Do you want to learn how to ‘Blue Team’​? Start with “Time Based Security”​.

Also available on LinkedIn

“We’ve been looking at security the wrong way […] Fortress Mentality insists that building tall electronic walls is how to keep the bad guys out. That method hasn’t worked for 5000 years of warfare, so why should it work for computer security? It can’t and it doesn’t.” — Winn Schwartau.

As much as I love to put my red hat on, as I always explain to my SANS students, pentesting or even red teaming, can become ‘boring’ over time (sorry guys), especially when you are brought into environments where all the organization wants is to have a green check for yearly compliance purposes, or simply to have one more report to ignore. And trust me, that happens more often than not.

That is why I am so happy to see how many security professionals, experienced or not, are making the shift, joining the blue team ranks to learn how to defend their crown jewels in a highly increasingly complex world where technology advances so fast, data is ubiquitous, networks become more opaque and endpoint devices are less trusted than ever.

If this is your goal, and you are willing to get into an exciting, high paced but also highly rewarding field, where learning never stops… welcome aboard! Now, where do you start? There are a plethora of resources out there on how to get started into pentesting, but it seems that it is not so easy to find good resources on how to become an effective cyber defender.

There are many resources I can recommend, but since dropping here a list of 100 links won’t probably help you much, let me recommend you a very easy and light reading to start with: “Time Based Security”. Though it was written in 1999, TBS is still one of the most relevant, effective and terribly simple security models you can apply today. The principles enumerated in this book are absolutely essential for any blue teamer, regardless of whether you are a CISO, a SOC analyst, a security architect or an incident responder. TBS provides a reproducible method to understand how much ‘security’ a product or technology provides, by answering:

  • How long are systems exposed?
  • How long before we detect a compromise?
  • How long before we respond?

While it is usually applied to auditing, TBS is a very practical model to assess and design security architectures too. The method proposed is very simple, but it provides you with the knowledge and the tools required to make systems more secure and resilient. Here’s the main idea:

“If it takes longer to detect and to respond to an intrusion than the amount of protection time afforded by the security measures, that is if P < D + R then effective security is impossible to achieve in this system. It should be becoming a little bit obvious that the choice of a good protection system is not the first thing you need to think about when designing a secure network environment. It’s the efficacy of the detection and reaction processes that really matters.”

If this wasn’t good enough, Winn allows you to download and read his book for free on his website, so please go and grab a free copy of “Time Based Security” now!

https://winnschwartau.com/wp-content/uploads/2019/06/TimeBasedSecurity.pdf

Want to learn more on #BlueTeam? If so, please let me know, and I will follow up this post with a series of articles on how to improve your cyber defense skills. In the meantime check out the series of webinars that Justin Henderson and I recorded here:

Defensible Security Architecture and Engineering – Part 1: How to become an All-Round Defender – the Secret Sauce

Defensible Security Architecture and Engineering – Part 2: Thinking Red, Acting Blue – Mindset & Actions

Defensible Security Architecture and Engineering – Part 3: Protect your Lunch Money – Keeping the Thieves at Bay

A follow up on the Indian embassy issue

It’s been a busy two weeks trying to put together the training material I’ll be using to teach Incident Response and Computer Forensics to some of my colleagues in other geographies across Europe, Asia and Australia, and that will kick-off in Leiden in approximately 10 days. Meanwhile, the latest news about the Indian embassy reported earlier on this blog, spread quickly on the Internet.

Many sites reported on the issue, from antivirus vendors to security professional’s blogs and online magazines. Whilst most of them just echoed what others said, some shed more light on it posting some interesting notes and only a few did an in-depth analysis worth of mention, the most relevant being:

Continue reading “A follow up on the Indian embassy issue”

Embassy of India in Spain found serving remote malware through iFrame attack

Hacking an embassy’s website to use it as malware distribution point is not something new, neither is the use of the iframe injection attack, but it’s still surprising the number of infected sites out there.

Earlier this morning I was alerted to this problem by a colleague who was trying to access www (dot) embajadaindia (dot) com to sort out some paperwork related to my employer’s offices in India. When tried to load the site, the Desktop Antivirus displayed the following pop-up alert:

Sophos Alert - www (dot) embajadaindia (dot) com

The alert description is fairly self-explanatory, Continue reading “Embassy of India in Spain found serving remote malware through iFrame attack”