Hello everyone, everybody.
Welcome to the master class tonight, August 31st, 2023, the
last one we have for August, We'll be moving into September.
Can't wait to see what's going to happen with that.
And the internship as well too.
So we got a lot getting started and coming through.
Ahmad, you go.
Ahmad, you have a hot mic.
Let's see, we've got four people presenting.
I have one.
The first one is going to be a recording by Roman Knowlier.
So I hope I'm saying that name correctly and I will get this
started.
Can you see the screen?
Excellent.
Let's get started.
Hello.
For my Master class presentation, I decided to talk
about the demand for chat bots across different industries.
So the agenda for tonight is to first of all go over the main
role of chat bots and review some numbers and statistics such
as projected growth of the global chat bot market as well
as market trends.
Then I'm going to go over the specific industries that have
implemented chat bots in recent years.
Next they will talk about the limitation and negative impacts
that are associated with using chat bots and professional
fields and I'll finish the presentation with final thoughts
and conclusion.
So first of all, chat bots, artificial intelligence powered
software that uses natural language processing to basically
replicate human behavior, which results in more natural
conversations.
They're also able to comprehend human language by analyzing
dialogues and this allows them to deliver personalized services
and suggest appropriate actions based on context.
And now I would like to talk about some numbers and
statistics in the global chat bot market.
First of all placed on the precedence research that was
conducted earlier this year.
In recent years, the chatbot market has experienced this a
huge increase and it's actually projected to reach up to 4.9
billion U.S.
dollars by 2032.
For comparison, the chatbot market value in 2022 was only
zero point $8 billion.
Such a big increase happens because of the demand for
customer assistance as well as the adoption of advanced chatbot
tech and integration into e-commerce platforms.
And those factors actually have increased.
They compound annual growth rate of 19% for the next nine years.
Another interesting fact that was mentioned is the precedence
research is that in 2022 in North America was by far leading
in the chatbot market growth with 41% share and in the market
itself large enterprises hold approximately 51%.
Bot for service represents 36 and stand alone chat bot
solutions dominate with 55.7%.
And now moving on, I would like to talk about specific fields
that experience implementation of chat bots for example and
healthcare.
Medical chat bots have become valuable tools for things like
symptom assessment and initial diagnosis and they can be used
by patients to evaluate symptoms and determines the urgency of
medical attention.
For example, your MD Healthcare chatbot collects symptom related
information from users and provides potential diagnosis and
treatment options.
Also, Robert's week in the article The Accuracy of
Artificial Intelligence Chat Bots in Telemedicine mentioned
that chat bots are actually becoming useful for post
operative care and chronic disease management by offering
general guidance throughout patients recovery.
They are also capable of providing therapy delivery,
especially in fields like mental health and health with different
symptoms and conditions like anxiety or dementia.
However, it is important to mention that the accuracy of
those diagnosis and reliability in critical situations is still
questionable And healthcare professionals themselves also
benefit from chat bots because they can assist them with some
tasks like treatment planning, patient Ricard management and
medication dosage calculations.
And lastly, chat bots are useful for general tasks like schedule
an appointment or prescription renewal.
OK, so now I would like to talk about how chat bots are making
significant changes in the banking industry.
First of all, they're used in mobile banking apps basically in
order to improve the traditional approaches to handle customers
inquiries.
Most importantly is they are able to handle customers
requests any time of the day and besides that, they offer a
personalized customer service, prevent fraud and send reminders
for timely actions.
Actually, they're also helpful to lower employee turnover by
managing routine tasks, which allows human agents to handle
important issues.
Also according to Shanghai Singh, chat bots increased
revenue through app selling and cross selling based on customer
interactions and they simply analyze customer needs and
provide insights to improve services.
Next I would like to mention one of the first banks that
implemented artificial intelligence power, chat bots
and that was Bank of America.
Their chat bot is called Erica and it helps customers with
tasks such as searching for past transactions like checks written
or shopping activity, helps to access important information
like routing number or viewing bills or scheduling payments.
And this is all as far as online banking and now I'm moving on to
e-commerce.
This field benefits from chatbot implementation because it helps
to connect with prospective customers, simplified
transactions and deliver real time notifications.
First of all, based on statista.com, the chatbot market
and e-commerce is expected to hit 1.25 billion by 2025, which
is a huge increase from the market size in 2016 which stood
at 190 million U.S.
dollars.
One of the most important advantages of chat bots and
e-commerce is that they can proactively interact with
potential customers, initiate conversations over assistance
and answer questions about products or services.
So overall the approach with implementation of chat bots
increases the chances of converting casual browsers into
customers.
So and another major benefit is that chat bots actually do help
with facilitating transactions, navigating customers through the
checkout process, offer them product suggestions and provide
information about relevant sales or promotions.
And Brandon McConnell in the article Everything You Need to
Know about E-commerce Chat Bots in 2023 mentioned that this chat
bots customers are more likely to complete their purchases.
Another useful feature is that chat bots offer posts sales
support.
This is specifically useful when customers have questions about
order statues delivery times, returns after making the
purchase and many others.
They also offer personalized recommendations based on
customers purchase history and preferences and that shows the
deep understanding of the customer needs and it helps to
create a brand customer relationship.
And now, aside from the advantages that were mentioned,
I also wanted to talk about the limitations and consequences of
relying on artificial intelligence, power, chat bots,
and professional fields.
As an example, I chose a recent situation that happened this
year in the legal field based on the article that was published
by Sarah ****** called New York Lawyer Sanctioned for Using Fake
ChatGPT Cases and Legal Brief.
The two lawyers submitted the brief and a personal injury case
against the Avianca airline, which included six case
citations that were created by ChatGPT and that didn't actually
exist.
So in response, the lawyers from Avianca alerted the court to the
false citations and as a result of that, the judge found that
the lawyers acted in bad faith and provided misleading
statements to the court.
The judge also ordered the lawyers to pay a fine of 5000
U.S.
dollars.
And in this case, both attorneys experienced not only financial
loss, but it also damaged their reputation within the legal
field.
And this situation demonstrates that chat bots and artificial
intelligence can't be 100% reliable.
And lastly, despite all the advantages that got implemented
with chat bots, the legal case with the Avianca airline showed
the risks and consequences of relying on artificial
intelligence, chat bots and professional contexts.
Also shows the need for human oversight, ethical
considerations and additional verifications.
And overall, it is important to properly balance chat bots
efficiency with human expertise.
And this is all I have for my master class presentation.
Thank you for watching.
That was excellent.
Wow, so much information.
And I just want to remind everybody that we do have a chat
bot in the fresh desk ticket support system so that you can
ask a question within there and get answers through it and it
will grow the more that we put in there.
We do have information that we need to add to it, but you
should be able to find a lot of answers to that as well.
So that was an excellent, excellent presentation.
Yeah.
It, it exemplified the major problem with NLP.
It just associates the word with the next probable word.
Yes.
So it it creates a lot of fake references.
I know.
I work with this.
Yes.
Yes, exactly.
Yeah.
You got to be careful what you're using the chat bot with,
right?
Because you can have important information that it's going to
give you the wrong answer to.
Makes sense and it sounds good, right?
Oh, it's so smart.
But not right there.
Excellent.
Well, that was good.
A lot that he brought up.
Very good.
Let's see.
We've got Tamra.
Are you ready?
Yes, ma'am, I'm ready.
Can everyone see the screen OK?
Yes.
All right.
Good evening, everyone.
My name is Tamra TJ Muhammad, a member of the networking
department, and I will be presenting you with a little
information about computer forensics, forensics and
investigations.
During this presentation I will address the following topics
history of cyber attacks and cyber crimes, Forensics,
investigation and some responsibilities, tactics,
techniques and procedures.
Within that role, a brief history of cyber attacks that
have affected some in the industry and supporting
agencies.
Cyber terrorism, cyber attacks and cyber crimes negatively
affect personnel and organizations of both large and
small scale infrastructures due to various acts like theft and
or destructions of information as well as exploiting data.
This can result in loss of credibility for organizations
that may become victim of such acts.
Although people in society use the terms interchangeably, cyber
attack and cyber terrorism are quite different from one
another.
One cyber attack main objective relates to attacks against
information systems to create a disruption.
Whereas cyber terrorism acts are motivated by political or
religious causes in order to intimidate the government or to
cause catastrophic interference with an infrastructure, cyber
crimes are more frequent on social platforms like Tiktok,
Tiktok Well, X Platform, Mail, Facebook, Instagram, as well as
LinkedIn, since bad actors use available cyberspace to inflict
victims within their local country or an anonymous in
another location from an anonymous standpoint.
Additionally, cybercrime's popularity has also been
enhanced via the Dark web as this method of execution exposes
bad actors with an opportunity to assess a normally
unauthorized layer of the Internet that shall require
special software or authorization.
When all the required elements are assessed, bad actors are
able to conduct illegal activities without their
location or their identity being traced.
During the process, cyber criminals may use viruses or
malware like denial of service attacks or distributed denial of
service attacks to damage devices in order to cease proper
operations.
Due to this matter, it is highly recommended that end users
ensure their devices possess the most up to date security
measurements.
Individuals should take heed to this advice for both personal
and professional data security.
Forensic Investigation Teams are responsible for retrieving
evidence to support their case in the court of law, obtaining
automatically stored data, Ghost data system stored data for
utilized software to remove data from a workstation.
Forensic investigators examine various areas in order to
ascertain damage.
Infiltration means location of the initial operation and or
perpetrators at fault.
Actions of Forensic Investigation teams are required
to adhere to operations in accordance with established
tools, techniques and procedures, known as TTP.
Cooperations of any size shall be vulnerable to attacks as they
are connected to the World Wide Web, which leads to the
unauthorized access of sensitive information published.
TTP is a method that forensic teams shall use to analyze the
performance of an advanced persistent threat known as APT,
enabling the members to defend the resources or devices at risk
with the potential to detect attacks during the initial
phase.
Tools can vary in type and size depending on the organization,
falling into the following categories network security
monitoring tools like Splunk and Argus, encrypting tools like
Windows BitLocker, weaknesses of web analytics, and password
checkers such as key logging software.
Tactics emphasize how bad actors behave within various stages of
their acts, gathering technology to compromise desired devices,
increase privileges, and maintain persistence.
Overall.
Actions that are capable of concealing the identity of the
bad actor as the number of agencies to defend our nation
and its people against cybercrime continue to grow, as
does the knowledge possessed by its adversaries.
Since the ground breaking information for protection is
shared and they're vulnerable to be discovered by a number of bad
actors, cyber criminals often use viruses or malware to damage
devices in order to cease proper operations.
However, those viruses may also be used to remove or steal
information from affected computers.
Malicious acts such as denial of service attacks, which stop end
users from using their machine on their network, is a common
tactic used to prevent a company from providing business to its
customers.
Actions such as this shall hinder a large commercial
corporation from conducting their daily operations, possibly
resulting with delays on pending orders, customer sales, identity
fraud or identity theft from unauthorized access of clients
information or destroyed and stolen archived files.
Also, depending on the mindset of that person, the individual
or the bad actor may have the desire to target 1 computer with
the intentions of that computer spreading the virus to other
machines connected to the network.
It is highly recommended that all relevant information or
evidence be organized and placed in a centralized location to
ensure accessibility for investigators and attorneys.
The steps within the ediscovery process include the following
Creating, maintaining an electronic storage information
ensuring that ESI is both identified and preserved.
To prevent any modifications during the from occurring within
the data, initiate additional filtering of data, removing
redundant information which can save budget constraints.
Verifying the filtering has been accomplished, reducing an
upfront format and ascertain that ESI has been included in
the court order via Clawback Agreement.
The Clawback Clawback Agreement verifies that all parties
involved acknowledge the unintended production of
privileged information and it shall not constitute A waiver of
privilege.
As previously mentioned, bad actors may use sources like the
dark web to initiate their operations as well as computer
networks, social media or actual physical attacks to members
within target audience.
Therefore, it is important imperative that investigation of
cyber crimes maintain a well detailed structure operation to
ensure that all avenues of vulnerability have been
identified and safeguarded for use of evidence in the court of
law.
Ediscovery is the process by which parties in a legal case
collect, preserve, review, and exchange information in an
electronic format to use as evidence in the case.
Information or evidence that are submitting into the state or
federal courts are required to be exchanged amongst the parties
via recorded testimonies or interrogation.
This procedure shall be adhere to for all electronic documents
or files that are considered to be admissible evidence.
Sorry, I skipped on.
Secondly, ediscovery involves the removal of unsubstantiated
redundant information that should be considered of no use
in the court of law.
Although this process is lengthy and expensive, it is only
beneficial to active data and metadata from hard drives and
storage media.
Therefore, the need for more in depth process is required.
Computer forensics dives deep into centralized areas of the
computer, acting as one of the primary means for ascertaining
The Who, what, where, when and why from affected workstations.
In reference to E discovery.
Computer forensics is the microscopic view of cases,
whereas E discovery gives a quick glance under the naked
eye.
It is more time consuming and more expensive than E discovery
because of the lack of discipline needed for analyzing
evidence.
It should be free from error since it is vital to produce
legal evidence for crimes.
The technological procedures involved are used in employment
cases, civil litigations, criminal prosecutions and
fraudulent investigations, as well as domestic centre cases.
History has proven that cyber attacks are typically conducted
by a bad actor with the intent of personal gains or notarary
status.
In 2014, a cyber attack was conducted by Russians with the
intent to damage the Yahoo website.
Russian agents Dmitry Dokashev and Igor Sushan worked as a team
to hire a hacker to infiltrate the site, with the main
objective to obtain personal identifiable information of its
customers and clients.
Alexi Belon, I think I'm pronouncing the name correctly,
conducted the hacking process in 2013 via backdoor access to the
site's backup database, and transferred PII data to his
personal computer.
The process was successfully completed in 2014.
During this process and this time frame, Yahoo was being
breached and lost approximately 350 million of the sales value.
Unfortunately, attacks that occur over 10 years ago still
exist with identical identical intent behind bad actors
actions.
This verifies that history is capable of repeating itself and
older practices may be revised but should refrain from being
completely disregarded.
There are some numerous agencies and organizations that support
to defend the protection of cyberattacks by utilizing
forensic investigations.
Many countries have nation based organizations that adhere to
local laws.
The FBI stands and acts as an organization with the intent to
change criminal activity and behaviors.
With the desire to compromise US networks, financial standings,
intellectual property and critical infrastructures.
This agency encourages all individuals to take action for
protective measures against cyber crimes like business
e-mail compromise, identity theft, ransomware spoofing as
well as online predators.
FBI also adapts with the ongoing technological advancements via
the incorporation of the Internet crime complainant since
complainant Center IC Three that collects crimes and tips about
crimes from the public.
IC3's actions, in addition to agencies like Bureau of Justice
Assistance, have rendered assistance to various complaints
which enabled the protection of cybercrime victims and their
assets.
Additional agencies like the US Secret Service and the US
Immigration and Customs Enforcement, known as ICE, also
possessed to divisions with each of their agencies that are
dedicated to combat cybercrime.
the US Secret Service investigates cybercrime cases
that threaten the nation's financial and critical
infrastructure via its Electronic Crime Task Force,
whereas local and state law enforcement, as well as judges
and prosecutors receive training in computer forensics via the
National Computer Forensic Institute.
In conclusion, cyberattacks like identity fraud, phishing, and
malware virus infections can affect both personal and
professional environments, causing significant damage to
credibility, existing data, and overall operations needed to
remain productive.
This means of initiating such attacks can be conducted via
social media, insider threats, coercion, as well as
infiltration into a network or workstation for monetary gains.
Although the actual influence may be unknown to those seeking
justice.
It is possible to obtain such information from E discovery and
computer forensics via TTP, which shall examine both surface
level and in depth portions of workstations, hard drives, and
networks that the workstations are connected to.
It is vital that forensic investigators maintain organized
practices to safeguard evidence discovered in order for it to be
considered admissible in court, for any relevant information
that has been mishandled shall be deemed inadmissible by
adhering to practices accepted by agencies such as the US
Secret Service, FBI, and the NCFI.
Forensic investigation teams are capable of identifying probable
cause or preliminary to detail investigations, combating
adversaries that wish to threaten the security for
information, both nationwide and abroad.
Those are my references for my presentation.
And does anyone have any questions?
Great job, a lot of information.
That's very cool.
I, you know, I had not actually known about that with Yahoo,
although I knew that it had happened.
I didn't know where it came from and who tried to infiltrate.
It's great work.
Nice going.
Thank you.
Any questions for Tamra Cyber people?
I'm sorry.
I had skipped a couple of slides, but no worries.
Track with the topics.
Yeah, it was good.
Very good.
Thank you very much.
OK, let's go on to Anna.
Are you ready?
Hi, everyone.
Yes, I am.
Let me just share my screen, right.
If you could just confirm that you can see it.
Yes, I can.
So my name is Anna Mumford and my topic for today is building a
culture of cybersecurity in an organization.
So what is the biggest sub secure risk to undergoing to an
organization?
It is the human factor.
Research shows that over 80% of all secure incidents are due to
human error.
So whether it is a successful phishing attack, logging
credentials that are given away or incited, threat activities
such as data theft, fraud, malicious damage to company
assets, physical secure compromise, neglect.
When it comes to cybersecure policies or a third party
provider security measures, typically the the weak link is
people and their behaviour.
And it turns out that most organizations simply ignore
those issues.
Many others continue struggling with it.
So what are the common pitfalls of handling the human risk
factor?
Many organizations try to compensate through investment in
strong technology.
They believe that they cannot stop people from giving away
their credentials or clicking on things.
So they try and minimize the risk or the damage through
strong technology solutions.
Unfortunately that unfortunately that does not really work.
Also, many times there is no buy in from the the company's
executive leadership, which is critical because unfortunately
it leads to many other issues such as deficiencies in security
budget, insufficient employee training, treating security as a
project with a start and stop date which often indicates that
there is no ongoing risk management and lack of
cybersecurity.
Acceptable use passes and procedures that are adapted and
implemented throughout the organization.
And to successfully implement those business practices, the
organization needs to be able to deploy effective change
management, which is a significant issue in many
organisations as well.
So how can companies remedy this widespread human factor problem?
The simple answer is that we need to build culture of
cybersecurity throughout the organisations at all three
levels.
The leadership level, the group or the department level, The
individual employee level as well.
What does it mean?
We want to set goals, embrace attitudes and the beliefs that
infuse safe behaviour into corporate practices so everyone
or every employee is.
I'm constantly reminded of the role and responsibility to keep
the organization safe and understand why cybersecurity is
important.
When to make cybersecurity part of the organization's fabric
Beyond the How to avoid phishing emails or providing passive
management training.
Create a work environment where every person is excited by
cybersecurity and motivated to make it better.
Ensure that employees are aware of what the risks are or could
be, and understand how to respond to or report such risks.
And most of all, we want to ensure that the employees see
themselves as part of the solution.
That might be a tall order for organizations.
So how do we go about creating a sub secure culture?
What are some of the key elements or steps to
implementing the culture of cybersecurity?
Some of the high level steps are having an executive
cybersecurity culture, owner or performing effective employee
training or developing company wide acceptable use policies,
implementing change management and risk management.
So now let us look a little bit deeper into each of those
topics.
Cyber security culture owner would be an individual such as
CIO or Cesar or it might be a non-technical executive that
drives the actions necessary to change the behaviour, the
values, attitudes and the beliefs of the employees.
This person pushes the necessary campaigns and company
initiatives through a through a change management.
This executive also owns the message and actions necessary to
drive the change and aligns the security message with the
company's strategy goals in business terms.
For example, in one organization the term cybersecurity wasn't
connecting with the employees, so the the the culture owner
changed the messaging to protect our data and systems, which then
the employees could understand and relate much better and much
easier.
So besides the general subsecure awareness training, it is
critical that organisations conduct effective employee
training and their acceptable use policies.
And those are the the policies that instruct employees on what
they are allowed or prohibited from doing as well as the
security practices the company wants the employees to follow.
Once the company sub secure policies are developed, they are
documented and employee training is performed.
The organization will need to monitor and manage risk areas
and that is being done through a risk management process where
they will need to understand the human behaviour that exposes the
company to secure the threats, develop risk profile and build
mitigation strategy for those areas of risks.
They need to understand, track and manage the risks on an
ongoing basis and this is where implementing effective change
management is so important.
It's a critical step that drives changes in business processes
that the behaviour values attitudes and the employees
beliefs.
And for that, the leadership team with the cybersecurity
culture owner needs to be fully engaged and create a sense of
urgency and commitment getting to communicate cybersecurity
strategy to their whole organization that perhaps remove
some barriers, generate short term wins and maybe institute
the change over time within the organization.
So policies and procedures are a crucial protection method for
building a sub security culture and minimising the human error
or the human factor in an organization.
But so is the training and those policies.
So what are some of the more effective versus less effective
techniques to promote employee compliance?
And by the way, those are those techniques are compiled from a
research that was based on interviews with over 50 IT and
security managers.
So some of the less effective techniques is penalties or
punishments for non compliance.
So.
The idea here is that if you start punching employees without
first conducting a proper sub security training, the employees
will not understand the the threats and the impact on their
organization for non of non compliance.
And we'll still follow all habits, but now they will hide
it.
And we really don't want that.
Because you want your employees to be to report anything that
they've noticed, report any incidents or suspicious actions
to the IT so they can stay on that.
So the IT can stay on top of that.
And the punishment will all only discourage that.
The next one is being unclear in policies, objectives and
approach.
You can't expect employees compliance if they don't
understand the policies or what to do or not to do.
Some organisations would put documents on front of the
employees and ask them to read & that and this type of
training is not very effective.
What?
So what is a good sub secure training?
You really would want to bring all of the employees in a room,
maybe by a function or a department, and discuss it with
your with with the employees and be precise.
They're usually the devil is in the details.
You know.
You need to explain what type of forms you want them to use, who
to call if they know, notice something, whether it's an
e-mail, you know things like that.
The next one is creating policies that do not appeal to
employees.
Unique characteristics.
The benefit of having the open discussion with employees about
cybersecurity is that you can get their input, you can ask
about issues that they see, discuss the pulses, how's it
working, how where they see any areas of risk or maybe get the
feedback overall and and that will expose some of this the the
risk areas.
So you can then track and assess them again in ongoing basis.
So now what are some of the techniques that are proven to
promote sub security policies that procedures that are a
little bit more effective.
The first one is training that builds employee with skills and
confidence to combat threats.
So if employee received a proper training they know what to do
and why is important.
What is the impact of not not performing or not following the
policies and that will allow them to change their behaviour
or develop a positive beliefs towards other security.
They will feel empowered.
They will want to do the right things.
As a matter of fact, they will brag about it.
They will be excited that they've noticed something and
yes, no, they did not click on it.
They they will help each other, they will assist each other, and
they will become slowly part of the solution as opposed to a
problem within the organization, the next one says Employee
guidance and suspicious threats response and reporting.
So you want to be very clear on how you want employee to report,
if they've noticed something.
If there's not as an incident or any suspicious activities.
Especially when it comes to insider threat, it is very
important that they understand not only how to report, but if
they do report something did not as somebody behaving
suspiciously, the debt will be kept private and there will be
no negative repercussions repercussions to them for
reporting that the next one is providing understanding how
compliance benefits the entire company.
So, so, so this is very important that they understand
why we're doing that, What is the possible impact if they do
not follow the compliance.
And then the last one says hiring employees with a positive
attitude towards cybersecurity.
And we all love employees with positive attitude.
But an organization can develop within the positive attitude to
building a culture of cybersecurity.
And the last one says support organization's commitment to
security and that needs to come from the leadership from the tab
and then to show that they are committed and lead the whole
organization by an example.
And those are my references.
And if are there any questions, Excellent job, Anna.
Another cybersecurity one.
This is great information.
It really is even, you know, for especially us who do not take a
lot of cybersecurity or understand a lot of it.
This is great information.
Absolutely.
Thank you so much.
Thank you.
It's good to know, especially in this organization.
So, yeah, we need it.
Yeah.
All right.
Spencer, Are you ready?
Yes.
It just looks like maybe I'm trying to share.
I might have to update some settings.
So give me one second.
No problem.
OK, I'm going to quit and reopen, so I may lose you guys
for a minute.
No problem.
And as a matter of fact, we do have a couple of new interns
that are into getting everything set up for us in case of
emergency.
So, and I forgot the words for them.
Business Cool, all right.
Should be sharing my screen now.
Are you able to see that?
I do see it.
Awesome.
Great.
Well, good evening everyone.
Thanks for joining.
My name is Spencer Klein.
I am a graduate student in the Cybersecurity Management degree.
I'm excited to to guide you guys through a insightful session
here of attacking and defending AWS Simple Storage Service or
S3.
In the next 15 minutes, we will explore the critical aspects of
A/B OS S3 security, including vulnerabilities and best
practices for securing your S3 buckets.
So let's dive in with learning more about the the fundamentals
of S3.
So our focus today is going to be on the critical topic of
attacking and defending AWS S3.
While AWS S3 is a powerful and versatile object storage
service, this means you can store anything from files to
videos to a ton of different kind of media all within one
spot.
For this reason, it's become kind of a prime target for
attackers because there's a lot of different stuff they can they
can get AT in there.
So our responsibility is to understand the potential
vulnerabilities that, you know we pose and then arm ourselves
with the knowledge of how are we gonna defend ourselves against
them.
Cool.
So understanding the AWS S3 structure, so similarly to kind
of how your computer works, we're storing information.
But AWSS 3's gonna differ in the fact that unlike the traditional
file systems where it has kind of directories and
subdirectories, S3 employs a flat file structure.
So everything's gonna be stored within one spot within what they
call the bucket.
So it's gonna be just everything you're trying to store.
So you can do some organization using kind of the traditional/
to kind of simulate those directories and subdirectories,
but that structure is just kind of a pseudo hierarchical thing.
It doesn't actually create those subdirectories.
So this does change kind of how you might traditionally manage
your access controls, which is what we're kind of kind of move
into later with using some of the resource policies and I IAM
policies that AWS offers.
So within the S3 store, all of those kind of objects are what
you're gonna be storing and the the durability of those is
pretty staggering.
AWS boasts that they have a 99, and I know it's hard to count,
but there's actually 9 nines on that of uptime or durability for
your objects.
So that means that only one object out of every 100 billion
is going to be lost.
So it's very reliable in that sense, and that's just kind of a
testament to the underlying infrastructure that AWS has.
However, it's important to recognize that durability is not
synonymous with security, and just because it's gonna live
within AWS doesn't mean that it's gonna be safe from
unauthorized access or data breaches.
So that's where access controls come in.
So access controls are pivotal in the realm of AWS S3 security.
AWS Identity and Access Management, which is what that
IAM is gonna stand for, Create policies to serve as a powerful
tool to define and enforce permissions for various users,
groups, and different roles you might have.
This granular control empowers organizations to restrict
actions on S3 resources which will bolster their security
posture.
Additionally, there are S3 Bucket Policies and Access
Control Lists, which are Acls.
So as we kind of delve deeper into this, we can encounter the
kind of intricate world of access management.
Things can get pretty complex pretty quickly.
So alongside that IAM Policy, S3 offers the the tools of Bucket
Policies which would be specific for the S3 bucket and then the
access control lists are going to be more generalized.
The bucket policies offer a more intuitive and kind of human
readable syntax, granting flexibility and kind of ease of
use.
Meanwhile, the Acls are going to provide a simpler approach, but
they come with a little bit of limitations in the versatility.
So balancing these tools essential for an effective
access control for S3 and another service that's gonna
kind of work with S3, if you can kind of see in this picture is
AWS Cloudfront.
So Cloudfront is a content Delivery Network which is
designed to enhance the content delivery and offer some security
features for S3.
While Cloudfront is incredibly valuable, using it to serve S3
buckets does introduce some unique security dynamic and
we'll explore how attackers can leverage this arrangement to
their advantage.
So, and this is kind of something you run into a lot
misconfiguration, right?
So Cloudfront is no different.
A significant aspect of Cloudfront's security landscape
is you know configuration options for the Cloudfront
origin and a lot of times they end up being misconfigured.
This unfortunate oversight can expose vulnerabilities within
your infrastructure.
To protect against such risks, it's crucial to establish proper
configurations utilizing those resource based policies and
security groups.
Our journey will also uncover the methods attackers might
employ to bypass Cloudfront and gain access to the unprotected
back end resource or the the S3 resource.
So identifying A misconfigured cloud front origin is going to
be really important.
It's something that we're definitely going to want to
know.
Our arsenal includes a lot of different techniques that we can
use such as sub domain enumeration and DNS
reconnaissance.
Using tools like CRTSH which I've got linked right here and
other sub domain enumeration utilities, we can zero in on
potential targets and unveil the security risks associated with
kind of those cloud front setups and seeing that would enumerate
and allow someone to just kind of see that they could directly
access those S3 buckets.
So it kind of just like gets rid of any of that security that the
cloud front would have would have been providing.
So another piece that's really important to know is the S3
bucket mating conventions.
So when it comes to public S3 buckets, the URLs are structured
kind of predictably, like you can see here HTTPS S3 Amazon
aws.com with the bucket name and the key name.
And in fact, some companies actually adopt specific naming
conventions and they'll kind of like follow these throughout all
of their code, making these buckets kind of readily
discoverable.
And this has significant implications for security,
because obviously you want to keep a lot of this stuff that
you're storing probably secure and don't want that to be
something you know some random person could could kind of see
and look into.
SO searching techniques for these public S3 buckets.
So by imploring search engines and using kind of specialized
syntax and examples kind of displayed here, you can kind of
reveal those S3 buckets that are available.
A lot of the use cases for S3 initially was for posting the
content of static websites online.
So originally the point of way that it was set up was these S3
storage places would be default public.
Recently within 2018 they've they've changed this to be
default private off the bat.
But there can be some scenarios where people might misconfigure
their their buckets or their access controls in such a way
that they become public.
Which is where a lot of the the risk is going to start showing
up.
Another way that these like buckets could get leaked or you
could figure out that they're known, is through web page
source inspection.
So web page source inspection opens another door of potential
vulnerabilities.
So as we dissect the source code of web pages, which I've got an
example here from Tri Hackney, it's for the actual profile
photo that they use.
We can often stumble upon X3 buckets that are utilized for
these static content and scripts.
And there's other tools that you can use like link Finder, JSA
and sub JS to find out some of these embedded resources.
But a lot of times it really is as simple as just kind of look
at the source code online and you can see kind of where the
website is storing some of these resources.
Cool.
So DNS reconnaissance for S3 buckets is another way to
identify them.
So let's take our exploration further and look at this
powerful tool.
So by employing techniques like nslookup with the bucket name,
which I've got an example in the picture here, we can gain
valuable insights that assist in identifying S3 buckets.
And this technique becomes particularly useful when you're
trying to unveil additional resources hosted within the
bucket.
So within here, by doing an NS, NS lookup on a kind of test
website where they've got some public S3 assets, you can see
the underlying kind of canonical name and some other information
about the actual S3 buckets which would help an adversary in
their their attack.
So next let's talk a little more about actually kind of attacking
these public S3 buckets.
So S3 is used very broadly within AWS.
It's used by many different services.
While kind of how we describe public websites or primary use
case, S3's influence extends far beyond that.
Working with Cloud Form templates, Lambda functions,
Cloud Troll logs, Cloud watch logs and AWS Athena Analytics,
those all rely on S3 storage and kind of utilize this and this
interconnectedness offers kind of unique opportunities for both
legitimate use and also potential exploitation.
For instance, compromising resources stored within S3 can
have ripple effects on associated services leading to
unexpected vulnerabilities.
An example of how an adversary could leverage a public S3
bucket to exploit an organization could kind of go
like this.
So an adversary could be looking through the files in one of the
public S3 buckets utilizing AWSCLI, and because that bucket
is, you know, public, anyone can go in there and look at all of
the files.
So there is a possibility that an adversary could find a backup
binary file that would be used to restore an EC2 instance if
they kept that like within the the same place that they were
actually running their image from.
So the adversary will be able to get that Amazon Machine Image
and download it to their computer and using their own AWS
account, they would be able to set up an EC2 image based on the
kind of like stolen image and set that up and start pilfering
through kind of like sensitive information and files on that
EC2.
So something that they could find would be like admin
credentials, which would allow them to kind of get further into
the system and you know, create a better foothold in in an
environment that they're trying to get more information from.
So to kind of summarize what we went through here for AWS S3, so
we kind of started out by talking about the fundamentals,
you know, delving into the unique flat file structure to
exploring the interconnectedness of S3 with all the other AWS
services.
We peeled back the layers of its vulnerabilities and kind of
strategic defenses.
And by comprehending all the intricacies of AWS S3, we are
empowered to better defend ourselves against all the
potential attacks.
And thereby enhancing the security of our AWS
environments.
Next, I just kind of have AQ and a slide.
If anyone's got any questions.
There is a question from Anthony is CRT specific to AWS?
No.
CRT is a tool that's used for DNS enumeration, so that could
be used with with any kind of URL that you're trying to get
more information about.
I have a question, so aren't there specific permissions that
can be added to the S3 buckets themselves to keep them from
being attacked or found or yeah, used?
Yeah, so that's kind of like so.
There's a few different routes that you can use in native US
using kind of IAM rules to manage how users, like internal
users, can interact with the S3.
Additionally, there's more kind of policies you can write to say
how other services would interact with it and how it is
accessible to the outside Internet.
And something I kind of touched on briefly, a switch that AWS
has kind of made.
So previously whenever you like, someone just went in and created
an S3 bucket, it would automatically be public to
everybody, which is kind of like a pretty big security risk.
So over time in 2018 they actually switched that and went
back to defaulting to the S3 buckets being completely
private.
So you would have to go in to those policies and actually open
it up to make it public.
So it's kind of good to see that bigger corporations are taking
kind of these steps to you know give the security off the bat
instead of kind of making people go through the process of
managing and and probably misconfiguring something.
OK one more question, So what is better an S3 or CDN when it
comes to images that you use on a website, right.
I think it kind of depends on how you've got it set up right?
So the configuration SV buckets are a great solution with
something like Cloudfront.
But then again, it kind of depends on your scenario I
guess.
From my personal experience, I've done some work with
government contractors where we have framework requirements like
Fedramp that require us to do like image hosting and
everything within the US.
So we leverage something called AWS Golf Cloud.
So in that scenario you can't use something like Cloudfront
because of the nature of the environment kind of restricts it
to be closed off to just the US.
So there are some scenarios where you know it kind of
matters on case by case, but generally I think AWS offers a
you know, great solution with Cloudfront and S3.
Excellent, some good points made absolutely.
Well, that was great.
And 103, yeah.
I just wanted to kind of like add to your question about the
CDN.
Typically like you'd want to use a a CDN if you have content that
you want to be closer to a specific region.
Usually CDNS are deployed when you want to reduce like latency.
So like if you have, if you have content that you want like
people in Europe or Asia to access and you're hosting it you
know and on on in a in a region that's here in the states, it
would take a little bit longer for those users to access that
content.
So you use CDNS to basically store cached content that's you
know, stuff that doesn't change a lot.
And those CDNS are located all over the world and they
basically allow you to, you know, put your put your product
or whatever it is out on the web for users in maybe far away
locations to access that quickly.
Yeah, we did have a a website, we had PG radio and we had a lot
of images that we had on there and we couldn't decide.
We were using an S3 but then we had some a lot of hackers coming
to the website as well-being that like the images were wide
open.
Now we pretty much have it with four PGIP tech and PGI pods.
We have the CDNS that are built in, not so much an S3 as we are
using the CDN and the images are going to straight to the server.
I'm still not quite sure on the effectiveness of this and the
security of it, but that will be cybersecurity's job very soon,
yes.
I also I also dropped the link in the chat that because Spencer
was touching on the naming convention and he's like
absolutely right that some companies are kind of lazy when
it comes to you know coming creating you know unique names.
Because S3 buckets are global, it's a global service so they
have to by default have to be a a a unique name every single
time and because of that company's do incorporate certain
kind of naming conventions.
What does which does make it easier to like maybe enumerate
their their the way that they actually define their their
their storage buckets.
So I dropped like a a white paper in the link that it it
basically goes over how to create like AC name and what you
do is you you you create the C name as like ADNS pointer.
So that instead of having that funky long S3 Amazon, you know
fully qualified domain name, you can basically create an alias
that looks like a regular normal standard you know web address or
URL that you know that doesn't expose your S3 bucket's name.
Perfect.
I'll have to read that.
I do understand what you're saying because it it does come
into the domain name and where we do the C name when you create
the domain too.
So that makes perfect sense.
This is great, good information which will come in handy when we
do the business integrity plan, what's it called?
Business.
And then there's a there's two of them business, the business
plan and then the destruction plan.
This is not destruction.
So we have a couple of interns who are really into wanting to
create those for us, which is great.
So we will get those set up for the websites and for the system
itself and our servers and all that that we use because we do
need some more security on those ends.
So I'm glad you guys bring this up with all this cybersecurity
that we're going over tonight.
Great job, all of you.
Congratulations on completing your presentation, if this is
your first or your second, and glad that you joined in as well,
everybody.
Thank you.
Disaster recovery plan, which is needed very badly.
And then of course we have the business BCP business.
What's the BCP, the abbreviations for it?
It has so many.
Thank you.
Continuity.
Yeah.
Whoo.
Yeah, we have plenty of abbreviations.
We just have to remember what those mean.
So we're going to work on those, which is great and that's going
to help the whole internship in itself.
All right.
So thank you for joining everyone.
We had some great presentations this evening.
Looking forward to the ones next week.
And I do want to say that the sign up sheet's going to change
a little bit to conform to and help those that need some time.
I know that we have masters who need to do 2 of them.
Remember, your first or second one can be within your
department itself if you want to in the department meeting.
I don't have to be one of these master classes every time, but
the one of them has to be a master class.
So but I will look in here and kind of change the dates around
see what I can do to help everybody before they have to
leave and see what's best can be done.
Thank you so much everybody and have a hey Marjorie, before you
go, I just had one question.
Yes.
I don't have my master present, master class presentation until
I think like October.
But I just, you know, nothing against how things are being
presented.
I just wanted to know like does it necessarily have to be a
PowerPoint presentation or could I do like a demo.
You can do a demo.
You can do it all Absolutely.
OK.
So you can have a PowerPoint.
Good.
Yeah.
PowerPoint with a demo against PowerPoint.
Like I love PowerPoint.
I'm just I like to show stuff and I absolutely.
No, I totally agree.
That's how I teach.
So several.
And they're really good.
Yeah, they're really good.
They are very helpful.
I wanted to kind of do one on like steganography and how you
can hide payloads and pictures and stuff like that.
And.
Absolutely, absolutely.
Yeah.
However you can show ITS best.
Absolutely.
Just rehearse it well before you present it.
Yes, Yes.
OK And make sure your system works.
I'll, I mean, I'll probably be running a doing it in like AVM.
So how will I be able to share my screen?
Like, will I just have to like move it over to AI mean how does
the, the screen sharing work?
When you share, you share your, you share the screen itself or
you can share a window.
OK.
And I can put it on a window and I have a couple different
monitors that I use.
Yeah.
So you just have to share the monitor.
Yeah.
It'll let you.
OK All right.
No problem.
Good questions.
Absolutely Cool, Sounds good.
Any more questions for anything like this with?
Thank you guys.
All right.
Well, have a great rest of the evening.
I enjoyed your presentations.
Great job and I look forward to the next ones.
Have a great night.
Thanks.
Have a good one.
Hey, Marjorie.