Welcome, welcome everyone to Master Class Tonight, October
If our mind that we don't feel, I mean know or I'm it's a little
5th, 2023.
So glad to have you guys.
different and if you're doing it on the phone.
Hot mic, hot mic.
Umm.
Let's see, we have a definitely a good list of presentations
tonight and presenters of all different topics, not staying
within one field of it, but a lot of different stuff, maybe
even a little business like so this should be a lot of fun.
Get ready to go.
We're going to keep it at 15 minutes each.
Hopefully they may have to talk a little fast to get it going,
but they'll work with us.
Umm, we may end up changing this to 8:00 o'clock next week
starting next week.
Although we do have.
A starting.
Umm, term next week as well.
So I mean an ending term next week as well.
So we'll have to get this through and have the execs OK it
so once we get that vote through, we'll go ahead and do
that.
But we will definitely let you know as we move forward.
For now, we're starting at 9:00 o'clock.
Umm.
Let's get started though.
With our first presenter, Jose, Are you ready?
Hey I I have a night operation and I submitted my presentation.
Uh in the file file folder and also let my team know.
Ah, OK, so that means I got to pull it up.
That's what I was wondering.
So let me go into.
Which?
I'm getting there.
Actions master class.
Alright.
Can everybody see the?
Screen.
Great.
Hello everybody on a welcome the out to my presentation
leadership and IT field by me, Jose Alvarez.
What is leadership?
So this picture of me and my team when I was in Korea, most
recently this was the first group of soldiers.
I really laughed because I was a one man team for most of the
time as a Jane operator, and then I moved to Korea, then
became essmann operator and got to experience leaving these
group of guys.
They're all fantastic new their job.
So what does leadership leadership model words is being
able to show your support minutes had a complete work.
And be there in any given situation, being open to any
suggestions, but always choosing the best one for the team.
By the book definition is leaders motivate achieve
something new and better and taking risk challenges and
challenging the status quo?
The importance of it leadership in the digital age, our team
leaders are responsible for fostering a culture of
innovation, identifying emerging technologies that can give
organizations a competitive edge and facilitating the rapid
adoption of new tools and processes.
I see there are also responsible for developing and maintaining
robust business continuity and disaster recovery plans to
ensure that the organization can continue to operate in the face
of disruptions or crisis.
So when it comes to getting new technologies, as I said before,
I worked on a JNN I joint node network system.
Then I moved to as noon a small node network system, basically
combining the job of a Sierra, which is a satellite guy in in
November, which is a network guy which is myself to accomplish
supporting users in the field environment, and that is
something I had to learn to adapt to on the fly.
I had basically maybe a month and 1/2 to learn the equipment
and then right after that I was on missions back to back.
I went on probably, I say about 6 or 7 missions in my year in
Korea while also doing 2 classes at a time the whole time while I
was there.
Looks like right here.
Talk about understanding the technical side and having
leadership capabilities.
Being able to walk through your team in any troubleshooting task
will still trusting your team and your company or
organization.
Mustang the pieces of equipment to work with such as routers,
switches, and virtual machines, enables you to teach those who
aren't familiar.
So right here, me and my soldier.
Yet he showed me the Spectrum analyzer is hooked up to the
Phoenix.
The Spectrum analyzer basically just peaks where the satellites
at you can see if you get close to it, you can adjust the the
dish and just peak the.
Pick the signal to give the strongest ever you can get, so
he actually taught me a lot on this piece of equipment, so it's
just not me being the leader to having my soldiers show me how
to use this equipment.
So I could be the best leader I can for them.
Challenges in leadership some challenges that may come up are
having subordinates who have a problem taking orders for being
told how to do something.
There's only been a handful of times where I've had to.
Really hammered down when somebody about, you know,
showing up on time.
Listening when class is being taught on the pieces of
equipment because we had three different pieces of equipment
that we had to learn and we tabled tablets is basically the.
Basically a set up and tear down drill you set up get on the
bird.
Make sure you're passing data and then tear down right after
that.
We would do that maybe like 2 times after year.
I've done it in my old unit.
It bragged a handful of times.
But it's just.
Keeping your soldiers or keeping your subordinates informed,
ready to go so they know what they're doing.
And they felt no task because they know what they're doing.
Technology is constantly changing as time goes on.
In the last two decades, we have seen major updates when it comes
to technology, adjusting to different situations, to have a
proper training on the equipment before deploying it.
It would help network engineers and other supporting individuals
work more professionally, which ties into always informing
whoever you're working with.
It could be even peers or someone above that.
They're just not tracking what's going on.
Umm, another challenge is remote working could pose a challenge
ensuring your team is staying on task completing their work.
This will challenge the integrity of yourself as well as
the ones appointed under you, so we all went through the COVID
session and when I was at my last unit at Bragg.
We had to do remote work.
Not much was going on, basically just checking in, but you got to
make sure you're still doing your PT.
Umm, any progressive stuff you need to do, you need to be doing
it still port all that stuff so.
Leading IT projects.
So the first step, project initiation state to projects
objective escale and expected outcome.
So this is the point where you're.
The only way I know it is military style.
So you would have your Lt and your platoons on they have a
mission that brought down from the captain all the higher ups.
You get your pan up, you get explained how many users you're
to be supporting, what equipment is going to be used, are
redundancy or backup plans, umm, and who, who?
What team will we go out there with?
So and then the next step is the site survey.
I've done this before with my OT.
Basically, you just drive out.
I'm assuming if you do it in an office type situation you would
go to the office that you're going to be installing the
network equipment access points, cap fives, routers, switches,
firewalls and all that.
You would take down the information.
See where you're not?
Place everything.
When I did it, it was we're going to see where we're going
to put our satellite dish, where we're going to point it at using
the compass and all that.
So the site survey, while doing this activity, you will most
likely meet with the stakeholders and communicate
what services they need.
How many users they would be needed to be supported in that
building and how many access points and what type of security
they would want in place?
Leading IT projects continue.
Team building having a cohesive team that covers each field from
routing, cybersecurity, sat, com, cable management and
others.
And make sure everyone knows the task they need to be.
That needs to be accomplished so.
There's been times where I've had soldiers dead are.
Didn't know what was going on and how to provide how to hook
up the equipment and do these services, but that's why we have
this whole month of comics is just communication exercises to
train them up and get ready for.
Maybe their first mission or.
Setting up just the equipment, so practice, practice, practice.
It's a big thing for your team to be efficient and understand
what's going on.
So execution as a leader, you bounce around helping those need
it.
You are there to ensure the jobs getting done in a timely manner.
Make sure the jobs are being done to standard.
It communicate with stakeholders how work is going on and any
issues come up.
So from this.
I've worked with a 3 star general before and you would
have to communicate.
Hey this is how the networks looking if we're having any
latency issues satcon problems.
Umm.
Configuration issues.
You also have your worn officers there to help you out, which
would be your basically higher up network engineers and so they
world.
So you would just trying to handle everything you know the
lowest level is where I go into problem solving.
Also, just communicate with your continuous orange Lt so they can
communicate.
With the higher ups or your boss, whoever your team lead is
on that business situation.
So problem solving when it comes to solving issues such as
misconfigurations, it should be handled at the lowest level, as
I said, then move up once you exhausted your resources.
So reach out to your teammates, crew members.
They all have valuable knowledge.
One person could be specializing just IP.
Network configurations of the guide to be exported.
Firewalls setting up access points and so on and so forth.
So post implementation or AR if you don't know what AR is is on
army laying language for after action review.
So gather feedback from end users and stakeholders to
identify areas for improvement.
So after every mission, every business venture you go on and
it's available world you.
Document anything you any issues you run into.
Rather be like I said, configurations.
It's pretty supplement not talking to each other.
Other switches?
Firewalls.
Any any problems you run into?
Basically, document it, save it on the flash drive, put it
somewhere where you know it's secure, where you can have even
a team folder that holds all the issues you run into.
So in the future, when you do see that issue again, you know
the fix right away because you have it right there in the
folder right down the flash drive on the flash drive is kind
of hard to keep up with unless you really organized.
But the way we work, it'll get lost within the first two weeks.
So document it, go over it with the team.
Say, hey, this is what we can do better.
This is what we're going to practice on.
Just so you could be, as I said, proficient and efficient for the
next time you go out and do your job.
And finally, in conclusion, maybe I should projects could be
complex, but with careful planning, effective
communication, strong leadership and focus on delivering value to
the organization, IT leaders can increase the likelihood of
project success.
Additionally, ongoing learning and the application best
practices can help improve your ability to lead IT projects
effectively.
And here are my references.
That's me right there with the Phoenix striking the pose.
We always doing some learning how to get a little photo in,
you know, to make it look good.
So my company, but gotta sit.
I hope you enjoyed my presentation, so I wouldn't be
able to be here.
Had a not operation, had to do.
I hope you enjoyed it. Thanks.
Excellent job, Jose.
Great job.
You can hear me, but that was great.
Very nice to see for you know, the leaders that we have here.
This works really great with leadership.
Enjoyed it?
Thank you.
Umm, now we go on to nehemaris.
Are you ready?
No.
Like now I'm nervous.
I'm so nervous.
Y'all if y'all hear my voice shaking or like some heavy have
you breathing like y'all?
I'm nervous it's.
It's OK.
You're amongst friends.
A lot of you are doing it for the first time, so you
definitely got this.
Alright, so let's see if I can.
You're in the South.
You can hear me OK, right.
Yes.
I can you guys see my screen.
Yes.
We see our bubbles.
OK, OK.
I think I got it.
There we go.
Yep, right.
Thank you.
Here you go.
Alright, so as you guys can see my topic is going to be about
the dark wet.
Now, I'm sure we've all heard about it, but tonight, let's
just talk about it.
I'm going to be talking about the different layers of the web.
What is the dark web?
Why it exists?
How it could be?
No, not how what can be accessed on it.
What is Tor and a why we should avoid the dark web?
But let me first introduce myself.
My name is Nehemaris and if I maybe honest I didn't think this
was real like at all like to me the dark web was some
exaggerated glorification of dark hacking, illegal
destruction of the world in the black market.
It was something that I've always seen in heard about on TV
shows and in movies, though once I started my journey in
cybersecurity, I learned that the dark web is very real and it
should not be messed with.
So, and let's get back to the basics.
We're gonna start off with the three layers, the World Wide Web
is known to have three major components.
We have the surface web, the deep web and the dark web will
first be talking about the surface web.
This surface web consists of over 4 billion pages and
counting, and that only takes up about 10% of the whole web.
It can be accessed via standard search engines like Google
Chrome, Internet Explorer, Mozilla Firefox and many others.
It's also visible to all users of their Internet to look up
sites like blogs, news articles and any other public site
available using the search engines mentioned above, though,
as public and small as it may seem, it doesn't make it the
safest.
It's actually very easy to be vulnerable on the surface web
within those 4 billion sites, many of them are malicious sites
and scams that can cause harm.
So it's important to note that using a special security
services and practices will be beneficial to use in this level.
Next up, we have the deep web.
It's the largest layer of the three, going at about 90 to 95%
of the web.
It's the layer that's not so easily accessible, accessible as
the surface web.
The data here can't just be found on like a search engine
like Google.
These entities are usually accessed through some sort of
username and password, like type of login.
The deep web can be used to access databases, forums, social
media apps, emails, online banking, chat messages, health
records and fee for services sites.
Now, while it's important to be secure on the surface level,
this is the area where you really want to apply those
strong security practices, such as creating those long, strong
passwords and using a VPN service.
You might wanna think twice about accessing like your
private information while going online public networks.
Now onto the most dangerous part of the Internet, the dark web.
There is actually little to no information on how it got
created.
The dark web is the third part of the web level or the the
Internet, and it only takes up a very small portion of the
Internet.
But why is it there?
Or why does it exist?
Well, that's because it's the home for cyber criminals and
hackers.
Everything illegal you can find here?
Drug trafficking, illegal weapons fraud, contract
killings, cyber attacking services, and I'm sure there's
so much more at this point.
As crazy as it sounds, this world really does exist and I
just wanted to put in a side note on what cyber attacking
services can consist of, and that's bot Nets, which is short
for a robot network.
And there are a network of computers that are infected by
malware.
These include attacks about like email spams and DDoS attacks,
but that turn black market.
It's true.
Like there are illegal marketplaces and forums where
actual criminal activities are being conducted and discussed.
Now I don't know any specifics on what's being talked about, so
don't go and message me trying to get the tea on what's going
on, on the dark web.
I'm only here to inform you that such things do exist.
No.
Let me just start off by saying another thing that I'm not going
to show you what it looks like, how to use it or anything like
that.
It wasn't allowed for this presentation, which is cool.
No sweat, but I'm gonna inform you about something called tour.
Now tour is a network that allows for private web browsing.
It stands for the onion router.
It was or it's a browser that was created back in the mid
1990s and it was meant to keep like the US intelligence
secrets, safe and secure.
In the early 2000s, it was made available to the public as an
open source platform.
It operates by using 3 layers of encryption and a specific onion
style writing method routing method that allows users to be
anonymous instead of directly connecting your computer to a
website.
It bounces between the other users before delivering what's
wanted.
It allows for the user to browse the Internet, basically
minimizing the risk of being traced.
So if you look at this image here, you can see there's like 3
notes.
You have the entry node, the middle nodes and an exit node.
The entry node is when your data is being introduced to the tour
circuit, the middle nodes are.
This is where the encryption happens.
Your data is sent through multiple thousands and thousands
of nodes to quote unquote.
Replace your identity one after the other.
Say your data went through node A, then node P, then node K,
then node Y.
Why only knows the identity of node K who only knows the
identity of node P and so on and so forth.
This is how tore insures that or keeps that anonymous vibe within
its ohh network.
Then you have the exit node which allows the data to reach
its final server destination.
Sounds pretty cool, right?
Because it is overall, the network itself is safe and legal
to use.
It's even free.
Anyone can use it.
There might be someone who just wants a very or is a very
private person and does not want to risk like even the slightest
chance of being scammed or being a victim of identity theft to
occur.
Like you know, I've been there.
It's not fun.
Some government agencies still use Tor Major.
For for profit organizations like Walmart or PepsiCo,
journalists, activists like literally anyone can use it.
It's just those benefits of tour that creates these malicious and
criminal acts to occur, and I also wanted to mention as well
that even though it's purpose is to make people anonymous, you're
not 100% like out the.
There's always a loophole, and just because it's hard to find
you, it doesn't make it impossible.
So you're not, you know.
Umm umm.
What was that?
OK.
So it's important to say that.
You wanna say safe?
It's unfortunate to say as well that if there is any chance that
you've been hacked or your information has been exposed,
that it could already be in the dark web, ready for someone to
buy.
And yes, hackers will take personal information not only
for themselves, but to sell on the black market to another
criminal and make a profit out of it out of a you.
So get that anti malware protection, get a VPN, create
those long annoying complicated passwords.
For example, you don't want to use password 1234.
Instead, use something like how I have here.
I'm not gonna read this all out, but something that's unrelated
to you personally, but not completely foreign that you'd
forget it.
And here's a little cool that I wanted to share with everyone
because I thought it was important and it was very
informative.
If it's smart, it's vulnerable, so definitely keep that in mind
and this brings me to the end of my presentation.
Umm, it wasn't anything spectacular, but I hope it was,
you know, informative for anyone who may have needed it, or
anyone who may have just did it ever fresher.
I know for me this was very, very interesting because I'm new
into this field.
I come from like, you know, the medical field.
So in my journey of like learning on the IT side of
things, it was.
It's definitely interesting and this definitely caught my eye
so, but yeah, these are my resources here.
And everyone remember to stay safe and to keep off the dark
web.
That'll be it.
Thank you.
Excellent job.
Next.
That was great.
Very good.
Thank you.
And justice enough information.
Not for me, not to worry.
See, I told you.
I told you I was keeping it PG.
Yes, that was good.
It was good.
Very good.
Not get it right, not getting best with the spooky web.
Awesome.
All right.
No.
Who's next, Shay?
Yes, she is in the building.
With with your staging staging.
I am in the building.
Staging. Staging agrapha.
Steganography.
Yeah.
Thank you.
Yeah.
Because I couldn't say it.
Good job nehemaris.
You did good.
See.
Wasn't no thing.
Yeah. Excellent.
IT job.
Thank you.
Yes, ma'am.
I was even gonna say if you want me to go kind of break the ice,
you know, I was gonna volunteer, but I I know you got this.
You got this.
There she did great.
Uh.
Alright, let me see.
I'm going to share my screen.
We'll jump right into it.
Umm.
Let's see which screen do I want?
Choose which screen OK.
Uh, select this.
Let's see entire screen and I think it's gonna be this one.
Yeah, I5.
Can you guys see?
Is that the right one?
Yes, definitely.
OK, alright.
Good evening, everyone, and thank you for joining me in this
master class presentation on steganography, unveiling the art
of concealment.
I am your presenter, Shay.
Let's see.
So tonight's agenda.
I'm not gonna go through really fast because I really wanna jump
into the demo.
I'm gonna give you a brief definition and overview kind of
discuss its historical context, and then I'll discuss how it can
be used from both an ethical and unethical standpoint.
And then kind of highlight a a real world use case involving
the CIA and it's intelligence operations as it pertains to
Iran and later on China.
I'll also kind of go over the role steganography plays in how
information security is assessed and then, like I said, I have a
VM spun up, so I'm gonna jump in and give you guys a demo of how
easy it it actually is and the different, different ways that
you can utilize it.
Alright, so imagine a world where secrets are hidden in
plain sight, disguised within innocent looking images, audios
or text files.
Welcome to the realm of steganography, the art of covert
communication.
So what is steganography?
It's the technical definition.
Is derived from a steganos, which means covered or
concealed, and graphene, which means writing or drawing, and
it's basically the practice of hiding information within data
from a security standpoint, technology is the practice of
concealing one piece of information within another,
typically by hiding either like a message or data within
different files.
Images, Audio, even video, so that on the surface everything
appears to be normal.
The primary objective is to ensure that the hidden
information is not easily detectable by anyone who either
does not have the means to decrypt it or extract the data,
or even have knowledge of its its existence or word of look.
And that goes for both an ethical and unethical purposes.
Some people kind of confuse degregory with cryptography, but
where the two differ is that steganography is it's it's all
about concealing the fact that additional data even exists
where cryptography is concerned with protecting the data through
the use of algorithms.
Umm, ethical application.
It's it's a versatile technique that actually has numerous
legitimate uses across different fields with data security.
Steganography provides a solution that addresses concerns
of data, secure data transmission.
Umm.
Protection against data theft and sensitive document storage
organizations might use it as a means to ensure confidentiality
when data needs to be sent over public networks, hiding critical
data and otherwise meaningless looking files is another way
that it serves as an additional layer of defense by reducing the
likelihood that theft of that data will take place and
embedding critical information allows an organization to store
an archive it in such a manner that prevents unauthorized
access.
And one of the few instances where steganography isn't trying
to be so covert is in copyright protection.
And the most common form being the digital watermarks that
content creators used to safeguard their intellectual
property.
Kind of as seen in this picture here, where you kind of see it
preview.
So that's still considered steganography.
And then, of course, it's used to ensure the authenticity of
documents by acting as sort of like a digital signature.
Or, uh, fingerprint.
The goal is to make the product tamper proof and a perfect
example.
Uh that everyone knows about and probably handles on on a daily
basis as money.
Currency is a is A is another great example of how
steganography is is used and in the form of color shifting ink,
UV and infrared ink.
Michael printing hidden images and even security threads as
well as water marks.
Umm.
Now on the on the flip side for for most legitimate uses, there
are of course counterparts, so we're covert.
Communication is used to protect classified or secret.
You know, information we adaptively experience it.
Instances where criminals use steganography to hide
instructions, plans sensitive information and as I'll show you
payloads as well as stagers that will perform functions on their
behalf without much user interaction.
UM, they use this method as a meat of coordinating cyber
attacks and distributing malware, planning, criminal
operations, foreign intelligence agencies and spies, and even
perhaps terrorist groups might employ steganography and hang
out with nehemaris on the on the dark web, doing their onion tea
stuff.
Umm, a couple of weeks ago I remember Nick talked about
piracy and how one of the Rama ramifications of engaging in
theft of copyrighted material is that you might download
something that contains malware, which is probably the most kind
of common reason for using pirated software.
But steganography is also used as a means to circumvent digital
rights management protections.
What individuals will do is they'll hide copyrighted content
within legitimate files to evade detection, and then distribute
that copyrighted material illegally.
See, malicious actors can also hide stolen data if they're
trying to exfiltrate stuff, and they kind of wanna stay under
the radar and make it look like these things are normal
processes.
Then it it's a tactic that they'll use to make it harder
for security systems to detect.
Umm.
And then I'll show you kind of a a proof of concept later where
that can be done.
Criminals use it to embed malicious code and malware
within files, bypassing security measures and infecting target
systems, which will enable them to run commands, install
programs, communicate with the C2 server, et cetera, et cetera.
And feel great.
Great minds think alike.
Nehemaris I have a quote too.
Sometimes the most effective form of communication is the one
that no one notices and that was by David Goyer, who was a
screenwriter for The Dark Knight trilogy.
I'm a use case was the uh, CIA comes communication catastrophe.
So from around 2009 to 2013, the intelligence community kind of
like, experienced really crushing failures related to its
secret Internet based communication system, which was
a key means for remote messaging between CIA officers.
And then their sources, but primarily in China and Iran,
where the problem originated.
And then spider web to other countries, despite warnings
about what could happen, one of the largest failures occurred.
Umm.
Or started in Iran around 2009, which was a little after the
Stuxnet virus.
Umm, you know, Iran was kind of angered about the breach and the
damage that was caused by that virus.
And so they knew that there was some kind of Moore.
And it really didn't take him a lot of time to figure it out
because the communication system that the CIA was using was
extremely flawed.
Umm, the risks that are posed by the system appeared to have been
overlooked, in part because it was really easy to use, with
even the CIA's directorate saying that it was impregnable.
But, umm, about a year later, around 2010, Iran had already
started to identify CIA agents, and a year within a year after
that had already dismantled their network in that country.
Based on, you know, reports from other former intelligence
officials, the use of sloppy steganography and messaging
platforms that were operated by the CIA, and it's like over 300
websites had led to the capture and prosecution and most likely
execution of numerous Iranian informants who were working with
the United States and providing them with military intelligence
and other sensitive state secrets.
Umm, so the lesson here was even though it can be a powerful
means to conceal information, putting too much trust into that
methodology can lead to having like a false sense of security
and over confidence in one's ability to go and remain
undetected.
As we saw hubris, arrogance, and even a lack of conviction to
ensure a certain level of protection to those who are
helping you out, and ended up costing people their their lives
and freedom, and it really it really destroyed the trust and
credit credibility that you had asked the US had established
with Iranian nationals.
OK, demonstration time.
So before I kind of go into the VM, I'm gonna kind of just go
over briefly the tools that I'm gonna be using.
One of them is called Steg.
Hide.
It's a open source tool.
It works on all platforms, so it doesn't matter if you're running
Windows, Linux, Mac.
It'll work.
Umm Stag Hide allows users to embed a variety of data types
and it supports JPEG, uh, PNG, bitmap.
Although bitmap tends to be a little bit larger in size and
compressed formats like JPEG and PNG work better, wave files are
also supported.
The only downside to state hide is that movie files are not
supported.
Umm.
And then another important thing to remember is that if Steg hide
is used to embed data, it also must be used to extract it.
So this would be a tool that would be used between two
parties that wanna communicate covertly and use traditional
forms of communication to conduct their covert
communication.
So would already be understood that.
Umm.
Data or media that would be, you know, being sent over the wire
has some form of hidden message that they would, you know how to
they would on their end know how to extract and decode.
Umm.
And a cool feature about it is that you can password protect
the embedded data, so you set a password and whoever wants to
extract that data would need the password.
And the other one is a command line tool.
It's called Exif tool and this thing is like super powerful.
Umm, it has an extensive library for reading and writing and also
manipulating metadata which is like data about data just like
Steg hide.
It's also cross platform.
Umm.
And it doesn't stop at just audio and images for his
capabilities.
You can you can use EXIF tool for video RAW files, documents,
HTML.
You can you can embed stuff in fonts archives.
It can handle geospatial data data formats like GPX and GPS,
and it can even interact with file system metadata like
permissions and owner information and modify
timestamps on Unix and Linux environment.
So it's it's like it it, it's a really powerful tool.
So what I'll do is I'm gonna show you guys how I can embed
base 64 encoded scripting and and then utilize automation to
perform functions on a victims computer without them knowing
that I did anything.
So let me go ahead and jump into that and you guys see you still
see my my calia VM up.
Yes.
OK.
Alright.
So ah Dang, I still have my hunter stuff up.
OK, sorry.
OK.
Let's go ahead and get rid of you.
So we're gonna go into demo and I've already written out the
scripts and I'll I'll go over them so that you guys can see.
So we'll start with these pictures here.
These will be my starter pictures and I'll use one for
each different kind of different kind of demo.
The first one that I'm gonna do, I'm gonna go ahead and do the
steak.
Steak hide one.
And So what I have here are two, two different.
Can you guys?
Is it not big enough, right?
So I have two different scripts that I wrote me go ahead and
open this up and kind of show you what this one is so here.
What I've done is I've kind of created a some variables that
have some predefined information as far as where the secret file
is located, what kind of picture I'm gonna use, the name of the
output image, because once I embed this picture with this
file, it'll output this image.
This is the pass phrase that I'm gonna use.
Just keep it simple.
I have some error checking here, so this is kind of my way of
like seeing if there's, if there's any bugs then I get
little messages, but I've already.
I've already kind of gone through this and it worked just
fine, so this right here, this particular this particular
script would simply just encode the.
Or embed the image.
It's gonna take this file right here and it's going to put it in
this picture.
And then this picture will have another picture and that would
be the one that I would send to whoever I want to communicate
with.
And then, uh, on their end, we would just pretend like they got
the picture.
This would be something that they would have to do to.
Extract the uh the file, and so here.
Here's what they would run they would, you know, extract here
more variables to define locations and pass phrases, and
then the actual, umm, extracting the file is this one right here?
Is this state hide extract umm it calls this variable here and
output file uses the pass phrase and So what I did was I decided
to use the demo Umm directory and this file name to show how
this file and then where it will.
The other one will show up over here and this file will be the
same, so I'll pull up their terminal.
And.
Go ahead and.
Ribs.
Alright, so for the first one I'll do Steg hide.
Go ahead and run that and you see here.
Oops.
Can I zoom in on this?
Dang it, I can't.
I don't know how.
At least they don't.
So here you see file and better successfully with passphrase.
And as we can see, here is our other picture.
Umm, you'll also notice that the size of this file is a little
bit bigger here since 205 and it says 192.
So it has now this file in it and the other person would then
get this picture.
You'd already prearranged the password that you would need to
extract it, so I'll go ahead and you'll see as I run this.
As I run this other command, there's other program.
Uh, the text file pop up over here.
Ohh, we're gonna have Stagg.
Unhide.
And there it is.
So here is the extracted file.
I'll go ahead and open this up.
The secret message and just for a confirmation proof of concept,
we'll pull this one up secret file and you see they're the
same.
Alright, now for the other one.
Umm, the other one is gonna be a little bit more malicious or
candy.
It is as an example how malicious actors can use this
kind of tactic to umm.
Had you know, do remote code execution, download, install and
really kind of run amuck?
Umm, so again it's a two part thing where I have a payload and
I have a stager umm, I'll go ahead and start with the payload
and show you what this looks like.
So what this is doing here is this is gonna be the proof of
concept that I have access to a system and that I can install.
I can install files on someones net on someones system with this
is doing.
Here is it's creating a variable that I later call to a past due
to be encoded and I then embed base 64 content into a picture
and then what I will do is.
Create my own user defined metadata tag called certificates
so that it looks professional or anything that you wouldn't kind
of like you know, an unsuspecting person wouldn't
wouldn't think twice about it.
It it creates its own user.
I create my own user defined meta tag and then I umm embed
the base 64 command.
So this is what would get embedded as base 64 content, the
stager and what I'm gonna do is I'm gonna like on purpose.
Uh.
Kind of like make it hang so that you'll see that the error
checking at the bottom.
You'll see this come up because when you go to execute where you
actually need to download it, it needs to then be extracted,
converted again and then evaluated.
There's a.
There's a thing that I wanted to show you guys the difference
between just pulling a URL and then having to like go a little
one like one step further and.
Getting the complete of URL with the the pictures extension so
that it downloads properly.
Uh here.
I would then put the URL in this place.
I left it open cause I don't know what it's gonna be yet.
I'm in this section.
I'm defining my my my staging directory and the name of the
picture that I'm going to be downloading.
The output file of it.
I've got some more error checking here where there's any
kind of issues, it'll tell me that it didn't download over
here.
This is the part where I'm extracting the data, so I'm
running exit tool again and I'm piping it into AWK where I'm.
Isolating that line where it's that that user defined meta tag
and then deleting uh spaces and and colons and I'm just pulling.
What would be then the second column?
That's what this party here is.
And so all I have is in in my variable.
Just the basic 64 encoded content.
I then bring it over here to where I'm gonna go ahead and
type that into base 64 to decode, and then once it's been
converted into this again, I'm going to go ahead and execute
it.
And then at the end I do a little bit of cleanup.
So I will put the just like again for proof of concept.
This is where the file will show up if all this stuff runs
correctly and and then I do clean up.
So I go back.
I make sure that the temp directory is deleted so that
there's no.
There's no proof that I was there.
There's no cookies, there's no Iocs or anything like that.
So first thing is to go ahead and run.
The payload.
So go ahead and run.
And you should see here again, whale and whale GPG original.
So this is the original file.
This is without the the encoding.
This is the one that does have the encoding.
It's very small as you see.
That's not really a a major change in the size of the file
and to kind of get an idea of what it would look like.
We're just gonna run exit tool.
I'm gonna go ahead and pull this in here and you'll get to see
right here.
Certificate is what I defined and here is my base 64 payload.
Umm. Oops.
And to look at this one so that you can see the difference
between the two, the two excuse me, umm.
There is no certificate part here, just it is been completely
stripped.
Umm, so now I need to upload it.
So we're gonna host it, and I mean this kind of scary because
this is a a site that I found that does image hosting, you
know, bookmarks.
And you don't even need to like log in, you don't need to
register, you don't need to sign up for anything.
You can create an account, but as you'll see it would be like a
perfect place for somebody who's, you know, doing some
nefarious stuff to stage their their malware.
And I'll show you just how simple it is.
I'm gonna go ahead and take my picture.
This is the one that's that's infected.
I was gonna drag it right here and I can have the picture be
auto deleted in as little as 5 minutes after I upload it, so it
will.
It won't even leave any kind of trace on here, and it's gonna
upload with that base 64 encoding.
OK.
Now we're going to go ahead and open this link.
So what I'm gonna do is I'm gonna show you first what not to
do.
You what you would typically do when you're using like.
URL's is you would go ahead and plug this into.
There's my OK, they load stager.
I would plug this in right here.
Go ahead and save it.
And I'm gonna run this.
And you see my error right here.
File not found in demo well.
Everything worked except extraction, because what ended
up occurring was and and we can see that it it downloaded just
fine cause I'll go to my temp folder and we see there it is,
but the problem is there's actually 2 problems.
One, I pulled this page which can't, which came with a bunch
of garbage that I don't want and it also stripped what I needed
the most.
Most umm.
So let's go ahead and find out what it really contained.
Oops.
You notice it's got all this garbage here, whales.
It's Facebook stuff.
Image upload but no certificate and it was replaced with this
token.
So what do we do?
How do we fix it?
Well, we go here to share and we pull this part.
Oops.
Come on, you.
Alright.
Go ahead and pull that.
I'm gonna replace my code.
With the full path.
I'm going to go ahead and save it.
I'm gonna go back to my terminal.
And and working.
I'm going to go ahead and remove.
That image file and now I'm going to rerun it and we should
see a you've been hacked.
File pop up.
Boom.
There it is.
You've been hacked.
I could encrypt files, I could let them know this is the only
document you're gonna see.
Here's how you give me your money.
Just where you gotta send your stuff to.
I'm hanging out on the dark web and to double check we see that.
It's no longer there because I cleaned it up.
And yeah, so let me pull this up.
Any questions?
I'm gonna go ahead and stop sharing.
Any questions?
Yay.
Nay no.
Umm, I'm just it was very cool.
Yeah.
That was very cool.
But you see, this is stuff I was trying to talk about.
Yeah, exactly.
She nehemaris nehemaris playing like she don't know.
See, that's good.
Yeah.
That's good.
She keeping her cover.
She, like Mr Robot, going to going and and, you know, working
She actually got, yeah.
as just a little quiet security consultant during the day at
night Western people and exposing them.
I'm dying.
Having a cop showing up, but no.
I think she, yeah.
Yeah.
So it's it's it's like it's it's scary how easy it is.
But imagine if I were to just use like and Kali is like really
cool.
Like there's a lot of cool tools in Kali.
It's got its own social engineering toolkit where I mean
you can you can hide stuff that is very quiet and it's it's very
portable.
I can send you something that I'm pretty sure with, you know
with with some like OSINT, some good osen get you to click on
something that looks like it's trusted.
You won't even know that there was anything wrong with it,
because it's all done in the background and it it will like
kind of hijack already running processes.
So it you, it's what it's it uses what's called as like
living off the land there there's a term for Lobos living
off the land where you're basically using the host
machines or your target machines its own.
Its own environment, stuff that it it's is normal to it. It's
system.
Umm you click on this document I just I I'm waiting.
I'm like, I'm on.
I'm on my end.
I've got a, you know, I opened up a little.
A little server that I'm that that I'm listening on on a
certain port.
I mean, I busted out Python And I got I got my port listening
for your connection.
You connect to me and now I have access to your machine.
See, it's it's one thing to, like, try to get into a a, a a
person's, you know, home network by going through their router.
Router that's harder because you'd have to like hack the
router.
You'd have to go in, do some port forwarding.
There still may be like some security in place where it
doesn't allow certain kind of connections, but the thing about
firewalls is it's like it's like it's like the the the the guy
that collects or the woman that collects your ticket at a
sporting event.
You can't get into the sporting event unless you get your
ticket, but it it don't care who's leaving.
And that's the same way with like network traffic.
When you wanna go look at the web, the firewall don't care.
It's like, yeah, I'm letting everything come out because it's
coming from within your private network.
So it it's already kind of feeling like this.
Everything is trusted, so a reverse shell is just simply you
on your end saying hey, I wanna talk to you without you knowing.
You even wanted to talk to me because I'm so cool.
And then once I have that, once I have that connection, then I
See, that's just, yeah.
go in and I'm doing all this stuff on your on your end, I'm
going in and I'm.
I'm I'm using the command line to you know to curl and download
documents.
I've already got the stuff set up on my own side.
I'm ready.
I'm waiting and then, Oh yeah.
Oh yeah, you guys can't see anymore.
But yeah, I go back to my umm image upload I.
But that that is that is the crazy.
That's the crazy, scary part is being able to get into someone
Yeah.
else's system and do those things to them.
And and it's like I don't have any questions.
Yeah.
I'm just kind of, you know, back in why I've stopped watching
those cyber hacking shows.
Well, you know, nehemaris kind of like, you know, did me a
solid by introducing the first half of how this stuff is
Umm.
actually done.
I go through a VPN.
I use a proxy chaining.
Totally opened it up for you.
Yeah, I I I, I I go, I use a VPN, I use proxy chaining and
tour A.
You know the Tor browser?
Umm I upload my picture that has absolutely no personal
identifiable information cause I've stripped all the metadata
from it.
I've only curated what I wanted to put into it.
I found a site that doesn't ask me for my name, my phone number,
my address, my email.
I don't need to go check no confirmation.
I don't have to get multifactor out, you know, I don't have to
do none of that.
I simply drag and drop.
I get a link and in 5 minutes it's gone and even if you were.
Well, you have to wonder what that what that image.
Ohh website has to do.
What are they doing in the background too?
You know it.
Well, that's to say, if even if they are, even if they are
It's there for a reason.
LOGGING.
You know traffic, guess what, I I just, I came I get you guys up
from Finland.
My my tour, like the the cool thing about VPN and then that
tour.
Is that what they?
What they see is an IP address from somewhere else and it goes
Yep.
to at least three like.
That's the minimum is 3 and if if if I'm doing it on my
computer, I first gonna establish how I'm gonna do like
if I really if I wanted to do it and I know I I wouldn't get like
it would be very hard to trace it back.
I would set up a I would actually set up a bastion
server, so I would do a VPN into a cloud EC2 instance that's
running a.
That.
That that's running VPN software because free VPN they're still
selling your stuff.
Like if you see VPN services you can get free free VPN and
Yeah.
they're most likely selling your information to be able to cover
the.
The you know the the the cost of of hosting your your, your, your
your browsing.
They also will kind of like reduce how much browsing you can
do, so you won't be able to have a lot of data.
So they'll have a limit on it, but I would I would actually set
up my own.
I'd have my own like firewalls in place.
Umm.
And I would do it through like a cloud server and then so I would
connect from my computer through the through the VPN on a cloud
server.
From there, I'm gonna use what's known as tails.
I actually talked about this yesterday with Gary.
There's an operating system called Tails which is called the
mnesia GC Incognito live system.
It doesn't store any of whatever you're doing while you're on it.
I'd run through tails through its Tor browser, and I would.
I would actually do like maybe eight or nine different
connections for proxy chaining.
So by the time I get to image upload I've I've routed through
seven countries VPN VPN tunnel.
A bastion, router and a cloud server that's running my own VPN
software, and then I'm on and then it comes back to to my
home, and even then I might not.
Even I might not even use my own router.
I mean, I probably hack somebody else and.
Right.
You're right, Gary.
He yeah, you can hear the passion to.
He's definitely found what he likes to do.
That's for sure.
Ohh yeah.
And you better leave your mic on.
Ohh yeah.
What?
So we can hear somebody comes to, you know, if the feds come
banging down your door so.
You know, they're already listening.
I you know, and I'm not even worried.
Yeah, I know, right?
We, we, we, we, me and Gary, we we be talking about it like you
know what?
I'm all for the NSA.
Let them know how I can, how I get down.
Yeah, that's what I say.
I'm Middle Eastern too.
They can.
They can come here.
You know what I'm saying?
They won't find anything.
I don't mind.
I hope you, I hope they listen and please be paying attention.
Yes, I am Middle Eastern.
Yeah, pay attention and you'll work for them.
You know what I'm saying?
But I am American.
You have no problems working for them and showing them how it's
No, no, no, I don't.
done exactly.
I don't.
All right.
I don't care.
We should move on because we have a lot of people to go on,
but this was this was great.
It was a excellent, very good information.
Nice.
Thank you.
They're going.
Thank you.
I appreciate it.
Appreciate it.
Yes.
Umm.
Sharlene, I believe you are next.
Hi everyone.
Hello.
And just share my screen.
Can you guys see this right here?
Yes.
OK, awesome.
OK, so my presentation is about conflict resolution.
So what is conflict?
Conflict is opposing views that caused disagreements between
people.
I'm sure that a lot of you have been working for a good amount
of time, whether you like it or not, you'll encounter conflict
in the workplace even if you try your best to avoid it.
Sometimes conflict can be work related, other times it might be
personal.
Every even people who consider themselves as laid back and
easygoing can find themselves stuck in a conflict.
This is something that we all faced one way or the other, and
it's best to think of how he would handle things when you're
faced with a situation.
I'm currently in a management role, but before I was promoted
I was the type to keep my head down at work, do the task that
I'm supposed to do, try to do my best and go home even though I
tried to keep to myself, I was still faced with conflicts that
had to address.
If you do a search online, you will find that there are a lot
of different types of conflict, but I chose these three because
these cover a good range of conflicts in the workplace.
Past conflict pertains to opinions on topics that relate
to employee expectations, resources, and policies.
These are policies and expectations on what the
employee is responsible for.
Examples are computer use attendance policies or meeting
deadlines.
Relationship conflict is about differences between employees.
This can range from personality for styles and how one handles
issues that may arise.
This refers to someone being and how they operate as a person.
It could be that someone is an introvert, extrovert, type A or
type B, someone who is reserved versus someone who is very
outspoken.
Value conflict refers to their belief systems, such as morals,
culture, politics, religion and diversity.
It's whether someone is a Democrat, Republican, atheist,
Christian, Pro choice, or pro life.
There are a few things that can cause conflict.
Miscommunications can pertain to expectations that have been set,
but we're not interpreted correctly by an employee.
For example, if I type a boss signs an employee a task but
does not give them a deadline, the employee may expect that is
not a high priority item.
But since the boss has a type A personality, they probably
expect for you to complete that task ASAP, even though they
renote deadlines mentioned differences in values can be
simple as someone not liking a person after they find out what
political party they belong to you.
There are a lot of different types of personalities at work,
and sometimes some of this people just don't mesh well
together.
Someone who has a very high sense of urgency paired with
someone who works at a slower pace may not be a good fit
depending on the project, managers need to be aware that
every decision they make can potentially result in a
conflict, and they need to be mindful of who it will impact
and what solutions they could bring to the table.
It is best to always think steps ahead instead of only thinking
of the present moment.
When an issue is not addressed, it will keep occurring.
The person, for all you know, may not even know that they are
doing something wrong.
On the other hand, a person may deliberately be doing what
they're not supposed to because they know that they are getting
away with it.
Since no one has said something to them, if you bring it to
their attention, they are given the opportunity to change.
Their behavior depending on how problematic the issue is, you
may have to go down the chain of command.
If the problem does not get fixed after talking to the
individual, for example if the employee is an office
administrator, your complaint should go to their direct
manager.
If that direct manager does not correct that behavior after a
given amount of time, and the problem still persist escalated
to the general manager.
If that does not get resolved, go to next person and that could
be the district manager and your last stop should be HR.
Start from the lower level first, then work your way up.
Depending on the circumstance, the manager that you report the
issue to may even escalate it themselves.
There are different problems that may arise from the
workplace.
An issue with dress code shall be handled differently than
someone who is drinking on the job.
If an employee constantly gets away with not submitting their
work on time, the high performing employees may start
feeling resentful of management because they feel that they are
not treating everyone equally and management is playing
favorites.
Not only can this be damaging to your relationship with your
coworkers, but this can also result in low morale and the
company and can hurt productivity.
Umm, there are different benefits to conflict resolution.
It could reduce trust if you had an issue at work, you know how
stressful it is and how we can get.
There have been countless nights where I tossed and turned in bed
stressing out about my work day.
In the morning, you end up losing sleep and you're more
irritable than usual, and it could start spilling into your
personal life as well.
Conflict resolution can improve performance once the issue gets
addressed, it will be a big weight off your shoulders and
you can focus on more important things.
You can then start focusing on how we can perform your tasks
effectively and efficiently.
I've had conflicts in the past where you could sue me to the
point where I was reading my emails, but I could not
comprehend what I was reading because I was so flustered by
the situation.
Conflict resolution can demonstrate competency and
increase trust.
If there is a perceived conflict, you can ask your
coworkers to clarify what they meant.
If it was something that you took offense to, even if there
are opposing views, the other person can explain their point
of view.
Sometimes, even if you don't have the same release, you may
understand when someone is coming from and their actions
were not meant to be hurtful.
This can show others that you are open to dialogue and that
you are willing to discuss difference in a professional
manner.
Conflict resolution can advance to you to leadership being able
to step up and address the problem head on May show others
that you're not afraid to tackle hard issues that no one wants to
address.
If you handle situations correctly, this could show
everyone that you could remain calm under pressure and you have
everything under control.
The escalating a situation is not a skill that everyone
automatically has, but with enough practice it could come a
second of nature.
There are different styles and conflict resolution I could
accommodating.
Style is putting others concerns first before yours.
Even if you think someone is wrong, you simply agree to this.
Agree to keep the peace.
These conflict styles don't do the applied to coworkers.
They could apply to customers as well, in addition to
relationships in your personal life and this type of style, you
can be accommodating to customers whether needs because
you want to give them a good experience with your company.
Avoiding style is when someone ignores the problem altogether
and hope that it goes away.
Compromising style is finding a way to meet in the middle.
An example is if a customer was not happy with their experience
with your company, you could offer them a discount on their
next purchase and that usually helps move things over.
Collaborating style is finding a solution that everyone that
everybody can be happy with.
When I started working for the company that I'm currently with,
the start time for work was 7:00 AM.
They noticed that I was sluggish in the morning, but I still got
the work done and my boss didn't really have a problem with it,
but she was slightly bothered.
So my boss asked me and the question that made her realize
that it worked a second job.
She asked me what time I thought would be a great time start time
for me and I told her 9:00 AM would be great even though I
didn't expect for her to change my start time.
She did ended up changing start time to 9:00 AM with the
expectation that I still did my 8 hour shift and if I needed to
come in earlier than 9:00 AM, it was.
That was more than welcome to you.
Really appreciate it at that.
So competing style is sticking to your own views and not
compromising with anyone.
It could be an employee who is complaining about the dress code
policy, but you stick to the policy and knowing that is the
same across the board and it is fair for everyone.
Active listening involves allowing the other person to
talk by giving them your full attention.
Do not interrupt them while they're talking, and let them
finish what they have to say.
Allow for them to finish their train of thought.
Try not to think of your response while the person is
talking.
If you are too worried about what you are going to say next,
you will not hear the other person side of the story because
you are too wrapped up in your own thoughts.
Make eye contact with a person while they are talking, but be
aware of how you're looking at them.
I actually had the problem with this problem as a kid.
Whenever my mom would reprimand me, I would have eye contact,
but she told me I look like I wanted to kill her.
Ohh I'm working on that as an adult right now and kind of
challenging to be quite honest and be aware of your body
language, how you're sitting down during a conversation can
show your interest or lack of thereof.
If you are slouching, this shows your disinterest in what the
other person has to say.
If you're leaning forward, this shows that you are listening and
are open in what they are discussing with you.
Being assertive does not necessarily mean that you are
asserting dominance.
This simply means that you could speak up for yourself in a
respectful manner, be direct but not disrespectful.
Try not to raise your voice when you're speaking about something
that you're passionate about instead of being heard.
This can trigger the other person's fight or flight
response instead of being able to have a productive
conversation.
So I'm sure that you guys see the videos online and they call
people Karens.
It's because instead of having a polite conversation while still
being assertive, those people tend to throw a fit and nobody
ends up talking well, taking them seriously.
When having a discussion, try to understand with the other person
is coming from, maybe they are going through something personal
outside of the conflict that you are both faced with.
Yes, it does not allow them the right to act in a negative way,
but you are also helping them realize that our actions are
also affecting others around them.
And it's not just the word being affected by it.
Having empathy for others to allow for you to be more
forgiving when you know that circumstances they are faced
with.
When conflict initially happens, it would be best to clear things
up right away.
This way there can be no misunderstandings.
It is good to paraphrase what you think the other person has
said and repeated to them so the other person can confirm whether
you're not fully understood what they had said, even after
exhausting it through an understanding what the conflict
is, you may not still not agree with the other person.
This will be the time to brainstorm on other possible
outcomes where you could both agree.
If that still does not work, find a private place where you
can discuss the conflict.
It's unprofessional to discuss your conflict out in the oven,
and it makes everyone who is not involved uncomfortable.
Others also don't need to know what you are having the conflict
with.
Someone, that is how we're gossip is started in the 1st
place and some like to insert themselves even though the
conflict does not pertain to them.
Hear what the other person has to say and practice active
listening.
If you are not sure you understand the other person
correctly, ask for a clarification as to what they
meant and do not assume again pier phrase what they said to
confirm that you understand.
If there are more than two people involved in the conflict,
ask for others to share their thoughts and opinions to the
group.
They may have different insights and may bring a different light
to the conversation depending on the conflict.
You may have to identify a common goal and start breaking
towards it.
Who knows?
You know, you may have the same vision, but different ways of
working towards the goal.
Pros and cons could be discussed and brainstorming should occur
for both parties to come to an agreement.
If both parties still cannot come to an agreement, you may
have to invite a third party to sit in during your conflict
resolution.
It is best to find someone who is neutral to the conflict.
The mediator basically is there as a referee who can make sure
that both sides are getting their turn to express
themselves.
They can make sure that the conversation remains respectful
while getting their points across an action plan should be
made as to how all the conflict would be handled moving forward.
So in conclusion, if everyone just sat down to discuss their
differences, it will bring everyone closer together because
they will have a better understanding with how the
person operates, operates and misunderstandings can be
clarified.
The more you know about how another person thinks or views
things, the better your team can perform.
You can gain much mutual respect by being able to respectfully
sit down and listen to another person with an opposing view
when problems are discussed and solutions are made, team morale
goes up.
B.
More open to other people's differences.
So thank you for coming to my Ted talk.
And here are my references.
Great job.
Thank you.
Loved it.
Lots of good information.
A lot of things we don't realize we need to remember and
understand when you're speaking with someone.
And I hate to say it.
I love and hate the care and videos so.
I did too.
Doing yard as they're so entertaining.
They are, but I'm like, oh, my God, how could they be like
that? Oh.
What a novel person.
OK, next is Anna.
Hi everyone.
Let me share my screen.
And if you can just confirm that you can see it.
I can see it.
So my presentation topic is on managing risk in an organization
and this probably looks very familiar.
So it happened that Sharlene and I selected the same PowerPoint
team.
Good taste rolling.
So this is my second masterclass presentation, and perhaps before
I'm gonna start I should give a little background.
Maybe introduction.
So when comes to risk management, you know, I'm
familiar.
Just not.
Probably many of you with risk assessment and many different
parts of the whole process, but I did have an understanding that
there was a much bigger picture here, a much larger pro process
and I just want to take this opportunity to discover what the
whole process is.
And you know from beginning for an organization how to set it up
and how to be effective have an effective risk management.
So cybersecurity risk management is an ongoing and systematic
process in which we identify, analyze, evaluate, and address
threats to organizations, operations and its mission.
And the primary goal is to maintain, maintain the
confidentiality, integrity and availability of critical asset
against all threats and vulnerabilities.
It provides a structure approach that helps organizations
anticipate and address threats that could affect the company's
ability to meet strategic, operational, financial and
compliance calls, benefits, risk management is important because
it assesses the companies current service security risk
profile.
In tune, it informs the decisions the organization will
make moving forward in order to reduce the level of risk and
address vulnerabilities in a comprehensive and consistent
manner.
It also offers an organizational wide situational awareness that
provides ability to look like all the information available.
Recognize what's important and have a clear understanding of
the risks.
And then it allows the organization to act accordingly.
There are several sub security security management frameworks
available, each designed to help organization, assess, manage and
mitigate this.
The service secure the risks, so there are this form.
Frameworks vary in scope, focus and applicability.
Some are developed specifically to guide the risk management
process, such as the factor analysis of information risk,
the fair framework for understanding, analyzing and
quantifying information risk.
In financial terms, all the NIST risk management framework there
are MF and the supporting publication.
Then this special publication 830 thirty 739, which have been
developed by the National Institute of Standards and
Technology to Guide Risk Assessment and management, the
NIST RMF is one of the most widely recognized and commonly
used service security risk management frameworks.
There are also other frameworks where the risk management
guidelines are just the path of of a wider scope, and those are
for example the ISO 27,000 and one which provides standards for
establishing, establishing, implementing and maintaining,
and also continued improving the information security management
systems.
And there is also the Nestable security framework, which
provides a comprehensive set of guidelines, guidelines and best
practices for generations to manage and reduce their
cybersecurity risk overall.
So the developing a risk management program within
organization initially involves identifying what it is that the
organization needs to protect.
The first step is to identify assets that that have value or
recruited or a critical to the operation and mission of the
organization, and those can range from people such as
employees, customers, business partners, contractors, to
information like intellectual property or PII or software
system physical assets like buildings, plant equipment,
cars, storage media or even paper prints to outsource
conclusion services.
Third party providers, supply chain or even a corporate
identity in the second step, we would want to assign value to
those assets or a relative relative word that does assets
represent to an organization and we do that by determining the
the assets criticality which is based on adverse impact to the
organization that the business functions or the operations.
If those assets were to be compromised, the NIST risk
management framework guides us to categorize all of those
assets, value as low, moderate or high.
And there is also a publication that has been developed by list,
and this is the federal information processing standard.
The flips one 99199, which provides standards for
categorizing all of the secure assets and the information,
which is a really good resource.
So next we would want to perform a comprehensive risk assessment
and that starts with recognizing potential threats to those
assets that we have previously identified.
And then we would want to determine the likelihood that
those those, those threads can be compromised or or or the
threads that can be compromised from the uh, then and then.
Finally, we would want to define the vulnerability, which is
weaknesses or flaws in organizations secure posture
that expose the assets to some type of danger or compromise.
And finally, based on all of those factors, we then define
the severity of risk and there are two approaches here.
One is the qualitative, which is based on observation.
It may, we may assign value as low, medium or high in here and
then the second the other one is quantitative approach which I'm
this is where the risk calculation attempts to create
hard numbers using for example a historical data.
And there is at least special publication 830 that provides a
a guide for conducting Chris assessments.
Again, it's a.
It's a fantastic resource.
So now that we have identified the risk to to, to, to assets,
we need to develop a mitigation strategies and the best way to
do that is by selecting and then implementing security controls
or practices to safeguard the information systems and the
assets within an organization.
And there are many frameworks to choose from in here, but the
most widely used by all branches of the federal government and
then adopted by many other industries throughout the whole
world, is the next special publication 853 Framework.
It is this framework is like a catalog of secure controls.
It consists of 20 domains of families and over 1000 controls.
That organization can choose from to design their very own
security program.
It is designed to be tailored based on the organization risk
tolerance, the mission and the system environment, which means
that organizational will need to adapt a subset of the controls
that are most applicable to their very own needs, and the
controls are intentionally also not focused on any specific
technology.
So so you want to think of the all of them as goals, where each
organization will have to adapt a customized approach for
achieving those goals based on their own situation or their own
environment.
Again, and then once we select a set of secure controls, we would
then the next step is to implement them and the
implementation includes operational management and
technical security controls, which means that besides
installing let's say new technologies or configuring
secure settings, there are other types of activities that are
also critical such as implementing policies, plans and
operational procedures.
Uh performing comprehensive employee training, building into
the response internal capabilities and governments.
Just few.
Also, there are some things to consider while selecting the
controls.
Umm, things like regulatory compliance, which usually is
tied to the type of data that the company handles or other
industry specific requirements.
Things to consider are again, confidentiality, integrity and
availability priority based on the business needs and the
business profile and the business risk tolerance.
Next, we would want to develop a strategy to manage the risk or a
strategy to continually reduce risk to a level that is
considered acceptable to the organization.
Uh, which is also called the risk appetite and the first step
in this process is to assess the controls and we can do that by
testing the implementation to determine the security control
effectiveness.
In another words, are the controls implemented correctly?
Are they operating as intended and meeting the security
requirements for the systems and the environment in operation?
So there are three assessment methods in here.
The first ones interview individuals or group of
individuals.
The second one is examining the specification, the mechanism or
activities such as examination of the documentation pauses
software functionalities or system administration, and the
third one is testing of those mechanisms or activities.
And then, umm, next, we would want to umm make sure that the
system, well the system needs to be authorized and this is where
the authorizing official within the organization examines the
results of the Secure control assessment, the gap assessment
to determine whether or not the residual risk is acceptable for
their organization.
And then finally after that we would want to continuously
monitor the controls.
So incorporating incorporate all the monitoring into an
integrated organizational wide monitoring program and which
will be looking and continually searching for any changes or any
signs of attack.
And we also need to reassess the controls effectiveness on a
regular basis, which means the performing the gap assessment at
minimum once a year.
So those are the six steps of the complete risk management
framework.
And here are my references.
And I hope you enjoy my presentation.
Are there any questions or comments?
That was great.
So much so.
Ah, we need to do a risk assessment for PGIP.
I have said this for years and years and years and we just
haven't done it.
Awesome.
Thank you.
No, I will be calling on you for that as soon as I get it through
with the exact and stuff, we'll get that figured out because we
really do need to get that for all departments and for PGIP.
We don't wanna lose everything.
Great job, excellent job.
Thank you.
OK, I will show the one for James now and tell you what.
Let's do Abyan.
Uh, you go ahead and then I'll show James because it's a
recording.
You guys can always watch that at another time if you want to.
You.
But let's go ahead with Abyan.
You can do.
You can present yours.
OK.
Hello, can you hear me?
Yes.
OK, let me see how I can.
Screen share this.
Let me I'm sorry.
Here it is.
OK.
Can you see the screen please?
I see your calendar.
OK.
Uh, do you see the presentation?
Now I see it, yes.
OK, so if I can just.
Sure.
Oh, look, I'm sorry this I don't really use this.
I'm sorry.
You can hit the at the bottom of the screen.
Hit that little.
Looks like a book.
This one.
Yeah.
Ah yes, here it is.
Thank you.
OK.
So hello everyone.
Today my presentation will be about holding a professional
image.
Instead of security, however, you can.
This can be taken in any sort of field, but because I'm security
I'll be doing for sub security.
While maintaining a professional image is essential, it is also
critical to recognize that step security is a field driven by
expertise and results.
Concentrating solely on appearance, appearance related
factors can be deceptive.
This presentation seeks to broaden the audience's
perspective by emphasizing that a professional image consists of
more than just an attire and behaviors.
It entails constantly honing your skills, staying current
among emergency trends, emergency threats.
I have been participating in professional networks and
showcasing your achievements, but emphasis causing these
aspects.
You will not only project competency credibility, but you
will also lay the groundwork for long term success in
cybersecurity.
Remember that it is your combination of professional
image and substantive expertise that truly distinguish yourself
in this industry.
While a professional appearance is important, is also important
to understand that service security professionals aren't
defined solely by their clothing.
The emphasis on an on developing a sponsor, the emphasis on
developing a responsible and competent mindset.
Dressing professionally is only one aspect of presenting a
professional image.
It's critical to demonstrate your expertise through your work
by staying up to date on latest security trends and
demonstrating your dedication to protecting digital assets.
Remember that professionalism is more than just what you wear.
It is also about your actions and expertise.
A neat and appropriate experience appearance is
essential and SAB security, professionalism and attention to
detail are reflected in well fitting wrinkle free attire,
excessive jewelry, bright colors and casual clothing should be
avoided.
Should be avoided.
Europeans demonstrates aspect for your organization and
dedication to excellence.
However, it is critical to remember that while appearance
is important, it should not take precedence over core
competencies.
Mr Strive for a polished image while putting the substance of
your sub security work first.
Maintaining a professional appearance is extremely
important.
Substituting industry casual clothing, such as jeans,
T-shirts and sneakers, is generally regarded as
unprofessional and may harm your credibility and reputation.
Casual attire can beat the message that you may not take
your job or or organization seriously.
We demonstrate a company, a commitment to professional
realism, and convey a sense of seriousness and dedication to
your role in SAP security by adhering to a more formal dress
code.
Remember that you're tired.
Is an outward reflection of your professionalism and should be in
line with industry standards.
It is critical to follow appropriate attire guidelines in
any workplace, including this app security industry.
This includes avoiding provocative or revealing
clothing, which can cause distractions, discomfort, and
conveyed unprofessional or disrespectful image.
You can you contribute to a focus and respect of respectful
work environment by maintaining a professional image.
Dressing properly.
Not only promotes a cohesive and professional environment, but
also shows respect for colleagues and organizations.
Sorry.
Professional behaviors are critical in this sub security
industry for establishing a solid reputation.
Professionalism, professionalism and tells.
Actively listening to others, being open to feedback, and
practicing accountability.
You demonstrate respect and foster effective communications
within your team by listening attentively and sticking to
understand taking responsibility for your actions and taking
ownerships of your work.
Also demonstrate your dedication to accidents.
This quality is not only contribute to a positive and
collaborative work environment, but they also help to improve
your professional image.
Professional behaviors are critical in this sub security
the industry for for establishing a solid reputation.
Profile Chalisa entails actively listening to others being open
to feedback and practicing accountability.
Expect and foster effective communications within your team
by listening attentively and seeking to understand.
Take responsibility.
Taking responsibility for your actions and taking ownership tip
of your work also demonstrates your dedication.
These qualities not only contribute to a positive and
collaborative work environment, but they also help to improve
your professional image.
An example of trying to maintain a proper professional image.
Tattoos and piercings should be covered on minimalized in the
workplace in in the workplace.
While personal expressions isn't courage vegetable tattoos or
excessive piercings can be distracting, it may jeopardize
professional standards.
Your critical to prioritize your appearance so that it doesn't.
Does not over shadow your expertise and abilities, you
could foster a focused, incredible work environment by
maintaining a professional image that aligned with industry norm.
I'm.
Let's talk about the importance of self of balancing self
expression with professional standards inside security
fields.
Maintaining professionalism in the security field necessitates
extreme caution and diligence when dealing with sensitive
data, luggage and negligent data handling is not only
unprofessional, but it also exposes organizations to
significant set of security risks.
Negligence can manifest itself in a variety of ways, such as
failing to follow established security protocols, leaving
confidential data and attended or easy like festival sharing
sensitive information with on authorized individuals, and
failing to use encryption or proper disposal methods.
These actions increase their likelihood of data breaches,
which can help, which can have serious consequences such as
reputational damage, financial laws, legal ramifications and
the loss of trust from clients and partners.
Unprofessional behavior can seriously undermine an
organization.
Security cyber security efforts, in particular poor communication
and collaboration, can have a negative impact on service
security practices in adequate communication among service.
Security team members impeded the timely identification and
response to security threats, delays in reporting incidents,
exaggerate mitigation efforts.
Furthermore, I lack of knowledge and and information sharing
limits colleagues ability to stay informed and make informed
decisions.
Collaboration with other departments or stakeholders
weakens the overall cybersecurity defense.
These behaviors result in missed our missed prevention
opportunities, longer response times, and we can teamwork, all
of which reduce to organizations have security resilience.
Projecting competence, projecting competence,
credibility and professionalism in this sub security industry
extends beyond appearance to spend. Sorry.
Projecting competence, credibility and professionalism
in this app.
Security industry extends beyond appearance to include attire,
behavior, and best practices.
Your professional image reflects your commitment to excellence
and plays an important role in shaping your industry
reputation.
But Justin, present by addressing professionally acting
respect respectfully and following best practices for
appearance.
Julie, a solid foundation for success.
Remember that meaning?
Remember that maintaining a professional image is an ongoing
commitment, and upholding high standards consistently
contributes to your overall professional brand.
Thank you for listening.
Here are my references.
I'm sorry it it is a bit rushed and I'm sorry that I'm
stuttering a lot.
It is a bit late in the night for me.
Wait.
Yeah, yeah, that is, that is all for me.
Thank you very much for listening.
Uh.
Great job.
Covered a lot about that and that's what a lot of people need
to know.
So she when we're going out to get those new jobs, right?
So let's see.
Uh, I'm also.
Just, just so everyone can know, I will be sharing the
presentation here just in case you would like to have a better
detailed look at it because I'm because I mean I'm not have
actually the presented as well as I could have think it would
be all from.
Are you?
You did a great job.
Very good job.
Thank you very much.
You see, I'm looking for.
There it is.
OK, so to be ready for it.
Umm, right now we are going to see James.
Good evening all.
Welcome to today's master class.
My name is James Goldtrap.
I am a cybersecurity analyst intern at PGIP and I'll present.
I'll be presenting on Cyber, our security chaos engineering.
I selected this proverb because it perfectly capsulates the
essence of resiliency and chaos, engineering and cybersecurity.
In this presentation, we will start with an overview of chaos
engineering, diving into the history and principles for some
background, exploring the current cybersecurity landscape,
to grasp today's challenges, comparing chaos engineering and
penetration testing, discussing the connection between system
failures and cybersecurity, analyzing a case study,
understanding the limitations and risks of these strategies,
looking at what the future holds, and wrapping it up by
bringing it all together.
Think of Chaos engineering as getting a vaccine.
Just as vaccines give a small dose of a virus to strengthen
the body, chaos engineering provide purposely disrupts a
system.
The goal is to find and fix weak spots so the system can handle
unexpected problems instead of waiting for an issue to pop up,
we actively test and improve our system and conditions that
mirror in the real world.
Though chaos engineer through Chaos engineering, we aim for a
never ending cycle of learning, improving and making our systems
even better.
As we discussed this today, remember that chaos engineering
is our game plan for making systems more resilient and
dependable.
Chaos engineering started in Netflix in the early 20 tens as
Netflix systems got more complex, they wanted more than
just traditional testing.
They needed a way to test their systems in the real world
situations.
So in 2011, Netflix came up with Chaos Monkey.
This tool was a significant change.
It purposely created problems and their systems to find weak
spots.
This was the beginning of chaos engineering.
Thanks to the success of Chaos Monkey and other tools in the
Simeon Army, many other companies began to use chaos
engineering.
It's a big part of site reliability engineering.
Here are 6 main principles of chaos engineering.
Start small, start small with.
Start with a small test and gradually make them bigger.
This way you will avoid accidentally causing big
problems present.
Create a predict outcomes before doing tests.
Hypothesize what might happen.
This will help you understand the test results better mimic
real life problems.
The test should recreate real problems like if a server stops
working or a connection break test in real connections, even
though it sounds risky, it's best the test in a real world
setting, but always do this carefully and safely.
Automate your test.
Keep running tests regularly, even during work hours.
This ensures the system is always robust.
Learning get better.
The aim isn't just to create problems, but to find weak spots
and make systems more robust.
In short, Chaos engineering is all about making sure systems
are always ready for anything.
Cybersecurity is constantly changing because of the cyber
threats keep evolving.
We face new risks daily, like changing malware and creating a
creative ways hackers attack.
There are many more advance.
There are also more advanced threats, often backed by
governments, that spy on us for long periods of time as we move
to newer systems like cloud platforms, we opened the doors
for hackers and with more devices connected to the
Internet, they can attack from many more points.
Many big companies and governments have faced major
cyber attacks.
These attacks have led to massive data loss and
substantial financial costs, but the harm isn't just immediate.
Companies lose trust, which can hurt them in the long run.
Challenges also bring chances to grow.
We need to change how we protect ourselves.
We still need our old our old defenses like firewalls, but we
need more.
Taking a cue from chaos engineering, many experts
believe we should actively test our systems by pretending to
attack them.
Let us see how our defensive works and find weak spots in the
ever evolving world of cybersecurity.
Was we must continuously learn, adapt and innovate to stay ahead
of threats.
This all started with a simple question.
How was chaos engineering different than penetration
testing?
Chaos engineering is all about expecting the unexpected.
It checks how resiliency, resilient or reliable system is.
Imagine you wanna see how tough a toy is.
So you drop it, step on it, or throw it.
Similarly, in Chaos engineering, we intentionally cause problems
like shutting down critical servers or slowing down the
network.
This helps us see if a system can keep working and fix itself.
The main goal is to find a weak spot in the building.
The uh.
A weak spot within the system and how different parks work
together.
Penetration testing, on the other hand is like a security
check.
Its main goal is to find gaps that the bad guy might use to
get in.
This is done by pretending to attack a system, helping us spot
security risks.
It doesn't just look at software, but also the whole
system is set up and how people use it, like with fake scams in
emails such as fishing.
After testing, we know where the system can be better protected
against hackers or data theft.
Even though there are different, even though they are different,
chaos engineering and penetration testing have much in
common.
Both want to find and fix problems before they become real
issues.
They believe in testing things in real life situations and need
a deep understanding of the system be being tested while
chaos engineering checks this, the system can handle and
recover from problems.
Penetration testing ensures that safe from attacks together, they
help businesses create robust digital security.
Digital systems ready for today's challenge.
When looking at security Chaos Engineering, I wonder should a
security team worry about system failures?
I think some of you already shaking your head yes to this.
So let's dive into why one of the main pillars of
cybersecurity is availability, meaning systems or services
should always be accessible.
The idea is part of the CIA Triad, which stands for
confidentiality, integrity and availability.
So if there's a disruption and availability due to a system
failure, it's direct directly affects this crucial cyber
security concept.
But there's more to system failure than just an eruption.
They can hide real threats.
Regular system hiccups can overwhelm security systems with
false alarms, making it hard to spot actual harmful activities.
Clever hackers might use the frequent glitches to hide their
actions or even cause distractions on purpose.
Also, unexpected failures can cause system to act erratically,
exposing weak spots.
For example, a backup system might not be as secure as the
main one if the primary system breaks and the backups kick in,
it might be an easy target for hackers.
System failures can also damage or lose data.
Which threaten another core concept of cybersecurity, data
integrity trust is critical in our digital world.
If a system fails, users will not maintain faith.
They might even look for other, less safe ways to get what they
need, which can expose them to scans or risks.
The steps to handle system failures are often similar in
measures for handling security problems, so a cybersecurity
team that deals with security failures will also be good at
responding to security incidences.
Modern systems are complicated and connected.
A problem in in one area can cause an issue all over.
Understanding how these parts depend on each other is
essential for keeping things running and spotting hidden
security threats and emergencies.
Teams might need to use particular tools or methods to
fix things quickly if there are tools if these tools.
Please remind yourself that these tools still need to
appropriately be checked by security, or they could offer a
risk or a new vector of attack for threat actors.
So even if an actor doesn't always cause system failures,
they can still significantly affect cyber security.
Cyber security teams should work closely with IT teams to avoid
and handle these problems when they arise.
There are growing need to defend against online physical threats
in an ever changing cyber security landscape.
Cardinal Health faced this exact challenge.
John Hartman led the way with his vast experience as an FBI
agent specializing in information protection heading
8, heading a team of 15 experts, they aim to protect both digital
and physical assets.
What made their approach stand out was combining digital and
physical security measures.
They focused on being proactive, working together and guiding
others harm's team believed in education instead of just
setting rules.
They taught business owners the importance of their assets and
the risks they face.
The idea was simple.
If people understand the value and threats, they will also
follow security measures.
They offer also emphasize working closely with departments
to get complete pictures of potential risks.
At the same time, running mock events for a wide array of
events, both digitally and within the physical facility.
Ultimately, Cardinal Health transformed its cybersecurity
approach into a flexible, innovative model that can tackle
a wide range of risks.
When diving into security chaos engineering, I wanna address its
challenges and considerations. First.
There's a need for balance while we aim to mimic real life
threats to test our defenses, there's a risk of causing real
damage or shorten our vulnerabilities to outsiders.
This means we must be careful not to overdo our tests or might
give a road map to real attackers or even disrupt our
systems.
This includes not disseminating information about the tests to
people who don't need to know.
Next is the debate between testing and live environments.
Production versus controlled setting sandbox testing in a
live environment has risks like causing disruption.
However, testing and controlled settings might not show us how
our systems behave in the real world, conditions which could
lead to a false sense of security.
We also have to consider ethics.
Simulating cyber threats can come close to real hacking,
especially involving people unaware of the test.
We must ensure we don't violate violate privacy rules or
agreements or unintentionally harm someone.
Then it is crucial to set limits like an artist needs a canvas.
We need a clear guideline and goal for our chaos experiments
to avoid unintended consequences that could harm, trust, or even
legal matters.
However, even when our tests succeed, we might still develop
a false sense of security.
We might think we're safe and miss other vulnerabilities.
Therefore, we should always change and expand our tests.
We must remember that one test won't protect us from every
threat.
Chaos engineering can help us see where we are vulnerable, but
also has risk.
It is crucial to approach with care.
Now that we understand the basics of chaos engineering in
cybersecurity, let's look at an exciting future of
possibilities.
First, considering the use of advanced technology, think about
using machine learning and AI as both tools and partners.
They could help predict systems will act under stress and
improve our tests with the rise of quantum computing, which has
security challenges.
Chaos engineering might need to evolve to test networks with
apps built within this new technology next, there's
potential for better testing environments using cloud
technology, we could make a more flexible and realistic test
environments.
These sandboxes would be almost identical to our production
system.
We could even run tests alongside our regular
operations, with more powerful computers.
We should also think more extensively about the test.
What if some something physical like a paleo failure effects our
digital system as everything gets more connected, we must see
how people react during these tests.
How do they behave during a cyber incident?
There are also new areas to explore.
We might soon be able to predict where a system might fell by
looking at past data and as our world becomes even more
connected, we could test how cyber incidences affects not
just an organization, but many at once.
All in all, the future of chaos engineering and cybersecurity is
full potential.
Combining it with the latest technology can help us make
safe, ethical and reliable systems.
Thinking about chaos, engineering and CYBERSECURITY, I
was reminded of a Japanese saying the same saying that I
mentioned at the beginning of this presentation fall 7 times.
Stand up 8.
It speaks to the heart of resilience, the core of cyber or
security chaos engineering.
Whether we find and fix a weakness, our systems become
more robust, combining chaos engineering with cybersecurity
gives companies a straight, poor way to exanthem examine system
resilience and protect against threats.
Given our complicated digital world, this communism isn't just
good to have.
It's essential.
It's also crucial to be proactive, fixing problems
before something goes wrong by running a chaos test, we could
get ahead of problems.
Staying true to the idea of getting back up each time and
becoming stronger.
Lastly, I encourage everyone to learn about the idea behind
security chaos engineering as we depend more on digital systems.
The stakes get higher.
It's not just about voiding problems, but building trust and
long term strength.
So with security chaos engineering, we see a future
where we can keep moving forward no matter what comes our way.
Thank you by.
There was a great presentation that was a good recording.
Yeah, it was a good recording.
You did really, really good.
So James, when you see this excellent job, good information,
I love the chaos theory that you added to that very good
implementation of all that information. Awesome.
And I want to thank everybody for some great presentations.
You all did a great job.
Thank you for joining the master classes.
Evening.
I know it was a long one and they will be long because now we
get we have more students who do master classes and and the more
students we get, the more we're gonna have to figure this out.
I have to have a whole day session of master classes.
Probably not, but I thank everybody for joining and and
watching the presentations.
Being part of the, you know the uh, your classmates as we go
through this and definitely uh, add these recordings and these
presentations to your portfolios.
I I'm telling you, you'll get jobs for them because of those.
You will get jobs.
It's always very impressive.
So other than that, have a great evening.
Thank you for joining.
And I will see you.
For the next one.