a project
and it starts with resolve. The baselines are established in a
course of action. As charted, it will need to end with the
commitment to actually implementing.
To that end, of Project manager will be required to facilitate
engagement, set agendas, engage in, allocate resources and
ensure the progress is moving along on time and within budget.
And Speaking of engagement, key decision makers must be
involved. There is no way around it from TUT senior leadership to
the C-Suite. The term budget is key, as it truly indicates the
level of resolve and commitment is some instances there are two
budgets, one for the project, while the framework meaning
policies, tools, resources, either training the existing or
adding new staff is being set and the annual one for the
actual implementation of the vulnerability management
program.
Year after year.
Leadership must not only support and define the policies, but a
consensus must be reached regarding roles and
responsibilities. Everyone must understand The Who, what, when,
where.
Why and how associated with every single role? So in the
time of need, everyone is reading from the same playbook
and has the same understanding.
Hardware and software asset management are critical to the
foundation and success of the vulnerability management
program. It improves the overall IT organization by allowing for
better insight and planning.
Great lamp proves the risk analysis because you know what
you have allows for thorough mapping of software to hardware.
That is what applications are installed on, which devices,
where are they installed and whether they're are vital or
needs to be removed. Lastly, it allows for the system owner of
every application to be identified and thus who is
ultimately accountable for it.
By actually knowing what existing your environment, you
can then prioritize and assess which assets are critical to the
operation of your organization. With this information,
remediation teams now have actionable data by which they
can set a valid and consistent scan schedule and therefore not
waste time and resources by remediating everything. As the
saying goes, we need to work smarter, not harder, and by
using the proper tools for asset inventory, complete with
policies and inventory management.
This will help set the asset criticality.
Also, the number of available threat intelligence feeds seems
endless. Therefore it's imperative that the research is
done to ensure the cybersecurity team is following those that are
applicable to the organization and its industry. This will help
filter out a lot of noise and help keep the team focused on
only relevant feeds and threats.
Tracking every threat that exists is not feasible, nor does
it do your organization any good. While you're a security
team is out chasing red herrings or assets are being plundered,
so focus only what is on what is real and relevant to the
organization.
Organizations must decide upon the best way to quantitatively
calculate the risk to them, and that will lead to uniform way in
which to rank, rate and ultimately remediate
vulnerabilities. The formulas range from super simple to
complex and a good starting point for any organization with
a very immature security portfolio is to start simple and
it's the organization matures security wise than a more
sophisticated formula may be adopted.
But be sure everything still aligns with the reality of what
you are protecting and how you are protecting it.
If you have a situation where the risk of exploit existing
successful will cost you $10,000, but the cost to
remediate it is 100,000, then the risk response and applicable
corrective actions rather technical, administrative or
physical must be put in place to mitigate it.
Oregon and these organizations need to follow the vulnerability
management life cycle so they don't end up filling as if they
are on a quest to Mordor without any capable companions.
The conversation returns to baselines there needed to create
and set performance, key indicators and metrics, and hold
the responsible parties accountable when setting the
metrics. This is a good time to have discussions with your
vendors and IT team because it truly allows for learning what
the software or hardware can or cannot do.
Proper placement for it to do its job and also how to roll out
the scanning and phases as to not overload the network and its
resources.
When conducting a comprehensive review of government and
industry regulations to identify and address compliance
shortcomings, organizations must take into account the markets
they operate and sell their products in.
This piece is important because designing a vulnerability
management program with compliance requirements in mind
will not only ensure the organization is fulfilling its
obligations, but will go a long way in protecting its goodwill.
Bottom line, keeping the company from being fined and executives
from being jailed.
Automation is the heart of the vulnerability management program
because it is scalable, reduces human error, is repeatable, and
will be relevant as long as everyone does their due
diligence and has the proper sources and inputs set, which
goes back to tracking relevant threats.
With the cyber threat landscape constantly involving, there's no
shortage of alerts regarding new and resurgent attacks on all
vectors, or new trends or new malicious actors joining the
scene, along with new tools with organizations redefining their
needs. And those are their clients, service security teams
must constantly review every facet of their vulnerability
management program and tweak the metrics and tools.
This continuous improvement also extends to the three P's policy
process and people.
Having a vulnerability management program leads to
increased morale and retention among the IT and S cybersecurity
teams. The passion for work increases when they have the
proper support, resources, tools and time to grow and learn,
which allows them to increase their visibility with
management, leverage new skills into more responsibilities, thus
moving within and growing with the organization as they
endeavored to support it.
Mature of the security posture.
This process is by no means all-encompassing.
Excuse me, it is a good starting point. The details and layers
will be to to hurt, determined by the organization's needs,
compliance requirements, budget and skill level of the various
teams.
My hope for every organization is this process makes the road
to security accessible less daunting and a lot clearer
because not one business can afford to not have a relevant
vulnerability management program.
Still, it will all be for naughty if every person in the
organization is not engaged and trusted and vigilant.
The only other option is hemorrhaging losses due to
breaches, regardless of whether they make the headlines or not.
But with planning, resolve and commitment, your organization
will be an ongoing concern for years and years to come. Thank
you.
All right. That was awesome. Thank you.
Learned a lot. I love that stuff.
Yeah, and.
It especially what you said about the soft dev that really
is development that really speaks to me the vulnerabilities
and stuff.
Right. And I'm a process person and it's interesting watching
all of the politics and all the different things surrounding
something you would think or just basic.
Uh-huh.
But there's just a lot of inroads still to be made at
billion dollar companies you it's unimaginable. But also I
Right.
wanted to do this because sometimes your people going into
a new situation where there this is their first cyber role or new
company.
You can you go in and you're like, I'm gonna screw up logging
in with my credentials. Like you. You really are terrified.
So it's always good to kind of have that one thing that you
really feel good about or say, hey, I kind of know this or this
sounds familiar. So I kind of wanted to do that for them as
well.
Alright, thank you.
Thank you.
I forgot to add before we started everything. If you guys
have any questions for any of the presenters, please write
them down and ask them after everybody's done presenting.
That way you know we can move the right along. So with that
said, Lauren, Are you ready?
Uh, yeah, I'm ready to go. She just killed it with that song.
I know.
But I got some shoes to fill. So alright.
You'll do great.
Umm, alright.
I have faith in you.
Preciate it alright? You should hopefully be work. You guys see
the screen and all that.
Yep.
Alright, cool.
It get away.
Appreciate it. Alright, so I got it like as a presentation that's
gonna run. So if there's any audio issues, does let me know.
I have it also saved on YouTube, but if that ends up not working,
if you know how technology can be again this I have to slide
save so I can just present it that way. But let me play the
audio. It's guys something if you can.
Hear it and all that.
See if that this worked real quick for I keep playing it.
I can't hear anything. Did you share with audio?
Can't hear it?
Let me try again what I did.
I did not.
Alright, should be good now.
Let's see.
Hey there y'all, how's it going? Alright, cool. Alright, cool.
Yep, I can hear it.
Cool, cool. OK.
Yeah.
Won't start it. I'm going to meet my mic. Just make sure it
keeps working. So yeah, alright. Yeah, I'll turn it up. I got
you.
Doesn't wanna blast her once. Eardrums.
Alright, you guys just let me know the audio needs to be just
reading my mic so there's no background noise. So yeah.
Hey there y'all, how's it going? The names, Lauren and this is
going to be my presentation for master class today on
cyberattacks.
So some background before I go more in depth about like what
I'm to talk about throughout this whole presentation and all
that. So a specific question I've been asked a lot.
Is, you know.
It's weird. It's laughing on.
I don't want this for that will look.
Michelle, sharing from a minute. Hang on, I got you. I think I
know what it is.
Try my teams as a whole. I have to turn on the audio super loud
or do it again real quick.
The share with sound.
Yeah, I got you.
Sorry about that.
Alright.
You just let me know what's better depth about. Like what?
I'm gonna talk about throughout the whole presentation and all
that. Alright, cool. Sorry with me a specific question. I've
been asked a lot.
Is, you know, why did I want to pursue a degree in
cybersecurity?
Umm, so back, you know, I've always had a love. We start with
this first. I've always had a love for it and technology and
all that like.
It's just something I wanted to do. Like I went to.
Online high school starting my 10th grade year because I just
wasn't liking the education I was getting in breaking more
public school.
I'm in person, so I moved to a public online school, my 10th
grade year, and I graduated with that same school. This text
online preparatory school. I was the top of my class. I was
President of student council. I started the student council
there and I just fell in love with it. So toward the end of.
You know, my high school career. I was out being asked. You know,
what did I want to do after high school? What did I want to
pursue in college? All at that point, like, at that point was
about beginning of my senior year. All I knew is I want to do
something it. So I was thinking just go maybe get like a basic
IT degree.
And just go from there. So it's just, I didn't know totally what
I wanted to do.
But I had talked to some people because I'm in. I do a lot of
gaming online. I've talked to people and I've met people who
are really good friends with now that actually have careers
within the cybersecurity field and as well have gone to college
for cybersecurity. So they got to tell me a little bit of
rundown of like what all experience. And I'm like, wow,
this actually sounds like seeing a really want to do something. I
can, you know, help people. Something I want to do. I've
always want to be trying to help people. And I feel like this is
something I can do, you know?
Telling some people that, like some of the courses I've taken
throughout college, like while living ethical hacking like
ethical hacking has hacking ethical. I'm like, well, it's
not like us truly like hacking. We're stopping hackers. But you
know, doing counters for, you know, for their attacks and
stuff kind of pretty much cyber attacks.
And doing stuff like that. So that's why I knew I wanted to
pursue in cybersecurity. So I felt like I could do so much
good. And, you know, better for people.
So, and that's why I grew more of an interest for it. I look at
statistics and I look at data recording, you know regarding
that and all that such.
So you know, when I was coming up with this master class
presentation, I I just could not get an idea.
You know, for the life of me, I really was trying to think what
I wanted to talk about. So you know, there's two things that
I'm gonna talk about here that kind of made me lead toward why
I want to talk about cyber attacks with you all tonight and
talk about them more in depth. One, I do a lot of like watching
on my YouTube and Twitch. And I was just doing some late night
YouTube, you know, just trying to chill out for the night
before I went laid down. And the video actually came across my
feed. This talk about this guy who's Jim and he stops scammers.
So he's kind of like.
How I look at it, how cybersecurity people are he's
doing the same thing.
That scammers are doing but doing it for the better.
So he's scammed scammers, or he can tap into their things and
see what they're doing so he knows, you know, he exposes them
and he helps people in the video, I can link it if someone
really wants it.
It's my vice and they went and talked to him and he tries to
help as many people as he can. He's also trying to bring
awareness to what these scammers are doing because personally my
family, not myself, my family has been affected by this. When
I was a few months ago, I was in the hospital getting some
testing done for some stuff. My mom ended up getting a call.
And it was.
Posing as our energy company, but end up being a scammer.
And that just she started giving information. And she thought
about it. But she just totally wasn't thinking, you know, we
all have those moments when we're not thinking.
And you know, that happened. And she's like, Oh my gosh, I'm
getting scammed. So she hung up immediately. She contacted her
she company. And they told her this is actually been happening
lately, and it is true. Scammers are getting better at what they
do and more scams are happening per year. And all, you know,
scams and cyber attacks for sure go hand in hand. Like, I'll go
into in a later slide.
Most cyber attacks have grown even more.
And scams even more throughout the last couple years and even
decades because technology has a whole, as you know, evolved as
well, you know, technology evolving is for the better, more
in my opinion, but also obviously has its flaws, just as
everything does. So cyber attacks, I know some of my
friends who have been affected by them as well, just some some
people don't really take the precautions they really need to
when they're using you know their technology devices like
their computer.
Or even their phone because cyber attacks have evolved and
changed so much that those people can tap into literally
anything.
It's actually unreal.
But yeah, we'll go into this next slide. So let's just jump
right into it. What are cyber attacks? Let's go in. In NIST,
you know, they have article on there. They have a lot of good
information on there. A cyber attack is a type of malicious
activity which occurs that is attempting to collect disrupt.
Deny, degrade or destroy information.
Systems resources or information itself, so pretty much cyber
attacks are bad. They're you know, they're simple as that.
The should think about cyber attacks equal bad.
It's an attacker doing these attacks for a specific reason.
Most of the time server attacks are to, you know, get people to.
Hey up something you know? Maybe usually money.
Maybe information or whatever somebody cyber attacks.
Some of these factors should do it. You know, for the thrill of
it, they just. They just wanna do it. Order to trying to expose
someone or something or organization for something
that's like, you know, deeper into their systems and their
network. That, like, isn't obviously being shown to public
light. So better than they cyber attacks equal bad. Just how I
look at it.
So when was.
And what was the first major cyber attack to take place?
So first cyber attack that curd was in 1988 and it was host was
from. It was from my computer at mid actually.
And this cyber attack actually affected a lot of different
computer systems at various schools that include like
Stanford and UC Barkley, but also even attacked NASA. We know
how big NASA is nowadays. It actually hit networks and
systems with these. Those two different schools and even other
types of schools and even NASA that the.
Cyber attack occurred and it got information and you know like
sensitive information and data obviously.
You know that each of these places has within their system
and networks.
And this attack?
Pretty much.
The whole, you know, grisp like got hold of this data as a
whole.
You know, there's already. There's already attacks
occurring that were known as cyber crime, but this one that
happened in 1988 was truly the first major cyber attack to take
place because like cyber crime data back, all the way back to
1962 when Alan he launched an attack actually at MIT, again on
their computer networks and he was stealing passwords from
databases associated with MIT, the school itself, by using a
punch card. Obviously this is back before the Internet, and
everything was a thing.
So he.
Was doing it with the most like basic technology they had at
that time, before the Internet really became a thing and he was
obviously just attacking the database like a network in the
systems associated with the school. Nothing.
Those so she anywhere else, like the 1988 tacked it.
So how cyber attacks changed and evolved over the years? One
major way in my opinion, that cyber attacks have changed a lot
over the years is how much more complex they have become
nowadays. And I'm going to go into the next slide about
different cyber attacks that occur. But you know, like I
said, with technology evolving and changing for the better,
most in my opinion obviously it has its flaws, those being the
cyber attacks as technology involved in everything, cyber
attacks have as well.
Some cyber attacks that happened nowadays are just.
They're crazy. It's just it's.
Kind of astonishing to see how much time and effort some of
these attackers do, because some of these tasks, obviously
they're not like.
The process of Marge is taking place over like a day. These
attackers really are taking the time to.
Like, think about what they're going to do and how their tax
going to take place and all that, and then they just do it.
You know, so you know, there's many different types of informs
cyber attacks.
That, you know, people have to look up for nowadays like, you
know, the list kind of goes on forever and it's just.
It's kind of sad, but people should be aware and they should.
You know, they should be aware on, you know what they're doing
like, you know, being in person. You should always be aware of
your surroundings. You should also be aware of your
surroundings online. That's just how it is. The Internet is a
really big place and it's full of information, data. But it's
also full of, you know, those scammers and those cyber
attackers. And you know, malicious people, malicious
activities. It's just how it is, you know, it's recorded that
2200 cyber attacks happened each day.
And you know, if you do the math, you add it all up. That's
800,000 people that get affected per year.
And that doesn't sound maybe like that biggest number to some
people, but it's actually that's very alarming because.
You know, these cyber attacks, whatever they're getting their
hands on really, can you know?
Affect even more people than at 800,000 at than a day.
So some of the cyber attacks and what's your cutter are, you
know, malware very calm and type of cyberattack. Mom, I would say
most people who like have a computer or somewhat some good
knowledge of technology and all that know what that is. You
know, malware attacks, they take that deeper dive into one
systems networks, they're going to crack the passwords that are
associated with one account or accounts.
That you know the passwords are more simple. Like you know the
12345. That's why you know when you make an account like on a
website, nowadays there'll be like, you know Google. I know my
Google does it, it pops up be like, yeah, let's create you a
stronger password. Personally, I don't want to do that because I
just.
I don't trust it. I try to come always with my own password, but
if people do it simple password and easier password.
Obviously it's going to be easy to from rubber, but it's also
high. Look at, it's gonna be easier for cyber attacker to
crack and you know, do all that Trojan horse concept is being
used.
It looks legit and then ends up not being legit at all. You
know, people get attacked, scammed, you know all that or,
you know, ransomware as being used by the attacker at hand.
You know.
This is how people do it.
And then the next type of attack, it's kind of like kind
of like a A baiting type of cyber attack, you know, kind of
fishing for us. I look at it, it tricks people. But, you know,
sending a fake message like an e-mail like.
It's crazy. I've seen this first hand. Umm, someone I know.
Bought an e-mail and it was supposed they had a Netflix
account, so you know some like sometimes when emails come
through like I get text messages on my phone all the time and
then emails that are like saying oh, this needs to be renewed or
doesn't that like sometimes you get like an Amazon e-mail and
I'm like but I don't have Amazon.
I you know, I use my mom's Amazon account, so obviously I'm
not turning the Amazon, so I'm not gonna need the reset
anything for it. So I just, you know obviously ignores emails,
but I saw one for San, like I said with Netflix.
But buddy, yeah, Netflix. And he got an e-mail.
He's like, hey, well, would you look at this? I'm like, yeah,
sure.
And it was saying that his payment was wrong and.
I was like, well, when was the last time he paid? And he told
me he paid, like, about a week ago. I'm like, well, you
shouldn't be getting another e-mail yet about needing to pay
because it's a monthly subscription. So I like, looked
at the e-mail in depth.
It looked 100% legit. The only thing that threw me off is that
there was a singular typo at the very bottom, like in fine print.
And I was like, do not respond to that.
It's it's a baiting type of attack, it's looking legit and
someone's trying to get an entry point from you. Clicking the
link in that e-mail.
And they're going to scam you.
And.
Yeah, he ended up not doing it. And I think I kind of saved as
accounts because I mean by that happening, the cyber attack,
it's just giving the entry point for attackers and everything to
get into your system, your network and your devices. And
they can do whatever they want. I mean, that's just how it is in
today, sadly. And then there's denial of service attacks. You
know, the US and it's like a shutdown type of attack. If this
attack truly gets on one device is it's kind of like it's over.
You can't really do anything at that point in time at least.
You're going to be totally shut out of from all your systems,
your network, or even like the machine you're working like your
computer. You're not gonna be able to operate at all. It's
cutting you off from accessing anything, and that's how the
attacker really can get their hands on an information. And so
she may have.
You know, so.
I'm gonna end this is, you know, this is a lot. One of the last
slides I got here, you know, how can one prevent themselves from
being an A victim of cyber attacks?
And this is, you know, I try to preach people.
You know, just being 21 and like someone who's younger, I feel
like the younger generations obviously have a better grasp on
technology than maybe like the older sister generation is kind
of like my parents because my parents are like in their late
50s, early 60s.
Umm, so you know, somebody tried to tell them and I tried to
preach to like my parents, friends or like, you know, the
older generations, you know, some of these ways up listed
below.
Because you know.
Some people don't know the signs to look for that. They're being
attacked or scammed or whatever it may be being becoming a
victim because when she become a victim, it's really sometimes
hard to get out of it. There is ways to get out of it, but you
know, if you can stop yourself from, you know.
You could prevent yourself, obviously, from becoming a
victim from the start. You know be much better off. So creating
those stronger passwords, not doing this simple passwords and
all that. Really think about like a password that you're
going to kind of remember and all that. I mean, if you feel
like you can password at the end of the day, just take out a
sticky note, you know, write it down, put on your desk or like,
put it in a drawer, obviously.
Umm. And that's the way you remember it. I usually try not
to always save my passwords within browsers because I just
don't know what's going to happen or I change my passwords
every couple months. I know that probably sounds a bit weird, but
it's just something I kind of do because I wanna make sure it's
always kind of changing so then I'm good. Make sure your
software is always up to date.
If you're kind of behind the software, it's kind of gives
attackers an easier point to make entry and do their stuff,
you know? Also looking into antivirus software, it's never a
bad idea.
I personally have it and I've been much better off.
And it gives me like alerts when I feel like it's making me go if
I'm going to website that they think it's suspicious and
everything gives me alert. So I'm more cautious and I look
into it.
You know, always look at for an as suspicious activity which can
occur in your accounts, such as being accounts.
You know.
Make sure if you see something weird, you know, contact your
bank or contact you know, the charge associated would be like
yo, why did I get hit with this? If you really want to. And then
finally always just be aware when you're browsing the
Internet.
So she knew websites you might be visiting, you know.
Websites you know, attackers are really good at, you know, their
attacks, hiding them more in depth now lately. And from what
I notice, like just from that e-mail that my buddy got, like
evid look legit. Only thing that threw me off was to typo at the
bottom. And I wish I had screenshot to show you all, but
it was actually kind of crazy. I was like, wow, this is actually
kind of unreal. So, you know, that's everything I got.
We go and cut off there because I know what Angela said about
questions at the end, but it's all I got preciate at y'all and
All right.
yeah.
Baked. You did a great job and I understood every word. It wasn't
too fast. So that was great.
Umm. Wyatt, Are you ready?
I am making my screen share here.
Alright.
OK. Well, in keeping with the theme of cybersecurity or
security in general this evening.
I am discussing conditional access policies, specifically
within the Microsoft 365 environment.
No.
With that said.
We'll go over what is conditional access. Some
recommended conditional access policies. We'll do some demos
with that. I'm going to show you how to set them up. We'll go
over multifactor authentication policies that can tie into
conditional access. Things have some demos there and then a
little bonus tip at the end.
So what is conditional access? Essentially it's a set of rules
that can limit the access of users or devices based on a set
of predefined conditions. Those conditions can include things
like location, device settings, or the security state that
device has.
It is important to note that you don't necessarily want to.
Apply it to every account high high risk accounts, certainly,
but there are some service accounts and things that you
would not want to apply conditional access to because it
can break access for services and things like that.
So.
Some recommended conditional access policies, like I said
before, it's location based or can be location based. You can
allow it from specific locations, either IP address
based or coordinate based, or you can deny from specific
countries or things like that. You can require MFA as a
conditional condition of access.
Umm. Specifically, I like that one for risky sign in. So risky
sign in is something that Microsoft deems is highly
unlikely i.e. Geographical difference. So you sign in and
Los Angeles and then 10 minutes later you signed in in Maine and
they're like, hey, that's probably not legit. So let's
flag that and require multi factor authentication even if
the device looks legit, we're still gonna require it because
it was risky.
Umm, you might apply a conditional access policy to
prevent a persistent logins. This would be useful if you've
got people that are signing in on maybe not their own device.
Hey, somebody went to the library and logged in. You would
not want that session to stay open. So you could say hey, it's
an unmanaged device we're going to kick you off after a certain
period of time or you're going to have to reauthenticate.
And then, like I said, it can also be applied toward the
device and settings there. So you could set a minimum
operating system version or whether the device has antivirus
enabled.
Those are just a few of the things. There's many, many, many
other.
Uh.
Things that you can base these on so.
So now it's demo time with that. And so I'm going to hold up.
I've set up a Microsoft 365 environment and Azure to show
some of these demos on and so first I'm going to sign into
their endpoint portal. This is basically Intune.
It's used to manage devices and so I'm going to show you this
first because for a lot of these policies you you'll have to have
a device compliance policy.
Set up and so to do that you can you sign into their endpoint
manager and you come into endpoint security.
And let's see.
Decisional access.
That's.
I thought I had it set up.
You.
Services.
No in here.
Ice compliance. That's what I'm looking for.
So I I went ahead and set up a device compliance policy.
And if we come look at the properties of it.
Because it's a very basic one and I said, hey, the device has
to have BitLocker enabled and turned on, has to have the Code
Integrity feature enabled, has to have a minimum device version
of this, and then a bunch of security things. You got to have
your firewall turned on. It's got to have a TPM chip,
antivirus anti spyware, all that jazz in order to be compliant,
your device has to meet all of those.
Thanks.
So once that's set up, we can go into the.
The Azure portal.
Too many sessions open, I think.
So we come into that Active Directory portal. There's a
couple things that we're gonna set up for demos in here as
well. If we go to security.
Named location, so we need to set these up in order to
blacklist or or white list where we can allow people to log in
from.
So we will do a new country's location.
He we're gonna say whitelist.
And we're going to say.
Just the United States is on our wait list.
So now we have a white list and we could add other countries to
that. It doesn't have to be just one, but we're also going to
create a black list.
And we are going to.
Purpose of this, we don't want anything coming out of Russia.
Blacklist, whitelist and then we can also.
Umm specify a specific IP address and so this might be a
corporate offices. So I'm gonna name it HQ the trusted location
and then I just gotta put in the IP address. So I'm just going to
give it a really basic one.
So only IP addresses from or only devices with this IP
address will.
No, be allowed to do whatever this. We set this for, so we
have a blacklist, a white list and at headquarters.
So now we can go in and actually build our conditional access
policy.
So the first policy that we're going to do.
Is an allow from base selected location, so I'll go ahead and
create.
Name my policy.
Policy name we're going to choose the users that this is
applied to and we're going to apply it to everybody now. They
do give you a warning. Say, hey, don't knock yourself out,
because if you apply it to all users.
It will apply to you too, and if you don't qualify for it, you're
gonna lock yourself out of your environment, so be careful.
And then for cloud apps, this is going to apply to anything in
the Microsoft 365 environment that is exchange online, your
e-mail teams, anything like that.
The condition so we will select that and the condition is based
on your location.
And we will say a selected location and we're gonna say our
white list.
And then down here, we will grant access.
Select.
And you're going to require multifactor at that.
So by default they're going to give you the option to exclude
yourself.
I'm gonna leave it because this is gonna be a report only. So if
you leave it as report only.
You will be able to run. It will get logged basically and and the
Azure logs, but it won't actually apply.
Umm, I'm actually gonna go ahead and turn it on. Since I'm in the
US.
Now.
The only way that we can.
Log in to our environment is if we are in the United States and
that's what our IP address will indicate based on other data not
based specifically on the IP address.
We can also do a block policy, say hey, we wanna allow people
to log in from anywhere except if they're in Russia. We don't
want to do that.
So we'll call this a new policy, we'll say block from blocked.
Quiet to everybody.
Apply it to all apps under the condition that if you're
location.
Is on our blacklist. Then we will block your access.
So you probably wouldn't run both of these policies at the
same time. You would either run a whitelist, which is what this
is, or a blacklist, which is what this is.
You're probably better off running a white list because
that way.
If something new comes up, not that there's new countries, but
if something new pops up, it's it's gonna be blocked by
default. That's generally.
The best method when it comes to security.
We can also create a policy to.
Require multifactor authentication.
So if we do that, we'll do a new one require.
Very.
This will also apply to everybody. You will apply to all
logins.
And then the condition that we will grant access is require
multifactor authentication.
So you can see and hear that the state of some of these are
report only. You can go in and turn them on when you're ready
to. You might run it and report only for a while just to see
what what might be affected. And that way you're not
interrupting.
Actual business operations.
One other policy that I.
Generally in favor of, it can be hard to do depending on the size
of your organization is to block multi factor authentication
device registration.
Unless it's from a trusted location. So.
He might say we'll only allow people to register.
A new device that an Authenticator app on their
phone, if they're at the corporate headquarters. If
they're outside of that, you cannot register new device and
this prevents.
Attackers that somebody even gets somebody's password and
they can get in and into their account online and try to
register an authentication device so that they can have MFA
access to their account. This would prevent that because they
cannot register device unless it's at the company headquarters
coming from that IP address that we set up earlier. So I will set
that up.
This is also going to apply to everybody.
For all apps.
Ohh, but it's going to actually be 4 user actions instead of
applications so.
Register or join devices.
And then the condition is going to include a location.
And that's going to be our headquarters IP address.
So then we go to our.
No, wait. We got two under the conditions. We also have to
exclude.
All other locations, so anything from our blacklist as well we'll
select now, but you would you would create.
Your black list would have everything on it.
Will you?
She was are requiring registration.
Ohh, it's in the actions. Anyway. We would block access
from that.
I did something wrong here in the demo.
Tradition.
It shouldn't. Conditions that require.
Different.
And.
Right.
You must.
I have done something wrong in this policy.
Umm, I'm gonna have to figure this out, but now it's not the
time.
If it had worked, it would have prevented MFA device
registration from another location other than the company
headquarters.
But you don't have to build your.
Policies, all yourself there are templates in Office 365 or
Microsoft 365.
And the one that I.
Use. Yeah. As for requiring multi factor authentication for
a risky login.
Apparently it thinks I'm doing right now.
You.
So like I am like I talked about.
If the if the services around register that hey, that's not a
likely login, we can require multifactor authentication and
that's it's a prebuilt policy here. Just come in and select it
and.
There you have it. Create policy and you're off and running with
that.
So.
I think that will do it for our MFA registration stuff, there
are conditional access policies.
I think I'm running out of time here.
So the thing to know with MFA is not all methods are equal. We
recommend the Authenticator app or something like a Fido 2 key
or something like that. SMS and voice calls are not not secure.
All of that stuff can be intercepted so.
I'll run through a quick demo on how to set.
The.
Uh type of MFA that your organization can require so that
that users can't select the.
Ohh unsecure methods.
Back into here for security.
In the syndication methods.
Nicator target all users and then we can go to configure and
so we can force them to use password, password lists
authentication. Basically it pops a number on the screen, you
get a notification on your phone and you have to enter that
number that's in front of you. You can also set a, set it to
tell you what application is being signed in to. When you do
that, and you can also have it send you a little map.
That shows you the geographic location of that.
So that's what I turned on there, and when a new user signs
into this environment, they would be forced to use those
methods and they could not choose SMS or anything else from
the list. Here that's all disabled anyway.
Umm. And then let's see.
Our bonus tip is that you can do company branding on the login
page. It defends against phishing. So if you notice when
I logged in here.
It had a brown background and a Purdue Global Icon. Let me see
if I can get it to work here.
From an in private session.
So you can do this from the Azure admin portal.
This customizes your login page and then you know what you're
logging into. So much of the phishing attacks use generic
Office 365 login pages, Microsoft branded Super Easy to
make, but it's gonna be a little harder for them to customize
what you log into. So if you set up something like this, you can.
You can help your users recognize if what they're
logging into is legit, and that can be done in the company
branding settings. Then here I'm not going to go through it in
the interest of time.
Anyway, you can come in here and set up your page background
color. You can set up a company logo, things like that so.
I apologize for running overtime quite a bit.
Sharing that is my Ted talk for the evening.
No worries. I was very interesting. Thank you.
Michael, Are you ready?
I am. Let me see if I can figure out how to share because I.
OK, it's the at the top bar next to the leave button, there's a
share with a box and a up arrow.
Yep, I've got that. So then I just gotta figure out how to
share.
Audio because I've got one slide that has a.
OK. And then just.
OK.
All right. Where it says share content next to that is include
computer sound. Just toggle that button. There you go.
There we go. Got it.
Is select the screen.
Can you all see my screen?
Yep.
All right, I'll set this to presentation mode. So it's a
little bit easier.
Yeah, that should be nice and easy for everybody to see.
All right. My talk tonight is about security technical
implementation guides.
And.
I'm currently getting a lot of involvement in in this at my
current job, but my memory of this goes all the way back to
2016 when I was deployed to Kuwait with the army.
In the army offered a boot camp for.
They are local university there that offered boot camps for
studying for security plus examination and in the middle of
that class I had an AHA moment that I realized that I probably
didn't get the best instructor and here's why.
The instructor was rolling through. We had this big book of
slides and these flipping them on his book as he's going
through the slides and he says security tech stigs you should
know what stigs are. And I asked them. I said, well, what are
stigs? And he said a Stig is a security technical
implementation guide. You really should know those for the exam.
And he went on to the next topic. And I was like, wait a
minute. You're teaching a whole bunch of DDOD people because it
was all either active duty military or military contractors
or military civilians that were taking this boot camp.
Any gloss right over it. So ever since that point.
The idea of Stigs have stuck in my head and currently right now
I'm going through these with my job and it's important that the
we should know these.
And what we're doing that exposed to me me to this at work
is we're going through what's called a command cyber readiness
inspection and it's actually taking us about a year to
prepare and I'll cover some of that.
But we're we're getting so in depth that we have weekly update
or status update calls and everything that's going on
there. There's a great deal of information that goes on, but
I'm just gonna give a cursory thing discussion over this. It's
actually led to some finger pointing because you get
different departments covering different checklists, there's
several dozen different checklists that break down into
different categories. I'm working on what's called the
traditional security checklist.
So between myself and one of my subordinate organizations like
no, that's your department. Well, wait a minute. Your
security. Do you have it? Your security in this falls under
your network. So we have to work through a lot of things.
And we're also having what's called staff assistance visits.
So we just had somebody from the army refers to it as G6
basically our IT department. So we had somebody from I worked
for the core of engineers and we had somebody from the I what's
called the Gio G6 IT department come and actually visit with us
for three days to cover just the traditional security checklist
which is 148 items. So it took them almost three days to go
through 148 items.
And this week, any of you that have been involved in the DoD
space, I'm sure you've heard of Sipper, which is the secure
Internet Protocol router system.
The rest of our IT department is actually going through a sipper
Security Assistance visit this week and we've got several of
these going between now and next. I think it's April or May
that we have our inspection, so a lot going on.
Next slide and.
What are stigs that they're requirements that are derivative
of the NIST 800-53?
There's three major categories.
CAT1 cat two or three a cat, one finding will result in the loss
of authority to operate.
So in our example, we're very concerned about that because we
have both.
The standard protocol nipper.
And we have our supper.
Protocol. If we lose our authority to operate, we won't
be able to do any of our classified work that we do and
and it's important that we keep that going. You lose your
authority to operate. You can't do anything at all to you. Fix
that. And it's not an easy process to get new authority to
operate.
A cat two finding has the potential for unauthorized
access and a cat three is recommendations that improve
your information assurance awareness.
Our process forgive you get a little bit of a dry throat here.
Been a long day.
In cat one weaknesses they should receive the highest
priority for correction and mitigation. Typically a cat one
weakness must be corrected before you can get your
authority to operate. Will be granted, but in our case we
already have that authority, but we don't wanna lose it.
And during a recent SAV, we actually only had one cat, one
finding, and it's relatively minor and fixable.
This collection presents the analysis with compliance
information from Stig audits that have been conducted within
the environment. Data is presented on the number of
stigs.
And.
Presents a pass or fail, and I'm going to show you some of the
tools that we can have to track this these items as you go
through because like I said, the they're pretty lengthy.
So again, stigs can be broken down in to approximately 20
different domains. Some of the major categories are network
infrastructure operating systems. As I mentioned before,
I do traditional security.
So I'm doing like antiterrorism physical security.
Uh, they controls of that nature. So that's my wheelhouse
there.
But if you were to count them up there, a thousands of individual
stakes.
What I'm showing you here on the right side of this slide is
what's called Stig Viewer. That's a publicly available
website that the average public can go look at it. If you wanna
use stigs even for a.
Civilian organization and I'll give that an A resources page at
the end if anybody wants the address for that. But you can
actually go through and find out what the stigs are and when you
click on each one of those links that you see there.
You could look at the description and what's called
the check fix. The check fix will deter tell you the steps
you need to do to ensure that you're in compliance with that
particular Stig.
This slide here is what's called the traditional Stig viewer.
This is what the government, the Department of Defense, is used
for years you'll see over here on the left hand part of the
slide is the pie chart and this is representative of this is
just generic, but all the green and the pie chart means that.
The stigs for this particular checklist and you can see it. I
don't know if you can see it on your side, but it says sources.
And gives the.
Name a list that you're working.
And in the center column. Here we received all those Greens.
The NF that you see there stands for not a finding. So somebody's
gone through here on this particular program and marked it
as not a finding, meaning they're in compliance.
You see up near the top, where the O is. That means it's open.
It hasn't been reviewed yet and then this example doesn't show
up at the red portion of the pie chart means that there's a
problem with those particular stakes. So in this example, you
can see where.
There's still room for improvement as you go through
your stakes and off to the right, you'll see it. How The
Stig is actually written.
It shows the rule title. A discussion of what they're
looking for and the important part is down here near the
bottom, where I've got this arrow, the check text and the
fix text, and on each Stig you have a fixed text and that tells
you the steps you need to do in order to.
Make sure that your compliance with that stick, the one thing
that I don't like about The Stig viewer is that it works on a
proprietary file system. So if I'm working on, say, a portion
of my traditional security checklist, and then I'm going to
send it to somebody else in my department, I have to send them
the file. Then they have to upload the file in their Stig
viewer, so it makes version control real problem.
But what we found in our office.
Is a new program called the Stigma Manager platform. This is
an open source program, but in order to access the network that
runs on it, you do have to have a what's called a common access
card in order to get through this so you won't be able to use
this unless you're somewhere within the Department of
Defense.
But I do have a video that shows some of what goes on here, so
hopefully me playing the video here will work and I'll please
let me know if the video works and here we go.
This video is an overview of stigma manager and open source
project from the Naval Undersea Warfare Centre Division,
Newport, whose champion is Jason Benda. I'm Carl Smigelski from
SAIC and I'm the lead developer of the project. The project is
also supported by my colleague Christopher Daley from Wright
Solutions in Middletown, RI.
Stigma manager is software for organizations that want to
collaboratively manage Stig assessments, which are often
performed in the context of steps three and four of the NIST
risk management framework. Stage Manager offers a single source
of truth about assets, stags and their current assessment status.
That's important to evaluators, managers, package reviewers,
issues and Q's, and even to automated tools. All
stakeholders can reference an act on the same set of data
stigma manager includes.
The web-based user interface with multiple workspaces. There
are workspaces for organizing and performing Stig evaluations,
a workspace for approving those evaluations, for reporting in
step five of the RMF, also workspaces for analyzing
evaluation progress and reporting on findings in emass
poems.
The web interface is what most end users work with, but stick
manager also provides a complete application programming
interface or API that enables system administrators and
developers to interact with stigma manager data in their own
programs. The remainder of this video will be a guided tour of
the web interface, which is an example of a client that
consumes the stage manager API.
Before we begin, let's take a quick review of stage manager
terminology and concepts, tag managers primary organizational
structure is the collection. A collection contains a group of
assets. The entities which are to be evaluated, each asset in a
collection has one or more Stig checklists attached to it. Each
checklist might have dozens and sometimes hundreds of individual
checks to evaluate, often requiring combined input from
multiple evaluators and from automated tools. Stigmata.
You're supports this collaboration by allowing
collection owners to grant other users access to the collections
assets and stags. For example, Alice might be granted access to
all Linux assets in a collection, while Bob's Access
might be limited to the Windows 10 Stig attached to each of his
teams workstations.
That's enough background for us to start the tour. We'll pause
the presentation here to check for questions and then proceed.
So as you can see, that's a pretty good overview of.
The Stig manager and I really like it because we're using it
in. It's a one source, so it's web-based. I go in and I work on
my portion of the checklist and somebody else can see the work
that I've done and it's not like the other one, the stick manager
where we have or I'm sorry, this Stig viewer where we have to
send files to each other. So I really like this and it's
actually speeding up our progress as we prepare for our
inspection next year.
This video is an overview.
And here I'm kind of breaking down again. What the stakes look
like this time just in state manager.
I when you're viewing it, it shows you the.
Kind of like a spreadsheet format where you can just see
the rule title, the check. Hopefully everybody can read
those. If not, you know if anybody wants these slides, I
can share them with you.
The fix and the discussion in generally like when we just had
our staff assistance, visit the inspector just simply said it
says to do X. Did you do X? If yes, you're good to go. If not,
it's a finding and I'm gonna write it up. It was that that
strict.
Here's another view within stigma manager. Again, I wanna
highlight over here to the right the fix.
This is the important thing that as we go through and you manage
stick stigs, whether you're doing it for AD, DoD, or you
wanna look at your organization and emulate what NIST is calling
for in these different areas.
Uh.
For example, here it tells you ensure the humidity controls
have been installed in information technology areas,
computer rooms to protect personnel and equipment
operation as follows. And it gives you specific information
on humidity ratings, control systems, that sort of stuff.
Uh, and you'll see. I do. The blue arrow here, so you can see
that this is a cat 3. This is minor, but when you click on it
in stigma manager, it pops up over here and you can see what
you need to do. And then when you scroll this scroll bar in
the right down it allows you to make notes and make changes to
the system.
Another tool that's available within Stig manager, what's
called the Security Content Automation Protocol and what
this does is it will send out.
Forgive me, I forget the correct technical term, but it it'll
send out or seek out your endpoint equipment, your
desktops, you whatever you have and it will look to see if
that's in compliance with the particular Stig that you're
working on so that you don't have to go to each particular
desktop machine or whatnot. So you've got one, you send out the
message and it sends a report back that out of your 50
machines, 48 of them meet The Stig, but these two.
IP addresses don't, so then you only have to go and look at
those two.
And that's the extent of my presentation. I do have it
marked his questions, but I'm gonna leave the resources marked
there if anybody wanted to see the this very bottom.
Web address that I have HTTPS stigviewer.com and I thought I
had another one but yeah stigviewer.com/stigs. That's the
pub.
Oops, I think your mic cut out.
There you are.
Are you kidding me? I've been. I've been talking through all
these slides and didn't know.
No, no, I didn't hear all the slides. It was just that little
section right there.
OK, I I must accidentally bumped it cause I looked down and saw
that my mic was muted there at the end.
Yeah.
Yep.
I I would have. I would have let you know beforehand.
OK. So that's all that I have.
Alright, thank you and thanks to all of our present presenters
Yep.
tonight. If you guys have any questions, now is the time to
ask. Robin did have to leave early because she had class. So
if you have questions for Lauren Wyatt or Michael.
Please let them know or please ask them because I'm sure they
would be happy to answer them.
Michael, how did you not pull your hair out without his stick
Further.
stuff cause?
You seem so calm about it, and I'm like, I will be going crazy.
Well, what? What I didn't say is that in some of our weekly
meetings, there's been a whole lot of finger pointing, yelling
and screaming. Not my yob. Yeah, it is your job. Go do it. You
know, or somebody taking the bull by the horns. But there are
literally thousands of stigs that we have to go through. So
it's a long, lengthy process. And if anybody ever has to go
through such a procedure, we started this back in June. We
were originally told our inspection date would be
October. Nick moved to April of next year and we're thankful
that we've got that extra time.
Yeah, it was interesting because I know that.
Uh.
I just uh, I just drew a blank date.
Nate was trying to get us to fall the NIST model on a project
for, you know, a quantum teaming project. So yeah, I I liked a
lot of those steps and seeing it all laid out.
And and you should jump.
But no, no, glad we don't have to do that though. Thank you.
Being honest.
That would be for the project manager.
Did you do all that?
Also, for those interested, I fixed my demo that broke so just
for the record.
Yay. I'm proud of you for not saying James an academic words
then that that didn't work.
Yeah.
I did. I did have a academic related question for Wyatt when
you were talking about the different.
Ohh was it the different access?
The access policies.
OK, think of. Yeah. What made you or what would make a company
do the NFA registration policy? Like, I thought that was really
interesting. All jokes aside, cause I'm like that.
Let me cut this.
Only me, myself real quick.
So.
Umm we we implement it so that if somebody for some reason say
a hacker in.
In China, Russia and gets access to somebody's account. They
could then register their own multi factor authentication
device on the account and then they could they could approve
their own access into the system. And so by by blocking
MFA registration from off Prem from the head, the the companies
IP address, even if they were to get in somehow with the
password, they could not add their own device and then
continue to exist within the network so.
That's that's why we do it.
We haven't ever had it hit, but it's possible if if somebody's
password or something was was to get leaked or something like
that, or device lost or something, something along those
lines.
Umm, that would prevent them from from persisting within the
environment.
No, not definitely. Get that. I was sorry. I was trying. I
thought my radio was coming through on the recording. I
didn't wanna have some silly song playing.
Ohh but.
Is that something? So you saying that's something that you do at
your organization for? Is this something that you were talking
about in, in theory like this is what you would want to do? Cause
I've never heard of an organization doing that
specifically and I'm just curious, are there attacks that
are?
And that like and I'm not keeping track of cyber security
attacks quite yet. To be honest, I'm still on the academic
mindset of things, but are there attacks that are being seen
where the hacker is trying to do MFA authentication now with
credentials stolen credentials?
Oh, oh, absolutely.
Wow, OK.
So we it, it is in practice that that rule is in practice at my
place of business and we've implemented that.
It it works, it's easier, works better and it's easier to manage
for a small organization. I'm a big company, is gonna have a
hard time with that just because there are people are gonna be so
spread out. But if you can, if you can narrow that down, if you
have a smaller organization that it's easy to implement and it's
it catches a lot of things.
If I can't even get their foot in the door, then that's a
that's a huge win.
Yeah, that was interesting.
They they just keep on getting smarter and smarter. These
hackers, unfortunately.
Yeah, there's always something new that they come up with.
Yeah, it's.
Alright.
Go ahead, Jane.
Sorry, one other sort of add on to that because I'm thinking
like a when you say a big organization, it's harder for
them to implement that. I'm wondering if.
I don't wanna say where I work at, cause now we talking about
cybersecurity related stuff, but my company that I work for, I
wonder if that's why they do a lot of the now. You can't have a
VPN if it's.
Ohh I'd what is it? I think it's like the VPN can't be outside of
the United States, like you can't have a a IP address or
something like that outside of the United States. And then we
still do MFA like when we log in and authenticate. I think it's
through the Microsoft type of programs and stuff like that
that we use, but even even outside of Microsoft, we have
like this SSO type of thing and then it's a MFA app or whatever
on our phone, but.
And has never heard the back end of that. So that was interesting
that you were talking about. There is a access policy that's
designed around that.
Yeah, you could certain that that could certainly be what
they're doing, is blocking access from outside the United
States. That's that's another rule that we have implemented
all of our people are in the US.
We we block incoming traffic from anywhere except for the
United States and most.
Most attacks come from overseas.
So at it, by default blocks a lot of that traffic.
So.
No.
Right. Does anybody else have any questions from her white or
Michael?
Lauren and Robin had to drop.
Change done.
Alright. Well with that I will close out this meeting. Thank
you to our presenters, Robin, Lauren, Wyatt and Michael. We
learned a lot as always and everybody have a good day. Make
sure if you haven't signed up to present yet that you do so
before you graduate.
And yeah, have.
A great rest of your evening.
Thanks everybody. Great job.
Letter.