Finding Relevant News

00:00

Hello and welcome to another penetration testing execution Standard discussion. Today we're going to briefly discuss finding relevant news within the threat modeling section of the Pee test standard. Now is a quick disclaimer. We do have some tools and techniques that we may discuss

00:19

that could be used for system hacking.

00:21

Any tools discussed, used or demonstrated should be researched and understood by the user. Please research all applicable laws and regulations within your given area regarding the use of such tools or techniques to ensure that you don't get into any trouble with the law. Now today's objectives are pretty brief.

00:40

We're just going to discuss the pee test definition of comparable news

00:45

and discuss search results for some relevant examples that we pulled out

00:50

and how we would go about doing that.

00:52

So relevant news of comparable organizations as laid out in order to provide a complete threat, model ah, comparison to other organizations with the same industry vertical should be provided. It should be inclusive of any relevant incidents or news related to such organizations and the challenges they face.

01:12

Such a comparison is used to validate the threat model and offer a baseline for the organization to compare itself to

01:19

taking into account that this publicly available information on Lee represents a portion of the actual threat and incident three compared, organization will actually face you could actually face.

01:32

So essentially, we're going to use some Google fu to attempt to find relevant and somewhat current data on how other organizations were impacted

01:42

and so an example given here. So we did a quick search for manufacturing plant hacked in. So let's say you're looking at manufacturing. So I did a Google search for manufacturing plant hacked.

01:53

We've got a search result for March

01:56

of 2019

01:57

that so locker Goga the ransomware crippling industrial firms on DSO it goes into something's there about ran somewhere. We've got an aluminum plant him by ransomware So this is likely, um,

02:14

the same or one of the same organizations ransomware forces, aluminum manufacture, trying to shut down.

02:21

So this all looks to be relatively current and related to the same organization. So if I were working with the manufacturer of aluminum or some other product, we could demonstrate how ransomware could potentially impact them or model how ransomware could affect them

02:39

in a similar manner to this particular aluminum manufacturing giant. And so that would be

02:47

a good resource to use in that case. And then we use something that is maybe a little less known. But we did a search term for the last year,

02:57

and we did florist shop at cause hey, who thinks that? Okay, I'm doing some security testing. I'm a major florist railing. Somebody's gonna hack me. Well, apparently there was in June, some relevant news

03:12

about a floor shop losing money

03:15

and floor shot loses 24,000 attacks on Shopify. And so this could be relevant depending on what type of third party tool

03:23

the client is using. Maybe they're using Shopify as a part of the review. And so we now have a reference point for how that third parties particular incident could be detrimental to other florists or to an entity and maybe a similar service type vertical, so search results

03:44

can be hit or miss. I would try to focus on search results within the last two years,

03:49

but really, if you could get something within the last 12 months, that would be best, because that's going to be more relevant as you get further and further back in the search history. Like, you know, 10 years ago,

04:00

the attack methods have changed the tools of change, the protections of change,

04:05

so it may not be as relevant. You could potentially apply maybe some of the methodology that an attacker used that was reported

04:13

to the scenario. But I wouldn't focuses heavily on the tools because a decade later we should have protections in place or mitigating factors in place through maybe automated tools or something of that nature.

04:26

So in summary, we discussed the pee test definition of comparable news,

04:31

and we discussed some search results for relevant examples again trying to focus on things within the last 12 months trying to focus on similar verticals. And that way you know, the information is relevant to the party. It's relevant to the client. You know, you don't want to do search for hacks on car dealerships,

04:49

and you're dealing with the doctor's office.

04:53

You don't want to look for hacks on accounting firms, and you're dealing with a bakery or a manufacturer of canned goods or et cetera. Whatever the case may be, you want to try to keep it vertical specific industry specific, so it hits close to home,