2.1 Attack Methods

00:01

Okay. Module to methods of attack

00:06

in model One. We learned about the why involved in the insider threat scenario in module to methods of attack. We take a look at the what? Involved in the insider threat.

00:19

We will take a look at the attacks,

00:22

uh, that human beings have come up with and the damage that they have done.

00:32

Okay, so let's talk about attack methods. Okay. So the largest and most devastating and started attacks on the U. S. Government were perpetrated by Mr Edward Snowden.

00:43

It was a defense contractor working for the agency. He had access to the network in the systems. He knew how the security infrastructure worked, and so he was able to do some significant damage.

00:58

Um, by stealing a large amount of classified data.

01:03

So this is an example?

01:04

Uh, the devastation that can be weak. Tw by an insider who has decided to do bad things within an organization.

01:15

Okay, so an insider attacker can exploit their access to gather information, copy store exfiltrate damage or destroy data or systems.

01:26

They can do some serious devastation.

01:32

Uh, this kind of review, what we're gonna talk about in this section

01:36

important stuff.

01:37

And, uh, so we're gonna talk about it. The attack surface area. We're gonna talk about privilege, user attacks,

01:44

non privileged user attacks, road systems,

01:48

attacks, printing smartphone and memorization.

01:52

Okay,

01:53

Okay. So first, let's talk about the attack surface area.

01:57

Why is this important? Because this is the area that is available to be attacked.

02:06

The area that is exposed. So, for instance, if you're on attacker out there on the Internet and you're a hacker and you're trying to hack into the company network,

02:15

you may only be able to see

02:19

the things that are exposed by the firewall. The firewall may only let you see a little bit of things so you can see the firewall

02:25

You can see maybe the external rounder. You can probably see whatever's in the D m Z the militarized zone of the network, which is where you keep your Web servers and the things that are exposed to the Internet.

02:38

So you may only be able to see a few things.

02:40

No.

02:42

If you're an insider

02:44

and you're sitting on your work station on the inside of a company network,

02:49

guess what. You can see

02:53

the whole kingdom if you will, because you have the keys to the kingdom.

02:58

You are on the inside. Your trusted your granted access your given database access your given network access. So you, in theory, are a much greater danger than the external hacker. If you decide to be

03:14

so, that is a tax service area.

03:17

Okay,

03:19

So privileged user attacks. A privilege user is someone who has elevated privileges on the network on the app on an application on a system. They may be a developer. They maybe someone who doesn't maintenance on the servers of the database, et cetera, et cetera. They have higher level privileges

03:38

in the hours

03:39

worker within an organization. Privileged user attacks

03:45

are a scenario where the privilege user uses their higher level access to do bad things. For instance, a system administrator who wants to steal a bunch of data may, um, tell everyone that they need to do maintenance on the server

04:00

in actuality, because one of the drives his pad

04:03

and so they take the server to hum, they take off the bad drive and they put a new drive in, and they get it back up and everything's good, But in actuality, what they did

04:15

waas the copied

04:17

data onto that internal drive,

04:20

and they stole that data

04:24

that is under the ruse of doing maintenance.

04:28

So they may say that they're throwing that drive away because it's no longer good. Well, actually, they took it home.

04:33

So that's a scenario where you can see how a privilege juicer conduce, um, serious damage when it comes to the insider threat.

04:46

Okay, let's talk about non free would choose their attack.

04:48

Okay, so we talked about the producer. They could do a lot of bad stuff. Edward Snowden was a privileged user. Now let's talk about what the average user can do.

05:00

So when normal, not administrated, user's abuse, their access to steal all to destroy or expose information that is a non privileged user attack

05:12

and could be justice devastating, depending on the motivation and the determination of the individual. Examples of such an attack include abusing application access, elevating privileges, employing removable media. That means playing

05:29

a member, stick into a computer and copying gigs of data down and stick it in your pocket and take it at home.

05:33

Ex filtration of data that's sending it out through the network

05:38

to like Dropbox or something. Social engineering. That's where you use your use your relationships with people who trust you to try to get what you want, and there's all kinds of things that these insiders could do. It mentions SQL Injection as an example.

05:54

That is a scenario where you could look up online, how to do SQL injection

05:59

as in really a user, and then you can come to work and try it.

06:02

And if you you may get lucky and may be able to elevate privileges or get access to data that you want supposed to have access to buying, doing an SQL injection of pack. That said. So there's other examples,

06:15

but this shows the danger of a regular user

06:19

within an environment.

06:24

Okay, Rose System and Attack. Let's talk about that.

06:29

So this is a concept of an individual.

06:32

Anyone within an organization bringing in a computer like a laptop, maybe a small device like a raspberry pi are doing a bringing one in

06:44

and plugging it into the network.

06:46

And if they if the security measures aren't in place, they can get this system on the network without anyone knowing.

06:54

And the goal is to do bad things.

06:57

So once they have this nefarious system on the network, maybe they had a bunch of hacker tools installed on it. They had it all pre stage and ready to go so they could start launching attacks so it could be a launch pad for internal network attacks.

07:13

So you could do things that external happier would love to do, but they can't. But you're on the inside of the soft underbelly of the network on the inside, and you can launch these attacks with this computer that you brought it. Okay,

07:27

um, you can do things like sniffing the network.

07:30

This is a situation where you can configure the machine

07:34

to be able to see the traffic, the network traffic going back and forth, which enables you to potentially gain information that help you hack into a system. Maybe you could steal information like passwords that are unequipped ID and things like that.

07:50

So a lot of bad things could be done with aero system. Another example would be to put it on the network and then manually map. And that would drive to this system from your your authorized computer and then slowly start copying David down to that drive, and eventually, when you're done, you take it.

08:11

Put it back in your gym bag and you walk out of the building and you have just executed an insider threat attack.

08:20

Okay, so let's talk about printing. Why is that a big deal? Everybody in print. It's not super high tech,

08:26

Um, but it is a danger. So an insider, be they a privilege or non privileged user can simply select in print copies of sensitive data. It's very simple,

08:39

and and this will often be able to go around security controls that are in place.

08:46

So maybe they don't monitor printing,

08:48

and so on. Individual can simply look for the most important data. Let's say that

08:56

a year's worth worth of a research

09:00

resulted in a one page document

09:03

that saw some sort of

09:05

of assault, a technical problem. And there's an equation that is on that document that could be printed and stolen. And that, in theory, is worth saying millions of dollars.

09:20

It's a very effective attack to just print that document and take it home.

09:24

Obviously, there are measures you've been put in place. She prevents someone from from just randomly printing a sensitive, sensitive document. You can do things like Data Tagi and have measures in place so that if someone wants to do something with something that is tagged as super sensitive,

09:45

there's

09:45

other steps that have to happen that require other individuals to approve that action and so on. But nevertheless, printing can be

09:54

I used to do a devastating impact.

10:01

Okay, let's talk about smartphones.

10:03

Smartphones are very powerful, very small devices that have their own network connections that can't be monitored.

10:11

And, um, they can do things like, for instance, you could take photos of sensitive information like the picture shows. You can take video of sensitive information as you scroll through it. You can just video.

10:26

You can use it as a storage device data you can. You can do a lot of damaging things. With a smartphone, for instance, you can also record a sensitive meaning, so a lot of damage could be done was a smartphone. It's got a lot of power, a lot of capability, and

10:46

so

10:46

in theory, if you have a room that has your most sensitive data in it, you would not want to allow anyone to bring the cellphone into that room.

10:56

Uh, just to try to prevent

11:00

that kind of scenario from happened.

11:05

Okay, Memorization.

11:09

Everybody has a memory. Everybody can remember a certain amount of information. Some human beings are super talented and remember a lot more than the average person, those air individuals that have a photographic memory.

11:22

And then there's average memory. That's what most of us have,

11:26

but either scenario can be bad. So again, let's go back to scenario. Let's say that a year's worth of research resulted in a one sentence formula or something for some chemical or whatever, and an individual who has worked with that was it is able to remember

11:46

that formula in their head.

11:48

How do you prevent that? There's no firewall. There's no tool. There's no technology that can prevent that individual from walking out,

11:56

writing it down on a piece of paper and selling it to someone. But that shows the danger of memorization, so really, not much you can do about that other than focus on your hiring practices. So if you are hiring something for us to be around, super sensitive information

12:16

that's worth millions and millions of dollars are highly classified information.

12:18

That's where you want to do extra things to try to make sure I established the level of trust, and you can have,

12:26

uh, with the individual that you're hiring.

12:33

Okay, so let's do the knowledge check. So question here, when elevated privileges are abused and used to steal, damaged, exposed or alter sensitive information,

12:48

this is called what

12:50

type of attack

12:56

prove? A geezer attack.

13:01

Connecting an unauthorized device to a network to store stolen data or to use as a launch pad for other malicious activity is known as what type of attack

13:24

answer

13:26

road system.

13:28

Okay, when a user of these is their normal user rights within a system or application to aid in stealing, altering, exposing or destroying sensitive data, this is known as what

13:41

part of attack