Works for the Center for American Progress – 501(c)(3) + 501 (c)(4).\u00a0 High visibility organization, constant media attention, high profile visitors, lots of research.\u00a0 Threat rich environment because they influence policy.\u00a0 Drive-by attacks.\u00a0 High turnover environment that is also a campus environment.\u00a0 Use your own software, Tweetdeck, they are their own ISP.\u00a0 Many projects at one place need different types of networks.<\/p>\n
Satellite Essential Project track things in Africa, etc.\u00a0 Track mass graves, troups, etc.\u00a0 50 cm imagery.<\/p>\n
Threat tracking, hactivists, anonymous.\u00a0 APT threat.\u00a0 Intrusion set developed by airforce.\u00a0 China.\u00a0 Tools, methods, and tactics to attack.\u00a0 APT is an actual thing in the end brought about to allow classified people to talk about it.<\/p>\n
Advanced:\u00a0 Do what is necessary to get the job done.\u00a0 Adjusts tactics based on targets posture.\u00a0 Public exploits.\u00a0 Work full spectrum of computer intrusion.<\/p>\n
Persistent:\u00a0 Patient and will not stop pursuing their goal.<\/p>\n
Threat:\u00a0 Not mindless piece of code.\u00a0 Funded, motivated, multiple ‘groups’ and ‘crews’.<\/p>\n
So many different targets:\u00a0 Google, RSA, Intel, Morgan Stanlet, Lockheed, MS, Adobe, GE, Northrop, Goldman, Juniper.\u00a0 China….attacking lots\/all.\u00a0 Involved with China??<\/p>\n
APT Workday:\u00a0 Email harvesting Activity @ 6am, after hours, always take lunch.\u00a0 7 day work week.\u00a0 Lot of management and people.<\/p>\n
Spearphishing most used attack vector.\u00a0 Crappy ones to good ones.\u00a0 Gmail, Yahoo, etc, addys.\u00a0 Monitoring emails allow for knowledge of abbreviations.\u00a0 Updating contact list a big one.\u00a0 Attacks on American progress.\u00a0 Look at this, its a funny cat.<\/p>\n
C2:<\/p>\n
Lots of different malware.\u00a0 2x malware, beacon transmits, http, dns.\u00a0 DNS requests fire once an hour.<\/p>\n
DNS, HTML Responds, Image Metadata.<\/p>\n
Prevention eventually fails.\u00a0 Actor trying to get posture.\u00a0 Authorities will be of little help.<\/p>\n
Get top down support.\u00a0 Realistic expectations, everyone’s responsibility.\u00a0 Mental preparation:\u00a0 Be prepared for the worst day of your career.\u00a0 Be source of calm and reason, never ending struggle, work through your worse case.<\/p>\n
Study your opponent, Empathize, Defeat.<\/p>\n
Detection, Response, Prevention.\u00a0 Advanced Information Security == Counter-Intelligence.<\/p>\n
Internal Threat Intelligence, classify your data, follow news, study the opponent, track their targets.\u00a0 Not just organizations but also people.\u00a0 Where are your users logging in to.<\/p>\n