Hello everyone.
Welcome to master class.
To night, February 9th, 2023.
Uh, we have 4 presenters this evening.
Should be a nice busy one.
But they have some great things that they're going to talk
about.
Uh, Michael affranchi.
Going to talk about security risks for autonomous vehicles
and AI.
David Haslam is going to talk about investigative techniques
for forensic cybersecurity. Von Eric Young. We'll talk about
virtualization and Evan Dix. We'll talk about load balancing.
So should be interesting.
Let's see.
All right, Michael, Are you ready?
Uh, yeah, yeah. I just gotta share my screen, right?
That's right.
Alright, let's see here.
Take it away from me.
Alrighty.
Alright. Can everyone see my PowerPoint?
Yes.
Alright, I'll I chose to do my master class on a project that
I'm working on outside of school. I'm actually writing a
book and I decided to write this book a while back when I started
getting ideas after learning a lot about autonomous AI and how
we are incorporating it into our vehicles and our traffic
network. And I kind of playing along the lines of an adventure
novel, I kind of started writing it and I got through a few
chapters, but then I realized.
I really need to focus on some of the technical things, so I
twisted this around into a research project and I really
decided after a while that I could turn it into a master
class as well because it has so much in-depth information, so
this is kind of an overview of what I've been researching and
how it ties into the book. So let's get started.
Right research regarding the cybersecurity fiction novel that
I'm writing.
We're gonna talk about AI, autonomous vehicles and cell
phone tower connections.
So today's interconnected, technological driven, automated
world has given birth to the ideal that a fully autonomous
vehicles are possible in our late lifetime.
To achieve these sent to the chieve, these sensors AI, radar,
satellite cell towers and a whole myriad of other
technologies have to work together.
All these systems are connected to form a large vulnerability
surface area with many access points to consider.
The possibility of overtaking a vehicle systems for malicious
intent should be paramounts when designing these systems.
And it got me thinking. What if?
What if someone was to take advantage of this in the future?
How do we lock it down? How do we secure it?
My book as Technologies connect to the world, the risk rises for
hackers to design ways to utilize these systems.
The novel centers around a semi retired cyber security and
programming employee.
The poor guys forced into retirement from his organization
due to a security flaw that he found in the technology AI that
he made.
And other organizations are big into controlling the
intellectual property that they have, and sometimes people are
forced to write out of the company because of mistakes.
The flaw allows for a hacker or any malicious user to gain
access to all vehicles and gain control of them under certain
circumstances. Keep in mind this is in the future.
Basis of the story relies on a switch over to manual controls
of vehicles being security flawed and not being able to.
Imagine if you would being in an onion fully autonomous vehicle
and somebody taking it over and not allowing you to get out of
it.
Think of the movie speed, but in the future when you can't even
get out of your own vehicle.
The goal?
The goal of this research project was to develop accurate
and modern situations for the novel.
To research the technology used for these types of environments.
And to research, autonomous and AI is automatic vehicles.
Let's get going here.
Artificial intelligence.
Transportation is actually already relying on AI for trains
and is working to make aircraft more intelligent and automated.
Machine learning and algorithms in these examples are contained
into the areas in which they operate.
For example, if you don't see someone publicly driving a train
down the road and a lot of people don't fly the plane that
they're on when they're going from A to B.
So when using AI to help machine learning and algorithms in these
examples.
They're contained in these environments that the public
can't access.
The vehicles that we have on the road, on the other hand, are
used freely by billions of people every day, all over the
place.
These bullets that were driving down the road are controlled by
US, and if we were to hand those over to technology, the
technology has to be secure and reliable.
Research shows that one technology is being utilized for
study that relies on heat signatures to determine object
and environment.
The objects in this example by the author colocar they identify
as drivable, non drivable living things, vehicles, roadside
objects and far objects.
Another great example of a technology that we can use is
explainable, artificial intelligence. XA I I don't know
if anyone has heard of this yet. It's being developed by DARPA.
It is the direction a I will need to go in for safety.
This system, in a nutshell helps to correct any errors in the
output that ought to. Automotive systems may generate.
These systems are one modify original data, two input each.
Modify data or images that are being received into a model.
Derive the output at step three and at step four, compare the
output to determine the proper course of action.
The future will use quantum computing in the situation to
calculate these outcomes in the lightning quick environment of
driving.
In basic terms, XAI will allow AI to analyze the content of an
environment and assess accordingly. For example, a ball
and a squirrel are the same size.
Tell the system to don't stop because there's a squirrel. Slow
down based on the speed and avoid the small adjustment if
necessary. Stop for the ball. There's a kid running to get it.
These are the different examples that the AI would have to face.
AI will also need to make to be able to ethically make
decisions.
Pushing the parameters of cybersecurity and safety to new
limits.
Code for AI algorithms and machine learning will not only
need to be impeccably precise, but will also need to be
properly configured. If the considerations of not just the
passengers but the surrounding environment.
That environment will need to be altered to help the AI system to
control decision making.
This will mean massive infrastructure changes to allow
for the AI to a be able to operate within safety
parameters, laws and policy.
So how does this translate to the book that I'm writing?
Well, this story does take place in the future. AI fully
autonomous traffic network, or a FAT N.
Will be utilized on specific roads and surfaces that are
designed specifically for the system.
This story does take place in a city that is being tested. The
entire city is being tested for the system.
Roads are specially built with specific features that the AI
system will utilize for driving.
The AI program will rely on 3 deep learning machine programs.
In the book, one is based on the moral machine.
One is based on the XAI method of determining safety and one on
the regulatory approach designed by Australian scientists to make
decisions based on sensor algorithms.
The security flaw in the program is based on the backup systems
that the automobiles will rely on. The systems connect to the
AI support that the automobiles rely on as onboard computers
will be too expensive to process, although by then, who
knows.
Another flaw that will end up being part of the downfall of
the story.
The flaw will dump command to vehicles less intuitive control
systems that are not powerful enough to complete the normal AI
modes.
The system will hand over control will will only hand over
control to the user or the driver when an emergency is
declared if backup systems.
Do not.
Let's move on to autonomous vehicles.
Today we already have partially autonomous vehicles. I'm sure
that everyone has at some point.
If you've driven a brand new vehicle, experienced that in
some formal way.
Right now the SAE classifies 6 levels of autonomous driving.
Level 0 was for cars that are not autonomous at all.
Levels 1/2 and three in the blue.
Sorry, level 01 and two in blue.
Have the driver engage in the actual driving and the
automotion is assisting the driver.
This is kind of what we see today in our cars.
Levels four and five in green have the driver not really
driving that much in at all, especially level 5.
Fully autonomous vehicles end up in level 5 where.
The feature can drive the vehicle under all conditions.
This is where using AI algorithms will help keep
drivers and passengers safe and pedestrians around them.
Security with autonomous vehicles.
Legal registration and the automotive information sharing
and Analysis Center is not enough to reach SAE level four
or five. The future of these autonomous vehicles is dependent
on many things beyond acceptance of the masses.
Legal registration would need to be enacted to a now the to allow
for the trusted technology being used to ensure safety for
pedestrians.
From 2017, 2019, the 115th Congress could not even come to
an agreement on the Autonomous Vehicle Act.
The focus was that the legislation should contain more
content relating to the cybersecurity threats that
surround autonomous vehicles.
Driver data will need to be protected in the situations
including input images, sensor data locations, insurance owners
or occupants, crash testing, and anything else that can be used
to think about when you're driving down the road.
If the camera is in your car, maintaining the visual
appearance of your face to make sure you're saying you're
staying on the road, it's taking pictures of you and those are
being uploaded to big data.
As it stands, we currently need legislation to protect the data
from hackers.
Right now, as of 2021, cars have up to 150 million lines of code
in them, with one to three defects per 1000 lines.
The number of software defects from 2005 to 2010 and further on
to 2015 has gone up.
You and regulations 115 and 116 dictate that vehicle
cybersecurity should be designed into vehicles from the beginning
of stages of development. They should be able to understand
cyber attacks and cyber security should be tested throughout the
lifetime of the vehicle.
How does this translate to my story?
Well, in the future the security of autonomous driving systems is
locked down as a computer would be, or even stronger.
Security risks and code code is thoroughly inspected at the
highest security levels in the book.
It's checked using modern print statements, error handling,
debugging tools, tests and AI tools like Tensor Watch.
Systems are updated live prior to the vehicle shut down.
However, quantum computing, remember, this is deep into the
future and 7G just guessing because we're at 5G now. Speeds
allow this to happen blindingly fast.
All sensors and systems and cameras are protected on an
internal automotive system.
Standards are set by the Auto Isaac protect data and
information with data sensors monitoring and the ground up
approach to cybersecurity surrounds vehicle autonomous
systems.
Main characters world.
Which is the entire city. They'll have fully autonomous
level 5 vehicles that drive themselves. The infrastructure
will be changed in a way that all rural parts and in the city
will be paved in a similar fashion. Yet different
approaches to traffic patterns are utilized.
Agreed upon sensors, signals, signs, indicators and other
traffic tools will be installed and utilized. These Rd utilities
will allow for automated vehicles to track along. Think
of how you see a stop sign now your car will pick up on
different signs along the side of the road telling them where
they are, how far they're going. This is in case GPS can't track
it. It's almost like a backup system.
The main character will be working for a corrupt
organization that cornered the market for these vehicles and
the API that supports them. However, the AI is sold to other
current manufacturers too.
Years of infrastructure changes and approvals.
Along with modernizing existing vehicles to keep up, have taken
place already.
The cell phone tower security in this story is a minor part of it
right now. Cell phone towers rely on base transceiver
stations. This is a universal thing, no matter whether it's on
GSM, UMTS or LTE.
These stations rely on a power source, whether it's in the
building or it's attached to a January substation, to the
transmitter. Renewable energy can be used here as well, such
as solar.
However, these are very much at risk. For example, certain
vendors.
And they're software. For example, Legba incorporated over
millions of ranges and multiple places are already vulnerable at
different levels. Attackers can take advantage of the devices
built in features by sending UDP packets to certain management
ports, specifically 57157. Oh one and 5702. This allows the
attacker to take control of the BTS station, removing
information from passing data, making changes to the GSM
traffic, or crash the entire station.
How does this translate to my story?
Well in the novel.
Connection is lost. Some satellites from the vehicles and
when it connection is lost, the AI support is lost.
The vehicle will rely on a redundant measurement and
connect to cell towers in the city that will provide the AI
support temporarily while cell phone towers are vulnerable in
many areas, the story will focus on a more basic vulnerability,
the power connecting connection for each station that our
powered for, the powered by a subsidiary of the automotive
company that develops the cars. Hackers will place a time bomb
devices in those to shut down the cell towers, rendering the
vehicles and the AI on usable.
Before we finish, let's discuss ethics real quick. This is a
fictional story. All the theoretical hacker methods are
real. The ethics of bringing level 5 autonomous vehicles to
the forefront of reality are ethically challenging as the
moral machine has taught us the reality of how to judge real
world decisions in the blink of an eye are challenging.
Crash optimizing will require targeting in situations where
there is no other choice. Grandma or child motorcycle or
SUV protect passengers or protective past pedestrians.
Which one will the system choose?
Futures like this one proposed have to have strict regulations
on where these roads are, speed limits, or in the areas and
who's allowed to drive manual vehicles in this situation.
We are still in a technological adolescence for autonomous
vehicles.
Bringing this story together.
The plot.
Our story finds the main character struggling.
The city is where the AI fully autonomous traffic network is
being utilized fully before national and global launch. The
character development aside, let's look at how the hackers
group attacks.
In their first stage, like any hacker, enumeration for all
information for the hijacking is done.
This stage will not be truly revealed until later on in the
story. However, it is it is revealed that like many cyber
incidents, it's done by the inside individuals to the
company.
In the second stage.
Pay offs internal tax to set up time bombs in each of the cell
towers. They have payload code developed at saddle to
satellites to cut off signals to the cars via a broadcast signal
intrusion. Set up a same time bomb schedule.
Satellite interruption is only to stop the signal, not to steal
traffic across the satellite signals.
In the third stage, satellites are cut off. Automobiles cannot
connect to the cell towers, and right before the cell towers
shut down, a polymorphic virus is transmitted, so all the
vehicles throughout the back door and the automotive
software, the cell tower is shut down and the virus cuts off
emergency controls to the drivers lock doors and commits
them to driving on an average of 40 miles in a random routes.
The fourth stage starts. Hijackers demand ransom to
release the users. The speed increases every five mph for 30
minutes at a time. Cell towers can be fixed individually, but
if certain cars stop, others will crash into them.
This is where the story plot I'm revealing will end.
There is a twist though.
These hijackers are just a front.
The traffic being held hostage allows for routes across the
city to be controlled, allowing for different crimes to be
committed. Can anyone guess what it is? How will the main
character know what to do?
Bonus by the way, I have not decided on a main character name
and I'm 2 chapters in.
I pretty much had every time this guy talks just a symbol. An
asterisk isn't the book I really have to replace it and the ideas
e-mail me with a good name if you have it. Anyway, that's my
basis for the story and I still have to do a lot of research to
really dial in a lot of the technical stuff throughout the
book.
As it is, uh as it is right now, so don't have a title for it,
but I'm a few chapters in and a lot of work to go so.
That's why I'm master class. And thank you everybody for
listening.
I do have references here, by the way. If anyone would like to
see them.
A great job, Michael. Excellent. You know that that really puts a
damper on my wanting to buy a Tesla.
You could still buy a Tesla.
Makes you rethink that one.
You could still buy a Tesla. That's fine.
Hey and and another thing.
A great character name would be Nathan name for sure.
There you go.
Ah, come on.
You know.
We'll just put those names out there.
I see where you're going with that. I see where you're going
with that. No, but this this. This was a love of Labor in
Hey.
labor, of love for me. And I had been doing a lot of thinking
about it. And I'm really gonna try to get this novel finished
in the next year or so.
So. So thank you everybody for listen.
And when you do.
I wanna copy.
Ohh everyone's gonna get one.
Signed copy.
Yes, yes.
Assign copy.
That's right.
Got it.
Yeah, great job. Great job.
Thank you. Thank you.
Yeah, great job.
Awesome.
So now we have. Yep, David, investigative techniques for
David, you're up next, right?
forensic cybersecurity.
Everybody hear me OK?
Yes.
Yep.
Awesome, yeah.
During.
Are you on mute, David? We can't hear you.
No, I'm still here. I think it froze. Let's see.
Gotcha.
Yeah, there we go.
It was not honest there. My computer. I'm not sure why.
You wanna pop out and pop back in again?
Yeah. Give me just one second.
Marjorie popped out, didn't.
Yes. Yeah.
The showing anything at this point.
Not yet.
There we go.
How about now?
Ah.
Yes, I see your calendar.
There has been made.
Perfect. Can you see this one?
Yes.
Yep.
OK, awesome.
Umm, so like Marjorie said, I'm gonna be doing mine on
investigative techniques for forensics cybersecurity.
I think that.
You know, hearing from professionals that are in the
field Arthas super important. And So what we're first gonna
hear from is an individual that has done his time within the
forensic field and he's gonna share a quick story of how he
investigated an issue that was going on within some businesses.
And so I'll kind of let him take it away for here for a few
minutes.
Everybody here that OK?
Oh, not yet.
Have that.
No, still no sound.
There's no sound.
Umm.
During your share, do you have it set to use your system audio?
Maria.
You didn't know.
Give company go to a competitor.
There you go.
There you go. Particular case, this guy didn't return key to an
investigation. So I wanna share just a quick example with your
case that I worked on recently. Some of you may be familiar with
this type of scenario. We have a guy who works at a company and
he decides to leave the company, go to a competitor.
Now, in this particular case, this guy didn't return the
computer hit well his work computer to his original company
until one week after he left.
Which raises suspicion.
So he sent his computer back. The original company had it
forensically analyzed, and they found two things. The first
thing.
Is that?
The laptop had thousands of deleted work related files on
there, which is not a good start.
The second thing that they found was that the there was an
external hard drive plugged in just two days before the laptop
was returned, and through their analysis of the linked file to
jump lists and the myus, they were able to determine that
there were quite a few files on this USB hard drive that
shouldn't have been there. Files which had the same names and the
personally dates and times as those found on the deleted files
found in the laptop.
So they obviously went very happy and and I apologize for
the language.
So they went very happy about this. They got a lawyer involved
and they sent a request back to this guy and they they asked we
we want this external hard drive. So the guy obliged, he
sent it back and further analysis was done.
And the analyst found that.
Called. Unfortunately, every single one of those deleted
files from the laptop existed on this external hard drive, so
this was a bit problematic.
And what they.
No.
That the conclusion they came to after they spoke to their
employees at this guy was not very technically adept. OK.
He was not.
An everyday computer user, people said he can do his e-mail
search the web, do some spreadsheet stuff, but that was
it.
So the most interesting thing about this external hard drive
was not that all these files existed on there, but the
timestamps associated with.
The created time was preserved.
At the time of copy.
This this event happened in December of last year.
And.
If you refer back to your fans poster, you'll see that file
copying or drag and drop preserves only one timestamp,
the last written time. But in this case the last written time
and the creation time are both preserved. So.
Given that this guy was not hugely into computing and these
dates and times have been preserved, the forensic analyst
made a bit of a conclusion.
And that is that in the week that he had this laptop, he took
it into his new place of work.
They had an IT person at this company.
Load up some specialist copying software.
Copied those files onto the external hard drive, deleted
those files, and then sent the laptop back.
Interesting hypothesis. So.
They did after they got the results of this analysis, they
sent notes to to the, to the, to the new company, and they
they're basically, they added them to the list of defendants.
Not happy at all of with this scenario. So what do they do?
Well, they went and hired a forensic analyst of their own
and that's where I come in.
And so I took a look at the external hard drive to start
with, and I saw pretty much the same thing as the other guy that
all the created and last written times were exactly as they were
found on the deleted files. So potentially, yeah. I mean, you
could say that specialist forensic specialist copying
software was used here, but then if it was, why only half the
times preserved, why not the other half?
Maybe some settings, maybe not. Well, let's have a look.
So I went and looked at the file name attributes.
And they were all exactly the same.
And they all reflected the time that this transfer of data took
place.
So now I've got 8 Mac times to look at.
So I went back to my trustee sans poster.
And knowing that the last written and the creative time
were preserved for all of the other dates and times were
updated, we could narrow this down potentially to a volume
file, move now to questions from this.
What's a volume file move and why potentially? Well volume
file move really, really straightforward and simple. It's
you have a window open over here for OneDrive.
You you you're right. Click select, cut. You go over to
another drive you right click and select paste.
That simple. It's a cut and paste OK now.
If that's the case, then all this stuff about the the
specialist copying software is all in the heads, and that's
what we want to prove now.
Why potentially? Well, we've only looked at half of the
evidence. We've looked at the external hard drive, so let's
take a look at the laptop well.
If this is a cut and paste.
The key thing that we're going to look at here is we want to
see that a cut is gonna delete the files and the exact same
time that they're copied to the external hard drive.
So.
We want to find out when those files were deleted. Now here's
the here's the rub is that file deletion and people always say
this isn't true. File deletion is not recorded in the MFT. OK,
the time that the file is deleted, you will not find the
Max times.
And I get people anyway, I posted this the other day and I
got like a flood of emails and this is not true. It's not true.
It's true. OK, just deal with it so.
So we want to look somewhere where we're gonna get these file
deletion times from. So we're stepping out of the MFT for just
a moment. And we're gonna look at the USN journal. And so here
we've got all the stuff from the file name attributes, all the
dates and times, and we want to make sure that for each file,
each and every single one of these thousands of files, that
when it appeared on the USB hard drive is the exact same time
that it was deleted from the laptop. And because I'm standing
up here talking about this, you probably already figured out.
They matched up perfectly, so we now went from our our hunch that
this was a a cut and paste to it was definitely a cut and paste.
So we went and we also looked for evidence of the specialist
copying software being used. And as you may well have guessed,
there was nothing.
So we went back to the court. We said, look, this is the evidence
we have. The court agreed the opposition was forced to concede
and they removed my client from the list of defendants. So they
were very, very happy about this.
So.
The one thing that I just want to touch on quickly.
Is that?
Frequently, when we do investigations we we we find one
thing and it sets us on course now.
Good investigators will alter course when they see more
evidence.
I'm not gonna say bad investigators because it happens
to everyone, but probably less experienced investigators will
not cause correct when they see evidence which contradicts what
they believe.
It it's so important that we let the evidence speak for itself
and that we just become the mouthpiece.
We can't let our own.
Our own agendas affect what we put in our reports.
So that that's the end of that, that.
Alright, so as we heard from this gentleman, you know there's
a lot that goes into analyzing and determining what actually
happened during an event and that's what an event forensic
investigator is required to do this to find all of those
different steps all the way until they can come up with a
firm solid conclusion based off of what the evidence is showing.
This is the same type of investigation process that goes
not only from the forensic side of cyber security.
But through almost every investigative process, through
law enforcement or FBI or anything else like that, it's
all just about the same. So.
As we go through here, there we go.
So the first thing that I wanna do is kind of go over the
different.
Situations that you might run into as a forensics analyst as
we go through these different ones, I want you to kind of
think of the different.
Cash that are created from these analytics analysis.
And what kind of?
They all have to do within each other.
So there's different processes that you're doing, right?
Because network forensics or whatever other.
The things that you'll be doing as a forensic analyst.
But it's almost the same thing each time the same steps, the
same processes. It's just maybe doing things a little bit
differently. So the first one that I wanted to touch base on
is with network forensics. So network forensics involve
collection, preservation, analysis and presentation of
network data for the purpose of investigating and preventing
network based cyber attacks.
Umm, it's a critical component that it's a response. The
digital forensics and could be used to identify the source,
nature and scope of security incidents.
To do that, they go through these few steps, so data
collection. This involves capturing and preserving network
traffic and other relevant data such as log file system images
and configuration files. Data analysis involves analyzing and
collecting data to identify patterns, anomalies, malicious
activity. This could be done manually or through specialized
tools such as network protocol analyzers and so on. Evidence
preservation. This includes preserving the collected data
and any relevant information and.
That would be admissible in court. So as we heard from this
individual before going to court to kind of a big deal.
It's something that you will, as a forensic analyst, that's
probably gonna be your end. End goal is to end up in court in
front of a judge.
And so in order to make sure that you know what you're
talking about, you need to report everything that happens.
So this involves documenting the findings of the investigation,
providing a detailed report on the incident, including
recommendations for preventing similar incidents in the future.
If you're working for a company giving them those, this is what
happened. This is why our network got hit. And this is how
we can fix it. It's gonna be a big step on that.
Network forensics can be used to investigate a wide range of
cyber attacks, including Dos attacks, man in the middle,
attacks, the advanced and advanced persistent threats.
And that can also it costs me used to identify and track the
activities of malicious actors such as hackers and
cybercriminals. It's worth mentioning that in order to have
a successful network forensics investigation, it's important to
have a well defined incident response plan and have a
dedicated team of experts that can handle the collection,
preservation, analysis of the data collected.
Then the next one that we're gonna go over, it's malware
analysis. So malware, malware analysis is the process of
dissecting and examining malware samples to understand how they
work, what they do and where they came from, how almost feel
like. This is like the biology of tech.
And so the goal of malware analysis is to identify the
malwares, behavior, capabilities and potential vulnerabilities
which can be used to improve security measures and protect
against future attacks. The process of malware analysis is
had as we go here. First one is obtainment, so you need to get
the malware. Obviously you can run a honeypot to lure it in.
You can capture it as it's translates to the network static
analysis at that point is the process.
Analyzing the malware without executing it, so this is code
review examining the malwares code structure and other
characteristics of identified the functionality, communication
patterns and potential vulnerabilities.
This is a big step on what they found out was Wannacry.
After they stood up a domain and it called back to that domain
and actually completely terminated. Wanna cry? They went
back and looked through its code and determined that that's what.
And and that inevitably, it stopped. Wanna cry from wiping
through the entire world?
So then dynamics analysis that's actually turning it on and
observing its behavior and see what it creates, files that
modifies what network connections it tries to
stablish, which is why wanna cry was doing it, was calling back
to that domain.
And then reverse engineering it, taking apart understanding how
it works and just assembling its binary code analyzing assembly
code.
And then going back to the reporting right, so that we need
to document all the findings of the analysis, including the
knowledge, behavior, capabilities and potential
vulnerabilities. Once it's complete, you can improve
security measures because now you understand what that malware
is trying to do and how it gets in. That's one of the nice
things about the honey pot is that you can create essentially
a trap that it can, it will weave through your network and
then you can see how it runs through your network.
Then you can block it because you understand all of that type
of stuff. One of the big things to to get out of this is
whenever you're working with malware, make sure it's on a
closed network and within a closed environment. A lab based
environment to make sure that you don't spread it further.
Like wanna cry that one was bad one.
Alright, so log analysis. So this is the logs that could be
created within a network.
Such as firewalls, intrusion detection systems and web
servers to investigate security incidents logged out of provide
valuable information about security related events such as
successful and failed login attempt, network activity and
system changes.
First, we need to collect all that data, right?
And so gathering log data from various systems and devices,
such as servers, network devices and security devices.
Data normalization. This includes converting the logged
data into a standard format so that way you can actually
analyze it using systems such as Elasticsearch logarithm, Splunk,
Arcsight key radar and RSA Security Analytics. It's how you
can do that. This involves data analysis.
Examine the logged data to identify pattern to nominally
suspicious activity.
You can use specialized software for that as well correlation.
This involves combining logged data from different sources to
build a comprehensive picture of the incident. This step allows
for the identification of potential malicious activity
that might have been missed by looking at the other. Just an
isolation and then reporting always going back to that
reporting right. This involves documenting the findings
something now so some providing a detailed report the incident
including recommendations for preventing similar incidents in
the future.
Log analysis can be used to investigate wide ranges of
security incidents such as network intrusions, data
breaches, insider threats, it costs. We used to identify and
track activities of malicious actors.
Alright, memory forensics. We'll go through this one quickly. But
this is analyzing the computers, RAM, identifying investigative
security incidents.
So acquisition, right, this includes capturing a snapshot of
computers memory which be done by specialized software tools
such as memory dump years or by physically removing the memory
modules from the computer.
Memory now analysis is includes analyzing the memory dump to
identify patterns, anomalies which is activity. It's being
done manually or with the aid of specialized software tools, and
then evidence preservation. This includes preserving the memory
dump and any relevant information in the manner that
you misspell in court. You don't want that RAM to just dump all
that information out.
And so you need to to keep it. It's where you can actually
analyze it and then reporting again, right. So memory friends
can be investigated. A wide range of security incidents such
as malaria, malware infections, data breaches and etcetera.
Alright, investigative technique. So we've gone through
all of these different things to kind of show you this is how
they're used in the world world now getting down to the
commonalities between all of those different situations. So
as you can tell, there's a lot of commonalities.
You need to have a good response team to search and seizure
evidence collection. Securing the evidence, got acquisition
and data analysis, assessing and documentation, and then expert
witnesses.
Alright, this is a kind of a flow chart of what a normal
response team would look like for an incident. These teams are
highly trained individuals who work together to gather,
determine what is what is and isn't evidence to a cyber
attack. One of the things that I wanna really focus on here is
that, as you can see, the forensics team is right in
between the infosec and the legal team.
So they understand somebody who's a good investigator.
And really understands both sides of of the house. They
understand how to gather all the data and how to do all the
infosec side of things like the other side of it, they
understand what legal issues can come about from gathering that
information. While legal issues can come about with
documentation, the processes that are required for it and how
they're going to give that to a judge.
Umm, in the later date?
So if there's anybody out there that's looking to be a forensic
analysis.
I'm friendly analysis test. Wow.
Just know that you will probably end up in court at some point
and sit in front of a judge.
Alright, so search and seizure this is the task of making sure
that everything that is determined is evidence is
gathered and legally seized. This legality comes from the 4th
amendment with the United States, the team of forensic
cybersecurity specialists wanna get information that is not from
their client? Then they need to obtain search warrants and we're
closely with the police.
This also includes determining what devices, logs, or code that
will need to be handled and determine where the evidence
could be.
A lot of forensics and analysts work with police departments.
There's inside of many states. There's forensics teams that go
out with police to analyze computers, analyze hard drives,
do all of that stuff. I actually have a buddy that recently was
on a case that they had to deal with a lot of computer crime
issues. And so the state sent out the forensics team. They
drove up with this really cool big van.
And they just looked at the officers and we're like, hey,
bring us computers. And they started walking computers out.
They used their big van with all their huge text that's in there
and just started analyzing everything right there in the
driveway. And as they started gathering more and more
information, they were able to determine which devices it
wanted to keep and take their state lab, which ones were not
necessary, and then get all that put together. One of the big
things with this.
Just making sure that anything that's the fruit of the
poisonous tree as they call it with the mom enforcement doesn't
happen. So if you do one thing that isn't correct, anything
after that.
Will not be in this spot in court. So like an officer who
illegally searches a car, right? They don't get permission, they
don't have a warrant. Whatever. Anything that they find inside
of that vehicle is not in the school, in court. And so then
there becomes an issue. This can happen as well within forensics.
Cybersecurity.
So going to the evidence collection, this is where I had
the Purdue poisonous tree as well, making sure that the
evidence is collected and a clean matter if any of the
evidence that ends up in court, they'll need to have a key chain
of custody starting from the collection to court. This also
includes methods of evidence obtained, whether through
programs such as Splunk Sleuth Kit, celebrate UFD.
The program.
Umm, we'll need to collect the evidence without tampering with
it. So having a good log of this. We found this at this
House at this time period it was brought to the state lab. It was
put away. Whatever. This will, even in the private sector, this
is something that needs to be maintained due to like what he
was saying. Right. And and the gentleman that at the beginning
of this was saying that they had all of this information. But if
any of that was.
Change or there's any issues in that time period? Well then that
data is no longer good anymore. And so making sure that we
preserve that information and don't tamper with it as it goes
along and knowing who is dealing with it, which is that chain of
custody, right, because you might collect it in one month
and then two months later, you might be analyzing it, who had
it in that time period, where was it?
It goes back to our securing of the evidence, along with the
collection of the evidence needs to be secured and the chain of
customer needs to be followed, if any further analysis. If the
data happens and all that needs to be logged in case of
tampering, that could happen, all evidence should be secured
so that no one can access it without their access being
logged, whether digitally or physically. So we have here a
locker, right? Somebody has to log in and say I want this
device from this locker.
And so now there's a a log saying who had it at what time.
Alright, that is acquisition and data analysis. This goes hand in
hand when investigator received the data from either a device
for stored logs.
They need to ensure the data is not been altered in any way.
Subsequently, any analysis needs to be done without affecting the
evidence, but allows the identification and conversion of
the data to be used within court. Whether other proceedings
might follow.
It's nothing in documentation.
It's using the data brings you to a point where you can
determine what the data means and why it's important to the
case. As you find these correlations, they're gonna be
documented for future use. Documentation is key to the
investigation. If you have made great finds within your
analysis, but you can't document it well, then you've really done
nothing. There's something that they always told us in law
enforcement that if it wasn't written down, that never
happened. So document everything and make sure that.
What your experience is, is documented. Any analysis that
you find where you have it, what systems you use, everything
needs to be documented and written them.
And then the big one, right? The expert witness. So after you've
gathered all of that information, after you've done
all of the everything that you done, your full analysis.
Eventually, you're gonna have to tell somebody about it, whether
it be within your company saying, hey, we know that Billy
Joe was tampering with our network.
You know you need to be that expert witness to your company
to say, hey, This is why we think that this happened. This
is why this is the evidence that we have behind it, all of that,
or if you decide to go governmental side, you need to
be able to tell the judge what happened. And even with this guy
who.
Worked within a the private sector. He still ended up in
front of a judge saying here's our evidence that this is what's
going on. This is why I'm an expert on this material. Just
remember that imposter syndrome is very real.
You can believe that maybe. I don't know everything on this or
whatever else, but you're still the expert. If you did the
analysis.
So this is when you're called to proclaim to the world that you
found and the techniques that you used to do it eventually do
do it. And then so you'll be called to testify if there are
criminal or civil litigation to repair it, be prepared by
following the process and documenting everything really
well. So I just want to thank everybody for your time. If you
have any questions or anything like that, I'd be happy to
answer anything.
Hey, David. Excellent man. Excellent.
I I do have one question.
I I do have one question though.
Now, when you were a technical know, an expert witness.
1st.
And.
Do you need to be certified in the tools that you use to
collect that evidence in order to be an expert witness on the
stand?
We're not technically. It makes it more reliable, so especially
like if you're in like a jury trial or you're even just
talking to the judge and the judge is gonna make the
decision. Those kind of back up your knowledge.
And and the defense will probably work really hard to
make you sound dumb.
Yeah, discredited. I get that.
It's kind of their job and so if having those credentials behind
you help you to be like, no, I do know what I'm talking about
done this 1000 times. I have these credentials. However, you
can still be an expert in anything at any time inside of
court. So you can be an expert about any type of analysis that
you do, even if it's a system that you don't know as well, as
long as you're able to say this is how I did it. And this is how
it worked.
That's you're an expert at that point.
Go.
Got it. One more question before I let you go.
Do you? Well, do you inspect the original evidence or?
As an analyst, do you pull a copy of this evidence?
So I think that depends on what you're analyzing, right? Like
this individual here. If he had pulled a copy, there's potential
that things could have changed.
True.
There's things in the metadata that could be different.
Whatever else. And so I think it's really depends, depends on
what what you're doing like the RAM, right they you can pull
that information off of the ram and leave the room where it is.
Mm-hmm.
Or you can completely remove it and analyze it while it's still
on the RAM. And so there's different routes, different
methods. So I think it just depends on what you decide
within your analysis.
Yeah, that makes sense. Thank you, Sir. Thank you.
Von Eric Young is next, and he's gonna give us a little bit of
the insight on virtualization.
Von Eric, you're up, buddy.
Hello, can everyone hear me?
Yep.
Awesome. So.
My presentation may not be as exciting as a.
Automated cars and.
Incident testing.
But.
I did my best. Hold on. Let me.
Share my screen real quick.
Alright. Are you guys able to see?
Yes, Sir, we can.
Wow.
Give me one minute. One minute.
I'm not sure how to.
At the master slide.
Wasn't an actual.
How to get the masters?
I found it.
OK.
All right.
So what is the virtualization? Virtualization is a method of
operating computer technology within a sandbox environment.
And there is actually a lot of use cases for virtualization
that perhaps maybe.
You don't know about a lot of people look at virtualization as
like an enterprise thing, but there's definitely some things
you can do with virtualization at home.
They are much more scalable than using purely physical hardware
because you are not confined to a space limitations. So one of
the big advantages of virtualization is obviously you
can run multiple operating systems on one piece of
hardware.
So instead of, you know needing to separate all of your
different tasks, you can create many different virtual machines.
That have a lot of different use cases.
Umm. Virtualization gives computing many more
possibilities, because these virtual machines can be created
for a single task and they can also be discarded when you no
longer need them.
So what's? What are some of the advantages to virtualization?
There are many practical uses for virtualization. The biggest
one is obviously they create a sandboxed environment.
Umm, this doesn't necessarily have to be.
Something for enterprise to use.
It's also for research. They can be used for personal reasons for
use cybersecurity guys. A big thing in the field for
virtualization is malware testing, so you can spin up a
virtual machine.
You can throw some malware in it. You can see how that malware
interacts with Windows. You can see how it interacts with, you
know, Mac or Linux. You can see if the malware is even looking
to see if it's being run in a virtual machine and trying to
hide itself. So you can actually learn a bot, learn a lot.
About uh.
A malware by throwing it in a virtual machine.
In software development.
Umm, they have a practical use as well.
Umm, you can ensure a program can be run on a base machine
that you just installed like Windows for example, and make
sure it doesn't require any additional dependencies to run.
Umm this is important because you want the end user experience
to be as easy as possible. You want them to know if they need
to install additional.
Uh, software?
For a somewhat related.
A method I've been using for this entire internship is I'm
using a virtual machine to get everything done.
And this is because I use my personal machine. It has, you
know, it has emails it has.
Uh, I do music stuff by playing games on it and I don't want
those distractions when I'm working, so it kind of helps me
to still have the convenience of using my desk computer.
But I can access remote work.
Umm. Let's see. Efficient utilization of available
resources.
VM's offer a single machine the capacity to run multiple
operating systems at once. Each of these operating systems can
be scaled down South that the VMS don't use more resources
than they need.
Although you can also give them more resources because they're
only gonna use what they need kind of thing.
This allows you to save money on buying additional hardware per
client and server.
And as I said in the very beginning, it just helps with
physical space and cost. You don't have to buy multiple
pieces of hardware to run different operating systems and
do different things with them.
And then another big benefit of virtual machines.
If a VM fails for any reason at all, you can simply restore it.
If you've made proper backups, or like in my use cases, if I'm
just running a virtual machine for a single thing such as
desktop.
Umm, if a VM fails for whatever reason, if I break it doing
something, I can just reinstall a fresh operating system and
there's no downtime. Like if you if you have a hardware failure
then obviously that's a little more annoying to fix than you
know a VM failure. So that's a pretty nice about VMS.
So what are some of the disadvantages of virtualization?
Some workloads obviously will require powerful hardware.
And this also depends on how many virtual machines you're
running and what you're doing with them.
Virtualization isn't a magical bullet that fires out new
computers. They still require real hardware resources, so if
you're running a lot of virtual machines, you're obviously gonna
need a lot of CPU power. You're gonna need a lot of RAM, and in
some cases you might even need graphics processing.
Because of this, they are slower than machines running on bare
metal, especially type 2 hypervisors, which I'll get into
in the next slide.
And.
Finally, I guess this probably doesn't affect most of us here,
especially if we are familiar with operating systems and
networking.
But they're not always plug and play, especially if you're
running like a niche use case for virtual machine.
Umm, you may run into compatibility issues that only
affect certain hardwares and that can be annoying. It's
sometimes difficult to.
Determined that that is the case.
Umm.
And the pending on what you're doing, how nature issues are you
may you may be able to find forum help.
But you still can come into common problems such as
different hardware acting in different ways when you
virtualize. So sometimes there are some things that there is no
one size all solution.
The biggest recent example that comes to mind is trying to game
on virtual machines.
There's a lot of documentation about this, especially in Linux
gaming.
Umm, there's a robust community kind of trying to make gaming on
Linux viable, especially in VM's.
Because Linux Gaming is an up to part with Windows, a lot of
games aren't written for Linux. They're not even written with
Linux in mind, especially like older games.
And there's easily more failure stories than a success stories
in that case, which speaks to how virtualization is very
dependent on hardware and these niche kinds of scenarios.
All right, so types of virtualization.
We have Type 1 hypervisors which are kind of like your hardware
virtualization. These are your bare it's referred to as bare
metal because these kind of virtual machines run directly on
your machines hardware. So they'll directly use your
machine CPU.
Uh, they'll directly use your ram, your graphics card.
And these are generally a lot stronger than a Type 2
hypervisor because these actually run as a software
layer.
Umm common Type 2 hypervisors are quemu KVM, which is I
believe Linux only.
VMware player and workstation, uh. Work on TV. They work on
Windows and Linux.
And VirtualBox also work on Windows and Linux.
Umm Quemu is completely open source and for some people that
is a big deal.
VirtualBox is open source, but it has optional extensions that
are closed source and VMware as far as I was able to determine,
is completely closed source, but it is freeware, so you are free
to use it.
Without paying for a license, as long as you are not using it for
commercial use.
And on the slide you can see I just have a Windows 10 virtual
machine I was installing that and a Linux machine on the
right.
And.
I have a video presentation.
That's about 4 1/2 minutes long, and that'll be mostly yeah.
Please let me know if you guys have found.
Sorry for the graphical glitches.
Can you guys hear it?
Not yet.
OK.
It took a little bit for some audio, but if you guys can't
hear it I can just mute it and narrate it over it myself.
Yeah, we're still without sound.
So basically.
OK.
So basically in this video demonstration, I'm going to.
I've already installed Windows 10 and I've installed a Linux
distribution on the right.
And we are going to.
Open up a command prompt. We're gonna determine the IP address.
And then to end this demonstration, I will make sure
that the pings can see each other and they're set up on a
physical network.
So right now.
I just installed Windows 10.
And we're using VMware, so in VMware.
Myself, because that's a a little distracting.
So in VMware it's automatically configured to use Nat routing.
Umm, which is fine for internal stuff, it's.
For most cases, probably good enough.
But as you can see it's giving me.
A random IP address. That's not my network IP address. My
network IP address isn't one 92168.70, it's a one 92168.1.
And so I need to go into the upper left tab and hit player.
Configure virtual machine.
And then change the network adapter to bridged.
And also replicate a physical network connection state.
And also, since my computer is running in Ethernet.
I have to configure the adapter that VM Ware is going to use.
Umm, so it automatically defaulted to my Wi-Fi adapter.
But again, that's not what I want, so I have to click, uh.
The Ethernet.
Let's Fast forward a little bit here and then as a little bit of
a proof of concept I ran I IP config slash all again and you
can see now it is.
Connected to the physical network and it was assigned an
IP address for my router.
And this IP address is routable on my physical network.
And then I just did the same thing on my Linux distribution.
Again, sorry for these graphics.
Uh glitches.
So on Linux I ran IP space ADR for IP address and it shows
192.168 dot 1.137. So I know that that is a network address
for my physical network.
And then.
I just run Ping, make sure that they can see each other.
And as soon as I get the test, I know that they are physically
connected to my network and obviously there are additional
use cases where you might also need to change firewall settings
or change.
Uh, like antivirus settings, but a you know, for a simple
connecting to the network test the ping test was fine for the
demonstration.
Good job.
And then for the last slide.
Good job.
Thank you.
In conclusion.
We learned why virtualization can benefit the individual as
opposed to simply just being a tool for organizational use.
We learned a bit how different hardware and operating systems
can react differently on virtual machines, so they won't always
work and every scenario.
And we learn basic virtual networking with a popular
virtualization software which was VMware and that's it.
Question about that.
For your.
Alright, ship.
But normally on a host machine, I mean usually attackers use a
virtual machine to attack other networks and computer systems.
Where are you getting your storage from?
Umm.
Like you're page space and your.
Are you getting new sewage problem so?
So it depends. It differs a little bit depending on what
virtualization software you are using, but they all kind of
Let's say VM Ware VirtualBox.
operate in the same way.
One of those two? What are they using RAM? Or are they gonna use
I'm sorry.
your actual hard? You know your host.
Hard drive.
It's definitely using RAM for page space, but it can also.
No, actually.
I can boot up MIC help only me quick.
OK.
And actually I show you some of those settings. So VMware. The
reason I like to use it is it's really simple.
Yes, I can plug and play.
Stuff like Quemu is a lot more flexible, but it's also a lot
more advanced. It's a lot more hands on and the command line.
Being more as mostly a graphical tool, which is pretty nice.
So you can allocate a certain file size for your storage
space. So for my Windows 11 VM that I'm using for this
internship, I have a 60 GB file on my host computer that serves
Umm.
as that storage.
Dedicated. OK, I got you.
And UM.
Yeah. And then.
How how many cores you got running on?
You can create VMS that don't use storage at all.
I'm sorry, go ahead.
How many cores you got running on?
You got dedicated to your machines.
For this virtual machine I have eight course I believe.
OK.
See, you're running two systems at the same.
Yeah. So there are scalable you can.
Now you can pick 1 to 8 cores. I have 32 gigabytes of RAM on my
host machine. I have 16 dedicated for this virtual
machine when it's up.
Nice.
Which is obviously plenty.
And you just you you just do your school work and all that
stuff in here.
Yeah, like I said, the reason I like virtualizing for like
You're doing it.
school and like a remote work and stuff as it just it gives me
Umm.
like a non distracting environment.
Right. Because I just have what I'm using for this internship on
Gotcha.
my like you can see on the left side only have like time clock
stuff shortcuts. I'm actually routing my mic through
networking so you guys can hear it just so I don't have to
unplug my mic into the virtual machine every time I spend it up
and then unplug it every time I turn it. Turn it off because it
gets annoying.
Nice.
Yeah, I got a billion virtual machines. Actually. We got a few
flavors. If you wanna take a look in our in our environment,
we we have a few flavors that I've dropped in. I think it's in
SharePoint. I'll take a look at that. And when I find them, I
will send you a link.
Awesome. I'd be interested in looking at that.
There's a few fun ones.
Yeah, we got a couple of calendar.
Yeah, virtualization is.
It's nice. Yeah, nice and convenient.
Virtualization is kind of one of those topics I learned about in
college that, like, really interested me and sorry if I
keep stepping on you. Like I said, I'm a routing my audio to
my virtual machine for you guys can hear it so that there's a
bit of delay when I actually talk and when you guys hear it
Ohh.
so.
No, don't worry about it. We're good.
Yeah. I apologize for that.
Nope. We're in good shape.
Well, thank you, Sir.
Alright, but uh?
Learned a lot.
Yeah. Thank you. That's my presentation.
Alright, who's next? Let's see here.
Von Eric, that's you, right?
Sorry guys.
Found Eric. You just went. Evan, you're up next.
Evan's going to give us a a taste of load balancing.
Let us know what load balancing is all about.
And anybody working in the cloud, anybody networking, this
is gonna be a good topic.
Yeah, thanks, Nate. Can you guys hear me OK?
Yep.
Alright, perfect and good and share my screen here.
So load balancing is my topic.
And give you a quick introduction here. Uh, what is
load balancing?
Most commonly, it'll act as a, you know a reverse proxy, and it
can distribute, you know client requests between more than one
server.
Umm.
And you know reverse proxy coming in, the client will
request you know it could be a web application through the
Internet you know HTTPS and it's gonna hit your load balancer
before it hits your servers.
And.
You know, it does some cool things there for security and
availability. So it's pretty common.
Implementation. And Umm, you know, corporations, government
agencies and things like that because they like to keep their
their sites online.
Umm. And that kind of ties into?
Why load balancing?
You know, if you if you're.
Secure if you have a security background, one of the first
things that they kind of teach us is the the CIA triad.
You know that there's the confidentiality, not integrity,
and then there's availability which.
I I would you know, personally I think it probably doesn't get
the most attention, but it's also very important aspect of
security and.
You know.
Load balancing.
Really enhances the availability of our application or a
resource.
Umm.
And it can deliver the content.
To the end user in a way that also supports you know server
health.
Umm, if there's an influx of users and there's only one
server.
You know, bad things can happen. Pages can freeze, servers can
crash, and depending on the importance of that application
can be very drastic impact on an organization's reputation,
finances, et cetera.
Umm, so implementing load balancing?
Can distribute these requests to more than one server.
In a way that you know is predefined and can ensure that
the servers.
Remain in a healthy state and online.
Umm.
As kind of mentioned the the subject of my presentation will
be F5. There's also some cloud load balancing which I'm not as
you know familiar with.
But five does some really cool stuff. They're kind of an
industry leader in load balancing.
Umm. And these are three of the common ways that you can
distribute the requests round Robin, which is, you know, the
one that I'm most familiar with and what I've seen it's, you
know, you have 3 servers. It'll just kind of go around and and
around and around there's no.
Other characteristics or determining factors other than
just, you know, kind of a random fashion that it'll distribute
the request, but there's also least connections, say server as
1000 connections, Server B is 100.
And then I go to browse the page, it's gonna send me the
server be.
And then there's also least response time checking to see
the the response time and the server.
And it kind of in UM, as you would imagine, you know,
shortest response time would probably send you there first.
All that kind of ties back into server health keeping
applications online.
And keeping the end users happy and the you know the company or
organization or agency happy.
UM.
And there are some free resources out there.
White free and you know, trials. So I would say, but I didn't pay
any money to set this up.
Umm.
And if you're interested in setting up something like this
to experiment with load balancing.
You could reach out to me and I could provide you with those
resources that I used, but what we are using for the lab.
Umm, so you know F5 big IP.
Development.
Umm. License.
Not using the most up to date version, but it's not exposed.
You know, gonna add a great deal so.
That should be fine and then it kind of ties into von Eric's
presentation.
We're actually using both Workstation and ESXI and.
Umm.
You might wonder why it doesn't make sense a whole lot off the
the sound of it to use 2 hypervisors.
But it's because I did all of this on my kind of personal
computer.
And I obviously I have Windows installed so I can't just throw
on ESXI.
Without.
Really adjusting things. So I just, you know.
But most easiest approach was to install workstation as a Type 2
and then on top of that you install ESX. I kind of nested
virtualization.
And that lets you kind of simulate a more of a production
environment. You know, where the SX I would be right on a server.
And on top of that, you could have you know your 5 installed,
you know your your, your servers and things like that.
We're also using, you know, a trial version of Windows 10.
And then training servers and these are actually provided by
A5.
And so this was the basically the topology, the layout.
Umm, I'm not going to go too in-depth here, but it does show
you how.
Uh, you know, this would be my cost system. Then we got
workstation installed.
This is my.
Land. And then we got.
Yes, I saw. I installed and that's where the magic happens.
We got we have F5 bridged.
On on, on, on the management network.
This this is your window Windows 10 virtual machine installed
inside of VSTS. I which also has a 2.
You know Ethernet adapters.
Good.
Put a.
Abridged IP there that we can RDP into it and then it also has
a.
Second network so it can communicate.
With the F5 itself.
Through a virtual switch in Esxi.
Umm.
Down here we have another virtual switch which kind of
these two switches is kind of the the key here. We have an
external network.
Which would kind of simulate, you know, the public. And then
we got our internal network and they're separated.
To get to in your resource on the internal network, it needs
to go through F5.
And that is the kind of reverse proxy we talked about. UM, I'll
go ahead and move on.
And I do have a demonstration later, but just wanted to go
over a few topics before we dive in there.
F5 has virtual servers and that is the servers are going to
live.
On the external network.
You know, and you can kind of.
Give those as an IP address based on the self IP which is
the VLAN.
Umm.
So you'll see here that my IP is 1010 one 100 corresponds to, you
know yourself IP here.
And you could have really been any.
Anything that at least it's 1010, you know.
And you know, it probably looks foreign to you guys. Just focus
up here in this spot. You know, we just had a source address,
which is at the zeros, meaning in anything can access it.
Umm.
Destination.
Where's that going to?
Umm, that's, you know what the end user would type into their
browser.
Ideally you'd have DNS involved and give him a host name, but
just for the lab we kept it as that I didn't deal with any
certificates.
It would have really complicated things, so I just kept it as
HTTP and we can go ahead and move on. That's the virtual
server pretty much. Give it a destination and give it a port
and you're good.
UM.
In its virtual server, because this is built on the F5, I could
build 100 of these. You know they're not necessarily real
servers, but they kind of behave as one, and now each server,
each virtual server needs a pool.
A pool of real servers. You know, things that the traffic is
being serviced by. These training servers were provided
by F5.
Again, if you're interested in any of this, I can point you in
the right direction. This is basically, you know, another
virtual appliance that I imported in Esxi and just really
low maintenance really didn't have to interact with it other
than typing in these IP addresses when I was adding the
nodes.
UM.
So you know you have your virtual servers, you have your
pool, and it's good for.
You know IT, administrators and.
Come at 5 admins to be able to.
Quickly identify if a node is online, because this is kind of
where that availability comes from. If we see anything going
on with the status here.
We can, you know.
Remediate that before it becomes an issue.
And we do that through the use of health monitors inside of the
pool.
For this example I used in HTTP health monitor.
Most commonly that I use at TC, you know on at work we would use
a TCP, but I went ahead and did HTTP here.
And you can do a different ones that will meet your needs and
just kind of summarize how it's determining the health. You
know, with the HTTP request, it'll send a git over there with
the version specified by, you know, the FBI documentation and
standards.
Doesn't send a whole lot other than Git.
To the host.
Which would be the server IP here and if it gets a good 200
response back it gives you a green light there.
Or there TCP. You know, if you're have that an IT
background, you might be familiar with a 3 way handshake.
It's a little bit better of a way to make sure that those
nodes are responding.
But if the health is good and everything's configured
correctly with the networking and that kind of initial
configurations, the hardest part, which that's usually done
by.
Umm, you know, it's usually already set up for a year. Just
kind of maintaining applications on there, but once you do set up
an application.
You'll be able to see that traffic and this is being
presented by the nodes.
From our virtual server, this is a virtual server.
Umm.
And I do have a little demonstration. I recorded it.
Because I have the two two virtual machines on my computer
while I was presenting, I went ahead and recorded it in advance
because it is resource intensive.
Umm.
Here we go.
There's no audio.
But as you can see here, here's ESXI. We've got my servers, my
Windows 10, my F5 big IP.
You can see the management network there. We went ahead and
browsed to that one 92168.1 dot 131 and there's the virtual
server we're talking about.
And it's pretty slow.
But it'll come up here and just a second kind of. See those
characteristics I've showed you source, destination and port.
Usually it'd be HTTPS and you'd have a cert on there.
And then if you go to resources, you can actually see the the
pool assigned.
And if you go to your pools, you can view that pool.
And you can see your health monitor that was applied and you
can view the members.
Check the status, say no one was online offline. You probably
want to investigate that.
For 80 again.
And if you remember the Windows 10, it was actually connected to
our external network which was on the.
The side that you know our virtual server is going to
reside on based on the cell IP.
Or the VLAN.
And get rid of the developer tools and you can see this. And
as you you might recall the round Robin.
That we mentioned as you refresh you'll see here.
You know, server one is presenting or HTML server from
server to it says.
Again server 2.
Then it's 3.
Server.
Little discrepancy there, but you the main thing is you can
see you know says HTML serve from server then it's three. The
main thing I just wanted you guys to get out of that is that
the server that's servicing you that traffic changes based on
the round Robin fashion.
And I can actually force these these nodes offline. Let's say
these are vulnerable to security. You know, need a
security patch. You can force those offline. Let the server
admins do what they need to do.
UM, and that's kind of where that redundancy goes through or
let's say you know, it's someone's first day and they
messed up on the server, takes it offline. You know, you still
have one going on and that application is you can see we'll
still work. Granted just on one server.
So that's where that availability comes in.
Especially in a corporate environment, there's a lot of
updates on servers. People are always, you know, patches are
always getting installed, especially if it's windows and.
Sometimes these can really break things and take things offline,
so it's good to have redundancy whenever possible, and for some
reason if you get really unlucky, you're gonna have a bad
day. But if all servers go down.
You'll kind of see that.
Umm, you know our health health monitors are checking not able
to establish that HTTP connection or get that 200
response and you'll see that red and that's not not a good thing
unless you.
Don't need that site anymore and then if you try to refresh.
You're going to be able to lock.
And that's basically.
What I wanted to show you.
I'll take it back there.
Umm.
You know, it's basically at if you guys have any questions, you
can feel free to reach out to me if you'd like to set this up
yourself, you can.
Send me a message and I'll provide you with the the
resources that I use to do that.
Umm but.
Does anyone have any questions? I know it's a little late.
Evan, I got a question for you now this load balancing when it
Uh-huh.
comes to cloud, you know like say for instance our
Yeah.
environment.
What? Uh.
I mean on a scale here we're talking like let's say for
instance, you know our server goes down, what happens.
Yeah. So if if your server goes down, you know if you're using a
cloud resource it I'm getting you know would be something
similar. There's gonna be other, you know, especially if it's
Yeah.
Like a load balancer.
your.
Yeah, it's it's just gonna.
When when F5 is gets it request from you, it's checking to see
the health of these these servers and that's kind of why
you install those health monitors.
Umm.
So if it's on A5 or you know AWS, I'm sure has some load
balancing or Azure I'm sure has some form. They're all gonna be
Yeah.
fundamentally the same. It's gonna be checking and having the
status of each server. If obviously the servers.
Still in the pool and offline, there's a chance it could serve
it. You know that to you.
Umm, but based on your configurations typically it
would just send you to a good server and that way you would
never notice anything and that's kind of the goal there.
Yeah, and and that is the goal, especially with cloud computing
Uh-huh.
too. The redundancy is we have load balancers, something
Yeah.
happens on one server, it's gonna jump us to another and we
wouldn't even know it as an end user. Another good thing about
Yeah.
load balancing is.
Nate can't pull a denial of service attack anymore.
Exactly.
I can't. I can't flood sink flood. You know I can't do any
of that stuff.
So that's just off the table.
So that's a good thing too.
Uh-huh. Yeah, it's a.
Yeah, good job on that job on that. Hey, make this available
in the chat. Could you please or could you put it together and
Yeah.
throw me an e-mail?
I might make this a project in the near future.
You know.
Would you like my PowerPoint and the training materials that I
used?
That a work.
Sounds great. I'll send that to you. Thank you.
Thank you, Sir.
I guess before we take off, I'd like to thank everybody for
their presentations.
Absolutely marvelous job, everyone.
One thing that I do want to.
Von Eric.
I have 3.
OS is that I can give you. I got one that's called.
Who next and exactly what I said? Who next? I have another
one that's called tails.
OK. And then I have a remux which is kind of like a Linux.
Emulator OK who next is very light, OK.
It's a very light security OS alright, so you can virtualize
that pretty good. It's only like 2 gigabytes big tails is a
operating system that operates on top of your existing
operating system. Man, you don't have to virtualize this. Put it
on the USB.
And throw it onto your computer wherever you go public place.
Put it in. Guess what, when you remove that USB, everything goes
with it. There's no temporary store to files. Forensics can't
do anything because nothing's there on that host machine.
True story, but I'll have that out.
Yeah. I'll sit it out to you.
OK. Or or I'll put it in the chat later on. OK. So just kind
of keep an eye on that.
David, for you. Forensics. OK, now when we're talking.
When we're talking the evidence.
Most cases you're not. You're not allowed to examine the
original.
In most cases.
OK and.
When you can't examine the original, what tools would you
be able to use? And there's a lot of good tools out there, and
I'm sure David, you got a bunch for us.
Think of autopsy.
Or F disk.
These applications can pull an entire computer system.
OK. And all the information on it with almost 100% integrity.
Meaning you could possibly show this in court as evidence.
Really, you're going to show the original in court, but you're
going to analyze this so you don't F up the original.
Alright guys, great job tonight. Any questions, concerns or
issues before we call the meeting?
All right.
Goodnight. God bless guys.
Have a good night guys.
Goodnight, everyone. Did very good job.
Thank you.
Is that sharlene?
Hey, Nate, long time I haven't. I I thought I heard your voice
Hey.
earlier and I was like, is that Nate? I haven't heard you for no
long time.
Ohh my goodness, we have to get together sometime this week or
so or next week.
I know well, I'm doing the same thing every day. I mean, I'm
home.
Doing my, you know, work and stuff, but I'm not working uh
per se.
Umm, because my contract ended, so I'm basically just, you know,
doing school work.
Going back to school for the masters.
Yeah, I'm just finishing up the internship. I already did. The
courses cause the last time I ended the my my schooling was
because my husband died.
Ohh no.
Yeah. So he passed. And so I couldn't deal with school plus
taking care of all the stuff I need to take care of. So I
stopped for a five months in between there.
I see. And now you're back.
Yeah, I'm just trying to finish up so I can at least say I
Umm.
finish, you know.
Are you going to hang around afterwards?
After what? In this in this chat or in this?
No, no, no, no, hang, hang around, GITA, come back.
Ohh yeah, I would like to. I would like to cause I really
missed it.
UM.
I don't know I.
Will you see a lot of new faces now?
Oh, I know. And I like how things are going like in
planner. How you guys all changed it, which is better a
lot better than it was.
Oh yeah, and you see, we got a lot of stuff going on too, and
I know I can't wait till you don't really dig into things,
you have.
but.
It's certified if you can, because we got a lot of
certification information out there and.
Yeah, I noticed that.
Yeah. Yeah. Well, good to see you. Well, good to hear from you
Yeah. Nice to see you too.
too. Yeah, and I'm probably.
Yeah you will.
You're in cyber, right? Still.
Yes, I'm in cyber and I'm trying to think of a topic to present
and master class. Those like, I don't know. There's so many
Are you gonna?
topics.
I'd grab a tool, a tool that you're super familiar with.
Uh-huh.
And demonstrate it.
Yeah, that would be good.
Yeah, everybody thinks Cyber is like magic anyway, so if you
just pick a tool that no one's really kind of seen or heard
before you ever heard of.
Uh-huh.
Uh, it's called W3AF.
Yeah, I heard of it.
You know how to use it.
No, not really.
It's kind of like a it's a command line based, but it it
just it does the testing quick now it doesn't look good.
Ohh really?
Uh-huh.
But you know with, with being in cyber, you can explain what's
going on with that. You know with the the terminal commands.
Ah.
So it's going to, it's gonna test your system for
vulnerabilities. Now you know you got Nessus and all these
other you know ones that will report like you know give you
some readable report that you can give to the executive level
like qualis or or qualis or something like that right and
Nessus.
Uh-huh.
Yeah. Now those aside, OK? Because you know the setup on
that and you know, trying to get the reports to look right and
all that which you know that that the reports are
automatically generated. So that's not a big thing, but this
Right.
this W3AF, it's so quick to use like you can you could probably
do the presentation in 1520 minutes.
Oh really?
How quick it is? Yeah, you'll do more explaining than actually a
configuring the the application, yeah.
Ah.
Take a gander at.
OK.
Yeah, but even if it, if that's not the one I I would think that
maybe demonstrating a security tool would be nice.
Should be two. Yeah, I should know some, huh?
Yep.
Ohh yeah.
Oh yeah.
Yeah, well, this last one that we did was financial based, you
know, financial designs or whatever it's called. I forgot.
But anyway that one was kind of started off really good because
it was based on math.
And I like that, but the only thing is we never had any X.
You know it.
Demonstrations on how they're actually it works, or you know
how you make a decision on your financial decisions based on
that.
Umm.
Ah, so are you gonna be using, like a a project management tool
like Power BI or Tableau to gather that information and to a
well a viewer friendly?
Yeah, I don't know. Because you know, I.
Reason.
I I can see how the tool could work, but then I didn't have any
other tools to go with it. You know, they didn't really explain
how you can use that.
In anything.
Uh.
So, like real life case scenario.
You know, it's sort of like cut short, huh?
I see I like a real life case scenario. It would. They were
Yeah.
kind of.
They didn't have any real life case scenarios, but we had to
explain some. So we, you know, searched for, you know, other
websites where they use a case scenario but not.
I know it was lacking because we never discussed it in in our
seminars. We never really actually put it into practice.
I mean, it would have been nicer if we had something to to
Umm.
actually see how it works, because we don't know how. I
don't know how it works. I mean, I know how to put in a plug in
the numbers if you give it to me, but I don't know where you
get those numbers.
I see.
You know.
Yeah, I don't know. I have to decide what I wanna use because
I see.
that one I I don't feel that competent about it only because
I don't know how it works. But is there any website I can go to
that would help me with that part of it?
Now see one thing you could do is go to the source.
Ah.
OK, whoever is the creator of this.
Uh.
You go to the source.
OK.
Yep, and that's your best bet is going to the source to see how
Besson.
OK.
it's done, yeah.
Ah, OK.
Yep.
I'll go do some research, but no guarantees, but I don't know.
We'll see what happens, but.
When's your master class?
Ohh not until March.
Shoot, you got time.
I got plenty of time, but you know.
I like to, you know, get.
You know, work on it now rather than later.
Oh, I got you there. I got you there. Proactive and reactive.
Yeah, cause.
Umm.
You know, let's say.
Yeah, but then, you know, when I first came in to this, UM, the
internship. Now I couldn't do any of my uploading files to
the, you know, the intern weekly status report thing.
Did they change that?
Because you know that that form they change, so it's not at all
like the old way we were doing it.
Right, right. Actually, we were trying to we we added to that
Yeah.
status report because we wanted to take away another areas.
Umm.
For what we were thinking is is you guys have to report too
much.
OK, per.
Oh.
You know, you already got your assignments that you gotta do on
the academic side. OK, you know, maybe filling out a journal on a
Umm.
weekly basis, you have to upload a status report and then on top
of that, you have to do what was that other thing that we had you
You know those boxes where we had to put what our tax was and
guys?
Yeah.
you know wouldn't started when we ended it? You know, it was
Umm.
Yep, screenshots of your time, that kind of thing.
like.
Yeah, screenshots of the time, yeah.
Yeah. And see, so we made we put all of that information into the
status report, so we could just take some of the time off you
Umm.
guys to work to do stuff not so good.
Ohh I saw that I yeah, I did see that. But then when we when you
guys redid that for some reason myself and this other fellow, we
came back. So they gave us our same e-mail.
Yeah.
Your own. Yep, that's Marcia. No, no.
And yeah, and then that one wasn't working with uploads
cause we tried to do that time on detailed time report and it
No.
wouldn't upload. That was like ah, So what I did was just so I
didn't lose my information. I put it in the old form anyway
and got rid of some, you know, got rid of the boxes and
whatnot.
And so just like in right down, you know, answered the questions
on the form, the new form.
Umm.
So I had it on the old form because I changed the form to
the the new form.
You know, with the right, the same questions and stuff like
that.
I see.
Yeah. So that that's why I did only because, you know, I didn't
know what to do. And I was like, I hate not being able to turn
in, but so I didn't turn it in. If I told my, you know.
Your instructor.
Supervisor or. Yeah, my uh, whatever. Whoever you wanna call
Oh yeah, yeah.
OK, you're.
them professor or Doctor Jerry? Yeah, it's kind of funny, but
Yeah.
anyway, but.
That's how you have as Jerry.
Yeah. Doctor Jerry. She's really nice.
She is nice and I believe she. She's gonna be helping us out at
Yeah.
the internship too.
We're hoping.
Ohh, I did see. Uh-huh.
Teaching staff.
In every department.
Oh.
Oh, good, good, good.
And then you know on top of professionals too, you know and
Uh-huh.
those that wanna come back and help too. But you know that
teaching staff will be kind of like the bridge between internal
Ah.
Purdue. You know what you guys do on the academic side and what
Umm.
we do on the the PGIP T side, OK kind of get those guys together
Yeah, the experiential side.
because you know years before we we didn't know what you guys
were doing.
Right, right. Uh.
You know.
And it's like, uh, we were making you guys do big projects
when your class was making you do big projects too. So why
Umm.
don't we just do big project or two big projects and have it
count for both areas. So we did a lot of that too.
Oh, good, good, good. Yeah, that makes it better that way. So
So OK.
It's easier.
then, you know, the interns don't feel so undulated.
It can.
Yeah. Yeah, you.
Because I know we had some of those that happen earlier on
when I was there. And UM, yeah.
Yeah.
Yeah, well, good talking to you.
Cool.
Nice talking to you too, you know.
And and.
I'm not sure if you're still at your old phone number, but you
know I thought about calling you a couple times, but I figured
you were busy working.
Ohh yeah, I will I work during the day, so I mean.
I know that's why I didn't call you.
But.
My my old phone number, which I had forever and ever and ever I
don't have anymore. I've changed.
Oh, OK. I'll get rid of it then, yeah.
Yes. So I think I have a. My phone number should be listed on
my e-mail.
OK, so you should be able to get it from there or I can get you
right here. And the message here.
It's.
Well, I'll. I'll send it to you privately. I don't want
everybody to.
Yeah. No. Yeah. Don't put it in public was like, well, you could
just.
Yeah, I'll just teams it to you.
Yeah.
OK, well, you know, I'm not sure if you have my new phone number
either. Let me look.
And see what I have.
Go ahead and give it to me. I got my.
Cool.
OK.
My phone number is 515 area code 4994999.
You say 99.
Yeah. So a lot of lines and 44994999.
Alright.
Oh, there you are.
I'll answer hold on.
Hello.
You got my number there.
OK, got it.
Yep.
We'll good deal. You call me anytime you need to call me and
we'll keep in touch.
And you're in the cyber department, right?
Yes, I am. This time I meet this time I made sure I was in cyber
How's Daniel and?
area.
Well, remember last time? Yeah, but the last time I was in the
How's Sean and Daniel?
internship, I ended up being in IT support because I didn't know
which way to go. And I didn't know how to choice. But then I
realized I should be doing cyber stuff and I wasn't, which I felt
that was kind of bad thing I did. But I did. I was able to
help the IT support and, you know, took on some management
leadership.
So I did gain confidence in that part of it. So it's not all bad,
but then I didn't get to do, I didn't. I wasn't able to do any
of the cyber stuff too much.
You know, you know, I was under you in the cybersecurity
department. You remember?
I know. Yes, I do. Remember after uh, Doc, well, after Doc,
The sides.
you know, appointed me for cyber because there were she was
wanting me to go with a Peach governance.
Ohh GRC.
Yeah, because then it was. She felt that we were, UM, you know,
cyber at that time was going the wrong, wrong direction. She
didn't want us going, you know.
What was his name again? Bobby or something like that. But he
was a mess. That Bobby guy, he was a military.
Yeah, I was Bobby. He was kind of, yeah.
Had a baby? Yeah, he just didn't really care much.
Yeah, which is kinda unfortunate. And so I think
that's why she got me in there instead. And then, you know, we
sort of like.
And then the.
The big move came and here we are today and you see what you
You know.
spread in cybersecurity. When you go into that cybersecurity
Yeah.
department, you just start to smile because so much energy in
there. I mean, the cybersecurity department, since you took over.
Mm-hmm.
And then when you were gone, I took over.
Yeah, which is great.
And then we really.
That's a lot of things happen after that, yeah.
Really kicked it up, but when you took over, things started
moving. You know, we were like, OK, we need to start bringing
Mm-hmm.
demonstrations in. We're start making it more fun. And we did.
Umm.
And a lot more people, that's all they want with cybersecurity
because of you. So thank you for that.
Uh, you're welcome anytime.
Yep.
For for.
We all work together, Nate. I mean, you know, we're A-Team.
So.
If we are quantum teaming, quantum teaming.
Yep, definitely and kind of felt bad about Doc though.
Yeah, that was a sad day.
Yeah, because the last time I got to talk to her was in May of
222022.
I talked to her. Maybe.
A month before that.
And I had been calling our regularly and we would just
shoot the ****. I mean, one thing that about Doc is the way
that she could put words together and.
Hmm. Ohh yes.
All you into the conversation, no matter what it was, but she
Umm.
would she. She had the ability to draw you in, and all it was
we kind of felt like it was just you and you and her.
Mm-hmm.
That no other distractions were around.
Right, right.
And she can make you see things that normally you wouldn't be
thinking or or even looking to to to look at, you know, to to
Umm.
find. So that was a good thing. She was very.
Yes, she was. She was really good. Yeah.
OK.
Very open.
Yes, yes. And and that's one thing I liked about her. You
know, it didn't matter who you are. What you think you are, who
you know, know and who you don't know. But it's down to you. You
know. What can you do basically so.
She told me that she, you know, she didn't have much time left
and she was kind of, you know, getting weaker by the day.
Ohh.
And she loved the internship and she wanted to. She wanted to
know if I could.
Take it over, you know, like.
Be her at that time I couldn't because I was doing the
Ah.
Emergency Management thing, which would take me all around
Oh well.
Yeah.
the the so.
I don't know if you've ever met, and I don't think you did.
When you get like the the Ashley Harrington's.
Hmm.
You know the the the power automate messages.
Yes.
Uh initially was under me.
Ah.
And I she she really good talent. I'm telling you, super
great talent.
Ohh great great.
Uh, her and Jeff came out of the same group.
Uh.
Wonderful.
So yeah, I gave her cyber and she took it up a notch again. So
you she you should see a Wikipedia. A cyber wiki is what
Oh wow.
Ohh I did see that I did see that cause they I got a link to
it.
Yes.
it. Uh-huh.
And then you know, the automated messages that you see and we
Umm.
did, we cleaned up the back end stuff, you know, like old files,
Uh gone?
Ah.
firewall rules, policies, that kind of thing. But still, we
Oh, I'll wonderful.
probably need to clean up the GRC side.
Umm.
I took a look and we haven't touched that since 2021.
Yeah, that probably needs looking at Umm.
So maybe.
Yeah. So maybe we could maybe get some of the cyber guys,
including yourself to lead A-Team to do that or you know
and this go through Sean and and Daniel to see what they think
about that.
Umm.
That's a good thing. And then we need a static.
And dynamic testing.
Of this new website that they're building on our AWS environment.
Uh.
Guess what?
That's interesting.
Nobody knows how to static test.
As Shawn does, and I Daniel does too, but nobody else.
Ah.
And and nobody else is even willing to take a swing at
static testing.
Ah.
Now everybody wants to do the dynamic testing, you know, verb
How come? Uh, huh?
sweet and, you know, web application tools such as Nessus
Uh.
and stuff like that.
Right, right, right.
The fun stuff, but nobody wants to do the static where your
Ah.
holes in you know the web page itself before it launches OK
Ah.
hotspots in the code you're running a linter on it, you
Uh-huh.
know.
Uh.
Nobody wants to do it now. Software should be running their
own lenters on their own software on on their own
Mm-hmm.
language. When you're writing, you running that Lantern while
By.
writing it so you don't have any hot spots in the code. Then when
Right.
Mm-hmm.
we check it with static testing, we can find out if there is
anything that they missed and if there's any syntax errors in the
code that could be exploited.
Ah, OK.
Then we put it on server.
Static.
Uh-huh.
And then it's time to turn it on and see if it works. And while
we turn it on and see if it works, we're gonna do a dynamic
test, which means that's the old, you know, all the stuff
that Red team already does. We we find our abilities.
Umm.
And and the code and and the website itself and the server
itself and the software installed on that server.
Anyways to get into it?
Hmm.
And any ways to try to manipulate it now we don't want
to pair up the code or tear up the site, but we wanna let them
Uh.
know that, hey, look, this is the problems with it and this is
what needs to be fixed and most times cyber's gonna have to fix
the cyber side stuff.
Right, right. That's true.
No, we don't. We don't know anything about no Dang software
languages when it comes to writing it.
Umm.
But so then we would throw it back into their lap if there was
any changes to the code itself that would need.
Right.
Yeah.
That's off dev, yeah.
Yep, Yep. Yep. So.
Yeah, that team, but I wouldn't mind, you know, doing some
You know.
static testing, but I don't know where to start. I mean, cause
I've never done that.
Do some research on it.
OK, I will.
Static analysis is what it's called.
Static analysis. Ohh, maybe this is gonna be part of my UM master
talk.
Ohh.
My master class that would be good, right? Do some research
Use you some research about it. Now. I don't just talk about it.
about this and then.
Yeah. And then see how I come up with uh, huh?
I want you to be able to demonstrate it too.
Them. All right. Right. Right. No, I understand that. Uh,
demote it.
Now it doesn't have to be a live demo, it could be prerecorded
Umm.
and you can just narrate through it live.
Mm-hmm.
Yeah, that's what they did tonight. Uh-huh.
OK, here's the idea.
Cool. Well, that gives me an idea. So I will do some research
on static analysis testing.
Yep.
And then come see what I come up with on that.
Umm yeah, but that's a great idea, Nate.
Umm, because I didn't know and nobody was doing static, you
Thank.
know, testing as you were saying.
No one has attempted to do it now is it needed? Yes. And I
Mm-hmm.
tell you the truth, we should be running a dynamic test on what
we have already. You know, our press site. Our what is it PG
Umm.
PGIP pods?
PGIP.
That's.
Well, it's pods. It's like a kind of like a radio, like a A.
Ohh yeah, the pod sucked. Uh podcast podcast Umm.
A podcast. Yeah, yeah. Podcast. Actually, I think they're
renaming all those.
Ohkay.
Or renaming all of our meetings so we can podcast them.
Ohh.
Yeah.
I think the IT department IT support, they're doing that.
It won't be cyber.
Oh, I see. I see. Well, sorry.
Yeah, but uh, see gay with Sean and Daniel and see if it's OK if
you borrow like two or three people to do some GRC work on
the company.
And ultimately, you'd be looking at like our policies in place.
OK. Then of course, you know, I can take you for a drive and our
Uh-huh.
Microsoft environment to look at those policies.
Ah.
And match more policies we have in SharePoint.
Yeah, because.
OK, that should be under the governess tab.
Uh-huh.
All of our policies, all of our frameworks, all of our
procedures, SOP BCP, ERP, DRP, all of that if if if applicable
should be in that SharePoint folder or in the.
Ohh OK.
Yep.
Uh oh.
And then I can give you a. You know, I can take you for a ride
with the AWS and the Microsoft so you can see those those
policies as well and see if those policies are matching up
OK.
with what we got in our governance management of tab in
Uh.
SharePoint. And if it doesn't then that means what are we
doing?
Yeah, yeah.
In in our environments here, where they are policy should
Right.
match what our systems have been configured for.
That's true. OK.
OK. Alrighty boss. You have a good night.
I'll take a look.
All right, sounds good. You're right.
And soon.
Alright, Nate, thank you so much.
Alright, bye bye.
Good night.
You too.