VA Cybercon 2025

001Good day. [Music] Just around. Yeah, it was a good day. I'm so glad the sun stayad all the time. We don't have to give up. Everything we're giving is enough. Moment [ __ ] together like a question. It was a good day. I'm so glad the sun stayed around. Yeah, it was a good day. [Music] Just stay around. Yeah, it was a good day. I'm so glad this Thursday. My check. My check. My check. Check. Check. >> This ain't no disco. Ain't no country club either. This is LA. I want to do a littlewhere. nothing. He says his name is William. I'm sure it's Billy. And I wonder if he's ever wonder Extraordinary. Well, good morning everybody. Oh, that is not going to work here today. All right, let me tell you. First of all, you got

002to be excited because we're excited. We're happy to see you guys. So, let's try that one more time. Good morning. Okay, that was mildly better. Let's do it one more time. Good morning. >> Okay. All right. We We'll take that. We'll take that. All right. Uh, first order of business. Um, so again, welcome to 2025 Virginia CyberCon. We are truly excited uh to to see everybody here. This has been a year in the planning. Um, I won't give you the whole history of it, but this started in region five. Uh, we talked about wanting to do something like this for the region. And as we started doing it, we're like, you know what, this is a lot of work. Let's do it for the whole state. And wow, what a turnout. We have 60some different

003school divisions here today, uh, superintendent, senior staff, technology leaders, and it is it's so wonderful to see you guys. Um, you're probably wondering about internet access. Uh, so let's take care of that real quick. The internet password is cho nu. C h o nu. And it'll be the ig gh rewards. Uh restrooms are just outside this door. Uh if you need to use restrooms. All right. So y'all ready to get this started? >> All right. Awesome. All right. All right. So, my name is David Childress and I have the privilege of serving as the chief technology officer for Louisa County Public Schools and I'm also the chair for region 5 tech directors. And it is truly a privilege to host the 2025 Virginia CyberCon and to stand among so many leaders committed to protecting our

004schools. Cyber security reaches into every part of what we do from instruction to operations to even governance. And that's why the work that we're doing here today really matters. Before we begin, I do want to take a moment to thank a few other people who helped to make this event possible. Uh because conferences like this don't just happen. They take hours, countless hours of planning, coordination, and setup. So, I'd like to give a special thank you to Joe Goldman, supervisor of technology for Ammeris County Schools, John Collins, director of techn director of technology for Lynburg City Schools for their leadership, hard work, and dedication, countless hours behind the scenes to help bring this conference to life. So, thank you guys. And I would certainly be remiss uh when we started this endeavor, we we were

005going to try and do it without having sponsorship, but we quickly realized no, we needed some help with that because this, as we said, this is not cheap. Uh and so thank you to our sponsors, uh Black Hills, Infosac, uh Clear Touch, Clinton Learning, Cybernut, New Line, and uh Ed Structure uh for their support, believing in our vision, and supporting our mission across Virginia. We also want you uh to be a part of today's conversation. Uh if you would get your phones out uh scan this QR code that's on the screen. It's also at your tables uh if you can't scan it. Uh this will take you to a slidoh to where uh you can pose questions uh for us um that we can answer. And this is going to be um a part of

006uh one of the breakout sessions at the end of today. Uh we're going to do a round table, myself, John Collins, Joe Goldman, uh answering going through and answering these questions. Again, the goal for today is that you guys to walk out of here with more information to be armed to go help and protect your school division. So, we want to do everything possible to help that. In today's world, cyber security is not just a technology issue. It is a leadership issue. It's a financial issue and it's a leadership uh leadership issue and a learning issue. Uh most days technology runs quietly. There we go. Most days technology runs quietly because when things are quiet that means learning is taking place and learning is happening and systems are secure and everyone's focused on their work.

007Unlike this week with AWS going down, I don't know how many of you had to deal with issues with that, but things were not quiet. And that brings us to this. When systems go down, learning stops. When data is compromised, trust with families and staff are shaken. And when cyber incidents hit, it doesn't just cost money. It takes away from every other priority we have. We're here today because protecting our schools means protecting our students, their safety, and their future. It's not a matter of if it's going to happen, but a matter of when. Across Virginia, across the country, school divisions have faced attacks that cost millions and disrupted instruction for weeks and left families in the dark. Our job as technology leaders is not simply to react, but to prepare, to be ready. I

008also serve on the Louisa County Safety Task Force which focuses on physical security, doors, cameras, panic equipment. And what's striking to me is how much correlation there is with cyber security. Think about it for a minute. Our uh our door access control system runs on the same network as our student information system. Our cameras are IP based and in many divisions tied to IIA to detect weapons. Even the panic buttons or emergency communications that we use are all cloudconnected and dependent on the same infrastructure as our student information system. A weakness in one can compromise the other. Research shows that the number one threat comes from the inside. Sometimes a student trying to test the limits, an employee who clicks the wrong link, or a vendor account that gets compromised. That's why awareness, training, and

009a layer defense matters as much as the technology that we introduce. Firewalls, yes, they are important. They're critical, but they're only one layer, one layer of of what we need. Our best defense is an informed and prepared team at every level. This event is designed to help you, but only only if you participate. The value today is not going to come from hearing and listening to people like myself. It comes from you engaging, asking questions, sharing your experiences with peers. There is zero judgment here today. Zero judgment. The only mistake would be you walking out of this room without something you can take back to your district and use. And let me be clear, it cannot do this work alone. Senior leadership must champion cyber security with funding, staffing, tools, and time. Cyber security professionals

010are expensive, whether you hire them directly or through a managed service. And applications like multifactor authentication, they're not cheap and they're not free. Firewalls, backups, monitoring, and training cost money. That's the reality. And yes, those costs can be hard to justify when it seems like nothing's happening, right? But every single day you go without a cyber threat. Every day you go without a cyber threat is a return on your investment. The alternative is far more costly. Millions in recovery expenses, months of downtime, and immeasurable damage uh to your reputation and more importantly to your mission. When recovery h costs hit, it pulls away from every other priority we have. Teacher salaries, classroom resources, safety upgrades, and most importantly, student supports. That is the true cost of a data breach. This conference isn't just about awareness.

011It's about action. By the time today you leave today, you should walk away with these three critical items. One, clarity on the threats facing Virginia schools right now. Two, a playbook, tools, a playbook, template, checklist you can use when you return to your district. And third, and most importantly, connections, people across the state who will stand beside you when the next challenge comes. That is why the the region tech meetings, the state DOE meetings are so important because it allows us to connect and help and support one another. The agenda this morning, shortly after I'm done, we're going to have um Chris Cope with the FBI Cyber Crimes Division. Then we'll have our keynote and then we'll do a tabletop uh exercise that puts you right in the middle of a real cyber incident from

012communication decisions to technical responses to financial impact. And then we'll break for lunch and then this afternoon you'll hear from incident response recovery and division level planning experts. And then we'll do ro specific breakout sessions where you can develop actionable plans for your next steps. So as we get started, as we get started, I want to challenge you, be fully engaged, ask questions, share openly, push yourself to take one idea from today and make it real when you return to your division. On behalf of our planning team and our partners across Virginia, thank you. Thank you for being here, for your presence, for your commitment to keeping our schools safe and our students protected. This work matters. You matter in this work. Now, let's get started. So, please welcome to the stage Chris Ko, the

013FBI supervisor, uh, special agent for cyber crimes. Good morning. Thanks for having me. A little bit about myself. I started uh FBI in 2009, I believe. Uh from there, I went to at the New York division uh investigating crimes such as Silk Road. I think you guys have heard of it, Anonymous. Uh and then I moved to cyber division where I took a a role as the uh program manager over national security uh our national security mission within cyber. After that I end up get getting a desk in Richmond's where I sit today as a supervisor of cyber squad. So this is I just want to kind of give you an overview of what the FBI is, some of the threats that we're seeing and some of the things that you you know you should

014think about as you're implementing a cyber security strategy for your your district. Uh we we the cyber squad I have eight agents and we basically cover all of 82 counties in Virginia with the exception of the white area in the lower right hand corner there uh that belongs to Norfolk Division. I have eight agents, two task force officers, two intelligence analysts and a team of specialists that help us investigate cyber crimes. When I took the desk in Richmond, one of the first calls I got was from a school district that had a compromise on their network and I responded went down to the to the administrator and said, "You know what? What what what happened?" So, basically, an employee who had a laptop allowed their son to play games or whatever on a laptop. It

015wasn't quite as locked down as you might expect. And they ended up downloading a virus. It ended up on the school district system. And I said to him, "So, what does your network look like? You know, is it segregated? Do you have anything?" He goes, "No, it's completely flat." He's like, "We're we're down. We might have to close schools coming up." So, it's at the very beginning of the school year. So, a little bit about what we're seeing, what we've seen. We have 16.6 billion in cyber crime losses. That's across all critical infrastructure uh businesses and and uh organizations. If you can see here, Virginia ranks number 13 at 12,711 and 317 million in losses. So, just a a bit of a a what to expect here. You know, ransomware is by far the biggest

016thing that we see within school school systems. Uh you have data breaches, theft of PII, double extortion. For those those that you don't know, double is where they'll infil exfiltrate data off the network and if you don't pay the ransom, they're going to further try to extort you in exchange II uh of your your students and and faculty. Denial service. We had a another school that was uh hit with a denial of service. Every time there was an exam, all of a sudden the school school network would happen to go down. So, what we ended up finding out was it was a student that had subscribed to a a a pentesting service and just, you know, threw in the school domain and and took it down. Uh website defeat and online threats. As far as

017students, obviously there's two sides of this, right? The school and the and the network you're protecting, but the students as well. Amount of students being extorted, being bullied. Uh, and it and it starts with kind of like a a an innocent conversation be somebody between somebody they may have met online or somebody that had sent them a text and the next thing you know they're sending compromising photos of of themselves to only be turned around and have those photos uh additional trying to extort them into two in stereo. Um, so trying to extort them for for money. I had two two uh acquaintances of mine call me up and said their their sons had were being trying to be extorted for I think it was like $250 or something like that, but they that my

018friend my friends end up realizing a credit card charge for $250 and she asked her son like what what happened and that she ended up he end up telling her. So again, cyber bullying uh extortion we call it schemes are very prevalent with for students. So what's at stake right 82% of K through 12 experience a cyber incident and between 2023 and 2024 9300 cyber incidents and and climbing. It's it's gotten exponentially worse over the last few years. It's becoming a lot easier for so-called hackers to obtain access to malware online. It's now a service. It's not an individual deploying malware against the network. It's an individual that's basically purchasing access to a do to a a command and control that they're able to then uh implement uh sorry implement the malware on a system

019for a percentage to to give a percentage to the actual developers of the of the site. But here's what you can inspect. Data loss, network disruptions, you know, blocked access to critical services, school closures, targeting, you know, exam, typically target targeting exam week or events. So, usually it's either a student or it's say a telegram channel where a bunch of students will will get on and and discuss schools that they don't like, schools they want to target, and it's, you know, could be another individual in a country doing them a favor and targeting that school. So, I don't know if you can all see this, but the gest of it is the three of the the the largest targets for students that are the business email compromise, extortion, and investment scams. I'll get into that

020in a second. So, where do they get their targeting data here? So there there are these data aggregators these also these individuals that will do any sort of password spray or or or some sort of uh exfiltration of of username and passwords and they will sell them online. So these individuals are on different types of forums, telegram channels and they gain access. These people will publish the the actual compromised networks, compromised passwords on on their site and then we'll just sell it and and it could be $500 per a set of passwords or whatever. And then what these guys will do will purchase access to the malware, gain access to the system and deploy it. So this is just a a actual screenshot of one of those digger data uh services where they're trying to

021sell information to a ticket master site. One of my first investigations I had an individual that was selling access to credit card information. And when it came down to finding out like how he did this, he was actually accessing different types of forms uh you know innocent forms where people just chat about their favorite coffee or whatever. some of these actually stored passwords in clear text. So what he was doing was going to these different forms and exfiltrating the databases that stored these passwords. He then used a PayPal checker tool that would check the same passwords against the PayPal account. And sure enough, people were using the same user ID and password for the these forums as they were their PayPal. And he would just sell that. So the these people will make hundreds of

022thousands of dollars. As a matter of fact, he made well over $3 million doing this. So, how do they do this? Number one is is through social engineering. Whether it is to trying to get students to send pictures of themselves or trying to obtain different types of PII so that they can then use aggregate all that PII over a course of time to being able to try to brute force a password or uh gain access to their network. It is it starts with the information you uh sorry the information you post online publicly about yourself, your family, your birth date, all that all that information is stuff that you typically use if you need to reset your password or challenge questions, right? Well, if somebody's trying to gain access to your system, they can use

023those same challenge questions that you probably post on a public uh forum or or site uh to gain access. So, here are a few other, you know, a lore message. The information you post online about your your favorite places, Disney, your dog, cats, your children. Again, it's all information that they can use to craft a message, let's say, an email to you to get you to click on it. Whether it be discount to to target, just click on this site. You know, Amazon is is requesting you update your your information. just click on this this embedded link within uh this email. It'll redirect you to a malicious domain and and get you to uh put in information you really don't intend to. So, what is what are they trying to do? They're trying to gain

024access, disrupt and encrypt and gain access to your money. And you know, for everybody that works in public school system here, it's all taxpayer money, right? is that you would need to be responsible in the way we secure our networks uh and be responsible to the taxpayer. So for business email compromise, I'm sure most of you know what that is. Basically, it's emails that are targeted toward typically a somebody responsible for payroll accounts payable. And what these individuals would do would try to get them to change, modify the bank account information in order to redirect payment to a a malicious or or a a another account that that you know typically is is uh is fraudulent. So what these individuals will do, it'll come to the fraudulent account and then it'll automatically either either access

025and and redirect it to another account and it's usually ends up overseas somewhere. So what we end up what we ask is if something like that happens that you notify the FBI and what we can do is initiate a financial killchain process that'll actually freeze the funds within the beneficiary account so that then you can ask for a return of the the money from your own bank. And the longer you wait, the less money is likely to be there as you would suspect. So ransomware again, it's it's at this point it's not just one individual individual actor deploying ransomware on a network. It it's anybody that has has access to typically dark web knows where to go and actually purchase access to those those command and controls where they can then purchase access to your

026network. uh exfiltrate any sort of data that they can find, typically PII, that they can then use once they encrypt the network to try to extort you into paying. Uh Ed have a colleague that is part of the incident response network. She works for a uh third-party uh remediation council. And what she told me was typically the the the recovery and uh incident response can cost a a public school between $200,000 and $2 million depending on on the how how effective the the malware was on the network. So think about that. every every every kid you see, every student you see within your schools has a cell phone, right? That barely look up to it when they're from when they're in class or even walking around. But these are the type of types of scams

027that we see. Work from home scams, tech support, uh romance scams are huge. It typically leads to this extortion uh scheme, cyber bullying, which I believe most states now have a law. There is no federal law against cyber bullying. However, every I believe every state does has adopted one. Uh photo extortion investment scam. I don't know why these uh these aren't so who are they? You know, typically the person who who is being u being asked to invest in in in crypto is is we think that it's somebody that had they had received a text online or received a text in their email saying, "Hey, I I I I found a new new business we can invest in." And you're like, "Who the heck is this? Why did you send me a text?" And you

028know, they're like, "Oh, I'm sorry. it must have been God's will that that we were meant to be. And over a course of time, they they establish a relationship with you, a trust with you. And it might get into uh you know, what kind of business are you into? And they say, "Well, I'm an an investor. I like to invest in cryptocurrency." So, they send you this site like, "Hey, just throw a couple dollars in and I'll show you how well your your money can appreciate." So you you're tracking this this site which you think is a legitimate crypto site and as the moment you put any sort of crypto in it, they will inflate the price and make it seem like, "Oh my god, I'm rich. Let me cash out." So you go to

029try to cash out and they're like, "Well, right now you're only at, you know, 200,000 200,59. We need to get up to $275,000." So, if you if you throw in another, you know, $80,000, you will be able to uh or whatever, what's the math? $30,000, we can cash that out. So, you throw in, you know, another bit and then they say, "Well, we you have to pay taxes on that before." So, they're trying to we call it pig butchering where you're trying to fatten a pig before you slaughter it. And what they do is basically just take over your the crypto, the the cash that you've actually deposited and steal your money. And what we've seen is I've had a a another uh public school employee who had began a relationship, began this trust, took

030out leans against their house in order to invest. I'm just not sure. I'm almost done anyway. in order to in invest in the this crypto uh investment scam and uh you know they there were I hate to say it so well because that money was basically sent overseas and and completely lost. >> So what what we ask from the FBI is if you do have a compromise on your network, you're going to end up either contacting your cyber security uh specialist or incident response team. have that relationship with your FBI office. Uh if you don't have it, I believe my email address is on here. Please send me an email. At least introduce yourself. You don't want to be on the wrong side of an intrusion and not know who to contact. Uh Chris Cruz

031is is going to talk later with the Virginia State Police. We work very closely with them during an incident as well as DHS SISA who will also be responding. So something happens on your network, you give us a call. I'm gonna call Chris or Chris is going to call me. I'm going to call John Harrison with the with SISA and we're gonna we're going to get on a call with your instant response team with your your third party counsel and we're going to discuss best way forward for you and and and your school. What typically happens with law enforcement is the moment council gets in the room, they cut off all contact. they'll make that initial call just because it's part of uh the insurance process, but that's we typically don't hear it back uh

032from the council and what's happening is yes, your primary concern is getting your network back up and running as soon as possible and we understand that. However, not sharing that information prevents us from possibly identifying the subjects overseas or wherever who are actually carrying out these the the the uh the attacks. So what we ask you to do is yes 100% focus on getting your network your your your schools back up and running but talk with your instant response team and say hey can we get the can we get this recovery uh uh plan and and and uh information to the FBI so that you know the more indicators that we have that these subjects are using whether it be a a tour address whether it be emails that that was used to to contact

033any sort logs that you might have that might provide us additional indicators that we can use to against these subjects and and to help identify the more we can hold them accountable, the better we can hold them accountable. So, just a couple uh things to share your findings with the FBI, right? Never click on a suspicious email link. And you know, while you're trying to protect your networks, we should be trying to protect the students as well. So the the better that that we communicate and educate the the users of anything on your network including students, parents and and teachers, uh the better you be prepared, the better cyber security practices you you you uh can implement. And again, use multiffactor authentications that if it's not a compromised password on a network or you know,

034let's say a a uh a router that just is is sitting on on on your network with still has its uh default username and password. Uh it is a an outdated uh software that we see is is getting compromised. And that's it for me. I think that's 15 minutes. I any questions? Well, I thank you for having me. I hope you enjoy the rest of the conference. Thanks. All right, just a second while we get set up. So, the next little bit we're going to do for you guys um is we're going to do a live hacking demonstration. So, I want to set the stage for you for a little bit. So, um, first of all, the hacking that we're going to be doing is self-contained on a private network. We're not hacking on the

035the, uh, hotels network, uh, for a lot of obvious reasons. Um, but what you're going to see here is real. Uh, and this could take place anywhere, anytime. All right, we actually turned it into a little bit of a skit, so bear with us for a minute as we get set up for that. Um, but uh this is going to be a live hacking demo and then we have a a little bit of a treat I think for you at the end of it. Uh, our final demo um is actually going to be a high school student to show you uh that not only adults can do it but our students can as well. All right. Hello everyone. Welcome to Virginia CyberCon. We're excited to take the next few minutes to show you a few

036techniques that threat actors uh use to try and get access to our critical systems and data. By a quick show of hands, how many of you in this room use an identity card to get to interior uh locations, secure interior locations, or your school buildings? The entire room. All right. That's what I thought. Cards are convenient. They're relatively affordable and we can disable them which is a lot cheaper than changing locks every time we lose an employee. Unfortunately, they aren't without their drawbacks. Uh we thought it would be a bit impractical to bring an entire door in for this uh demonstration. So instead, we're going to simulate a badge reader. So I have this little box right here. Uh and we have it programmed. Got a little simulation here. Yep. So, this one is set

037up to have access. As you can see, that gets in. This little key tag, however, is programmed to not have access. And you can see that was denied. Uh, anybody familiar with this? Couple hands. Yep. This is a flipper. Uh, and it even has a little cute little flipper like used to be on the show. Uh, it costs about $200. It's easily available on the internet. You can kind of think of it as a Swiss Army knife for all things radio waves. It can be used to get into your security gates, uh, to raise or lower railroad guards, to kick people off of their Wi-Fi or their cradle points that they brought to your cyber security conference. Not to name any tables. Um, uh, it can al also copy almost any infrared remote. For today's

038purposes, I'm going to use it to clone that card. It takes literally seconds to hold the card up to the device, scan it, and let's see. Can I get it? Just have to hold it up to the right spot. Boom. Uh, now now that I have that information on this guy, uh, I could do anything with it. So, I could use it to make another copy of that physical card or 30 of them. If I cloned one of your cards on your way in the door this morning, did I? Um, uh, I would have access now to your buildings or worse, I can make those cards and sell them. So, what do we do about these? Well, as David mentioned earlier, this is about layered defense. Training our users to be careful about skimming devices

039is always a good thing, and teaching them to never take their badge off and set it down is critical. Anyone guilty of ever doing that? Uh, consider official policy for this. To foil this device specifically, the best defense is multiffactor authentication, even for physical. So, that might be a biometric thumb reader. Uh, unfortunately, that is cost prohibitive. So, the next best thing is to look for the really expensive badges that are about $7 to $10 each. Uh, but they come with a thing called a security access module built in or a SAM. And they run at 13.56 MHz. So, for the geeks in the room, that's what you want to write down. That's what you want to be looking for. They have stronger encryption as well than the 125 uh khertz models. Uh, the cheapest

040defense would be to keep yours in an RFID blocking badge thing, but due to the inconvenience of that, nobody's going to use it. So, it's probably not even worth it. So, the real question is, why did we show you a physical hacking demonstration at a cyber security conference? And the reason is because it isn't enough to just lock your digital doors uh to keep the bad guys out. Once an attacker has a physical foothold in your environment, well, you know what? How about if we show you >> quick show of hands? How many of you have ever found a free cable, a free charger, or a USB drive at a company? Keep your hands up if you handed it to an employee, a colleague, excuse me, or plugged it in. I'm the only one. Um,

041well, that's what this little skit is about. One tiny choice, big consequences. for this little bit. Let's pretend that John is your CFO and David is our hacker. All right, let me see who is on my network. Who can I mess with today? I want to run an inmap command on my network. This is going to show me who my next victim is going to be. Hopefully, it's going to be somebody with a lot of money. bank account's running a little low. >> I'm sorry, Mr. IT director. How you said a sock is going to cost how much for security operate? Can we use for that? No. Okay. Well, I've got to get this silly board finance report. Oh, look, a cable. Not turning that down. Bri is good. Let's see. Got my Starbucks. Uh,

042let's see. 1340. I ain't got time for that. Let's uh look like I got two victims on the network. All right, let's get working on this finance report here. I need to charge my phone. These meetings take forever. Word chair just goes on and on and on. Here we go. Uh oh. John just plugged in an unknown cable. Do you need to charge your iPhone? Well, I've got the perfect cable for you. Here's a lightning cable that you can use to charge your iPhone. Just plug this side into your computer. Oh, these cables. Oh, now they come with their own promotional material. Well, >> John thinks that was a weird promo video. He goes back to work. He has no idea that something else is Let's see. Let's see if anybody is connected to my

043server. No active victims yet. Let's go back to my scan list. See, two victims. This is dramatic tension, everyone. >> Yes, it is. Hey, it's it's a live hacking demo, right? What could go wrong? Yeah. All right. Give me a second. Are you um have a flash drive? I don't know where the flash drives are. We gave them all away. Let's try start service on Apache. This is why you never do a demo live. [Music] service control service Go to uh google.com and go to download um go up Download attackhost.exe. Where is it? Up here. >> Oh, yeah. Yeah. So, in full disclosure, uh, Windows Defender actually deleted the malware that we had installed. Yeah. So, >> hacking ain't easy, guys. I can just run the memware. >> Yep. All right. Push that over. It's

044host attack.exe, by the way. Hold on a minute. There we go. >> All right. So, this is where we should have been a minute ago until we got foiled by a live hacking demo. All right. So, what uh what actually just happened? So, Windows Defender did its job. It actually stopped um the attack file that um when he plugged in the OMG cable, it actually pushed over um a payload uh designed to connect him to my server. And so now you can see up there, we manually ran it. And now you can see he's actually connected to my server. So now I can type shell. Actually, I got to do um sessions So I can see a session there and I'll connect to session one. >> Randy, could you switch to just his? >> And

045so now that just started interpreter. So interpreter is a hacker's uh tool. It's going to give me uh a reverse shell back to his machine. So I can just simply type shell and now I'm literally sitting uh on his machine. So if I do a directory here, I'm actually looking at his files on his machine. So I own his machine at this point. So as an attacker, I have a lot of choices I can do. I could uh copy his files. Um I could encrypt his files. I could hold him from ransomware. Um, I could collect the files, hold on to them, and then put them on the web. Lots of things depending on who the target is and what type of information uh that I'm trying to target. C. Can you guys imagine like

046what information do they want from schools? They want student data. >> It it's virgin data, right? They got years to use that data uh to use those identities. All right. So, imagine now. So, you can see as a as an attacker, I just took control of his machine. So now I'm going to ransom him. So I'm going to uh >> the attacker is set up. As we can see, John is hard at work on his financial documents. >> All right. So I just loaded up CashCat, which is and this is a simulation ransomware obviously, but I just ransom him. So now this popped up on his his machine. So he knows he's in trouble now, right? Right. So, as he goes through and he reads it, and I just encrypted all the files on his

047machine, so he has two choices. >> My files are encrypted. $300. I don't have that. I'm the CFO. >> Joe, what do I do? >> John must decide. Try to restore from his own backups, call it, or consider paying. The worst choice is to do nothing. >> I I think I'll pay. >> Let's pause the skit for a moment. John's files are encrypted. He's blocked from work. He's lost access to financial records and deadlines are real. This is not theoretical. So paying might get his files back or it may not, right? Because you could pay it then you may not get the the files and that only funds the criminals and it doesn't guarantee that you'll actually get the recovery and it may create a legal and reporting requirement for him. So but calling it

048is definitely John's best decision. We can only hope that they have an instant response process that's been tested and that they have good backups that have been tested. Being proactive is the real winner here. >> So, decision makers in the room, here's your takeaway. Backups matter. Offline or immutable backups reduce the need to pay ransomware. Train your staff. People must recognize suspicious items and avoid plugging in random devices. and make sure you have an incident response plan in place that you know uh is updated and ready to go. Uh practice tabletop exercises like we're going to do today and make sure you have your contact list and most importantly segment your network if it's not segmented. That way you're going to trap an attacker in the on the network that they're on. They're not going

049to be able to travel to other parts of your network and you want to limit their movement. And then uh also use uh lease privileges. Uh remember to patch your endpoints and your servers uh to reduce your exploitability. Uh and be solid in your vendor and your procurement reviews. You want to buy resilient systems and test them yourself, not just rely on others. Be sure to check for addistations like a soak 2. In our scenario, John ended up paying the ransom. He got lucky that his files were restored, but he paid a price for lack of planning and investment. Unfortunately, his system is still compromised. And even if it reimages his machine, they may not have any idea that it was the cable still there waiting for its ne next victim. >> A layer of

050defense matters from physical to digital to even people. Make sure you test your your backups. And John, no more mystery cables or flash drives. If you're interested in learn a little bit more, we're going to actually have some uh question answer at the end of this. But next up, I want to bring up one of our high school students, Connor. Ally, come on up. Hello everyone. My name is Connor Ally. I'm a high school senior at Louisa County High School. And um I'm going to be doing a demonstration on how in minutes you can go from having no campaign whatsoever for a fishing campaign to um having credentials. So here we have a terminal open on this laptop. Could be any laptop anywhere. Um doesn't have to be anything specific. And um we're going to

051be using freely available tool online. and anyone can download it called the social engineering toolkit. With the social engineering toolkit, you can use it for many different things. Um, but today we're going to be using it to go and create a fishing campaign and um I've just launched social engineering toolkit and it's as easy as one, two, three in this case. even it gives a list of options here and the first option we're going to do is one for a social engineering attack and because this is a fishing campaign it's going to be a website that we're going to be cloning in this case so it's a two and then because we're trying to harvest credentials to um to cap we're trying to capture credentials from like staff members or students what have you doing

052three in this case and For this demo, we're going to be doing a website template, but there's also the option of using the site cloner, which um goes and grabs a a website that's currently live and downloads it, finds the form fields that it needs for where you'd put in your username and password and all of that and then goes and like logs them. So then whenever somebody enters a username and password, I can see it here. But for this demo, we're just going to use a web template. And in this case, because this is a demo, we don't need to modify the IP address here. In some instances, you would need to. And we're going to be using the Google template in this case because um it's most commonly used for um just everyone

053in general. Uh 192 1680 one second again. Live demos go wrong. >> All right. Redo that. >> All right. That happened because I had to start the web server so John could download the malware >> and that will conflict. So one, two, three, and then we're going to do a template and then we're going to Google >> do um pseudo. Well, you already pseudo Yeah. try. There we go. All right. So, in this case, we did need to put in the IP address since it didn't have it autofilled. And in a lot of cases, um, right here, it would it would have it in parenthesis, the IP address that it would use by default. And in this case, it did not. So on our target machine, we have loaded up the web page that um

054in this case is supposed to mimic Google and we don't have images because we're not connected to the internet for this demo, but um it's still has the rough layout of a older. >> All right. So I put in the IP address of his machine. So envision a hacker has sent an email, a fishing email out with a link in it, right? It's it's going to be of a domain name. They clicked on it. They loaded up this page now. So, I put in my credentials here. Davidme.com. >> All right. Now, put the uh the attacking computer back up. I want them to see. >> And before I submit it, >> before he's even submitted, we can see that somebody has tried to access the web server. So, I can actually have timestamps for when

055um potential victims are connecting to the server. And as you can see right here, we have the email and the password that he typed in after he went and clicked enter. So, and it took literally five minutes to go in from having nothing for a campaign to credentials. Yeah. So, and the reason I thought this was important one I wanted um Connor is is a great student, super sharp, but high school kids can do this. They have access to these tools using Kali Linux. It's freely available online. You download it for free, put it on a flash drive, and I can go and boot it up on anybody's machine, and that machine could be my attacking computer. >> And what's worse about it is since it's on a flash drive, you can go and remove

056flash drive and such, and there's no trace on the laptop whatsoever that it was even used. >> So, awesome job. Thank you, Connor. introduce the answer. >> There we go. What's the answer to that question? Little louder, please. Not at all. Right. [Music] All right, our next speaker is the co-founder and owner of Just Hacking Training. He is a cyber security researcher, educator, and content creator. As part of the research and development threat operations team at Huntress, John spends his days analyzing malware and making hackers earn their access. Previously as a Department of Defense Cyber Training Academy instructor, he taught the cyber threat emulation course, educating both civilian and military members on offensive Python, PowerShell, and other scripting languages, as well as the adversarial mindset. He's developed training materials and information security challenges for events

057such as PICOCTF and competitions at Defcon. John speaks at security conferences such as Besides Nova, Besides everything to students at colleges such as US Naval Academy and other online events including the SANS holiday hack challenge and Cringlecon. He is an online YouTube personality with more than two million followers uh showcasing programming tutorials, CTF video walkthroughs, and other cyber security content. Would you please join me in welcoming Mr. John Hammond. All righty. Mic check. It works. Excellent. Hey everyone, good morning. Thank you so much for letting me join you here. This is quite a treat. Uh John had reached out I think way back in maybe February or March of this year to get together for Virginia CyberCon 2025. And way then it still didn't really have even the name the idea was coming together but

058I'm really flattered for the opportunity to spend some time with you all. Uh and when I heard look the premise the theme kind of the idea and talk is are we ready? I thought maybe a fun little title for our oh opening kind of kickstart the party here is look ready or not the threat's real. Uh the attacks are here here they come. So one thing that I like to do when I get to oh do some presentations and spend some time with conferences is start with a question I've heard from Jason Blanchard uh a great friend who you might already see running around later today for some of the tabletop exercises. Black Hills Infoset, great friend. He his best suggestion, the advice and what I learned from him was asking a question to get

059things started. And normally I can ask, hey, have you ever been to a conference or security kind of focused event like this before? Is this anyone's first security focused event, but maybe with a little hyperfocus on education? I don't know how many that might actually ring true for, but that's awesome. Great. I'm glad you're here. Another question though, if I may, and I don't mean to be too much doom and gloom, but I would love to ask, how many of you have uh successfully been able to test a disaster recovery plan or incident response plan in the last year? A couple hands, maybe. Maybe a few less. A better question is, okay, how many have not in the last year? Yeah. All right, cool. I love seeing the hands go up for that. Well, look,

060let me get the obligatory intro, who am I, credibility slide over with because I know no one really cares. I put the oh title in comic sands so we can make fun of that and have a good time with it. But look, I got my feet wet in this cyber security stuff in the Coast Guard. I attended the Coast Guard Academy and then bounced over from there to the Department of Defense Cyber Training Academy. I was a teacher and instructor with them for a little bit, teaching some military and government contractor folks a little bit more of the offensive operations and then I thought, you know, I should be on keyboard. I I wanted to be an operator. I wanted to do this myself. Bounced over to the Defense Threat Reduction Agency to work with

061their cyber red team. Truth be told, that had a bit of uh red tape, kind of some slowmoving procedural stuff that slowed down that work. But now I finally found my home over at Huntress. I'm a security researcher there. So a nerd, a geek. I love cutting up malware, trying to chase hackers, see what trade craft they're up to. And that's a managed security solution, right? Hey, it's EDR. It's all those acronyms and buzzwords, but trying to do security the best that we can and protect the folks that we're often helping with. I'll note maybe some folks are more familiar with the work that I've done online. Uh, I have a silly YouTube channel that has blossomed and grown into kind of a machine of its own. I'm very grateful for all the support and

062really what's that what that has turned into and I appreciate all your support and all the other folks out and about on the internet. Uh, another side quest I've been doing with that uh just hacking training an extra venture just to get some more schoolhouse curriculum courseware and training for hands-on keyboard practical applicationbased stuff. But uh that's enough about me anyway. I thought it might still be fun to kind of go back in time a little bit and chat about some of the silly shenanigans that I got up to when I was in high school to poke and play at the security posture of my school. Uh, what did I do as a little rap scallion kiddo making a mess of things? And way back when I uh I went to Laconia High School in

063Laconia, New Hampshire. It's a little bit some northeast New England here. Um, and this is maybe 2010, 2014 timeline, I'll admit. Um, but here's the thing. We were big on the pride of Sichchums, the mascot. Hey, where we wanted to be. Um, but I draw this parallel for you here. I hope we can look at this time period in the past to see how the security landscape has changed in different ways. And you can see yeah what some of the silly kiddos might be up to uh out and about here on the internet there because they had uh a library right in Laconia Middle School, Laconia High School of course a library room where hey you've got everyone on specific computers uh kind of thick clients that are already provisioned here a desktop environment that

064they would be able to interact with. There wasn't folks bringing in a laptop. Students weren't bringing in their own devices. These were already on site here. And this was Windows XP way back when. Uh we'd all log in with some network account, uh student individual or faculty account that we'd log into. And I was one of those kiddos that was thinking, look, I want to explore. I want to go see what else is out and available on the internet or use some of the other tools or code or scrappy stuff that I've written and use it to get some of my work done. Uh if you read between the lines here, I wanted to get to GitHub, one of those online service, oh hosting code and projects and software, but they had an internet filter.

065Uh probably common, right? And way back when I think this was Prism. I remember that login screen. I don't know if that's still kicking around, truth be told. Um, but whenever I wanted to get to GitHub or to any other site without any nefarious or or really ill intent to go to some strange website, but things that I still just wanted to access, internet filter got in the way. Now, this would kind of ask for a username or password if you wanted to bypass that filter. And as a student, as a low low-level account, right, I didn't have those privileges, but maybe some other teachers or faculty members or staff maybe did. Um, so I got to thinking, a scratch in my head, how could I get past the internet filter? Couple different approaches, right?

066Um, and for the nerds and geeks in the room, I don't know if you might appreciate this, but look, I could just SSH out. um Putty or now it's included in a lot of computers on Windows here, why not just proxy and filter some of my tunnel out of the environment and that's easy enough. Not so much of a concern, right? Okay, I'm just connecting outward and having some internet connectivity network packets going my way rather than the school's way. But that's one option. Remember how I alluded to maybe some folks with higher privileges, other team members, teachers and faculty and staff might be able to get past that internet filter. And now every student or every faculty member, every individual here on site has their network drive. You probably have something similar, right? I

067don't know if the red uh oh almost filling up the hard drive space gives anyone else anxiety, but that was something that everyone had a network share a Z drive and you put in your data, your documents, your files there. But here's the thing. Uh I got a little bit curious. What makes up that network drive? Well, it's just sort of like a shared folder on some network file system thing. But I'll admit it's kind of sitting on a flat network and all of the computers, endpoints, hosts in the library or any computer in the whole building at the old Laconia High School was just kind of oh blasting out sharing and showcasing those shares, those network shares. So while you know that Z drive or maybe your X drive or whatever if you have

068an equivalent that's alongside the other shares or network kind of locations that could be including the file system like your C drive on your computer and if those are kind of open out naked and bare to the winds to stop maybe some smart crafty kiddos and students from placing file files on other computers that aren't theirs remotely and you can get a little bit clever, some calm wither shenanigans, and run other code, execute programs. So, as a stupid kid, maybe it was a fun little joke. I uh would use some old Nuroft utilities or these programs or tools where I could just in hij jinks, uh-oh, turn up the volume, play some silly song, turn off the monitor, and make a fun little scene in the library that's normally a quiet, you know, calm location.

069Silly stuff, stupid hy jinks. But Nurosoft, this whole suite website, or maybe some folks might be familiar with it, includes password recovery utilities. You see where I'm going? What's to stop us from trying to now go put that password recovery tool on those remote computers that we could see and then maybe dump pull down faculty and staff or other students or other teachers passwords and credentials. Silly thing, but that could get us through maybe the internet filter. Maybe one option. And granted, this is back 15 or so years ago, decade and a half. There was a pretty recurring theme, like a standard schema for what a password would look like for your account. So me, John Hammond, by default had a password of Jam4817 or something like that. And say we found another individual. Oh,

070we caught another faculty member, staff or student that had a similar looking style. First letter, three letters of their last name and then four digits. That's an easy little key. Something we could probably iterate through brute force and go track down. We just need to figure out four characters, four digits, four numbers, and then we could go beat up the internet filter bypass button. I don't know why they gave us that, but a small silly cutesy thing. And I wanted to just kind of put that in your mind here because look, I wonder, is that an insider threat? Uh, even looking at the strange, silly stunts that maybe your student would do. I know I was just a kiddo, dumb idiot then, but okay, we get our gears turning for more in the future. And

071what maybe your faculty might be up to? What are other students scheming up when they are poking and exploring what's in the network already from the inside? Anyway, anyway, anyway, I'm sorry. I know that's an anecdote. 15 years or so in the past, not super duper valuable to you. So, what if we fast forward speedrun to today or at least as close as we can get now to kind of the modern age? Obviously, it's a very different threat landscape, those risks, those threats, what the cyber criminals, adversaries, and threat actors are up to. But you kind of know this playbook, right? I think we've all heard that already. and I'm sure you'll continue to throughout the day. The fishing email, the social engineering lie is usually what lets a bad actor into the environment because

072they're preying off of the human weakness because maybe not all of us are just as well-versed in the technology and the computer systems and everything that we're using day in and day out. Maybe they're just oh clicking along and maybe they fall for that fishing link or anything else. And when they get to that opportunity where their credentials are stolen, some of the cookies or their account is taken over, oftentimes once they have that foothold, they'll use info stealer malware. And these are programs and payloads that will rip through all of your cached browser data, whether it's browser history. So I'm thinking like Google Chrome, Firefox, Internet Explorer, etc. Some of the autofill data, some of the things when you select remember me, remember my signin or anything else, cookies, credentials, save passwords on the

073computer. Now, that lets them take advantage of not just this one account, but maybe those passwords could let them into any other online account. And at the end of the day, you probably know, the real money maker is ransomware. How can we extort, how can we blackmail, and how can we demand financial money from us? I have on the side here uh kind of a little listing that you might see and we'll touch on in just a moment of some of those other threats uh and how often we see them. And I'll admit this is coming from the lens of me and my day job over at Huntress security researcher there. But I think it's clear when something goes down, when something hits the fan, it's obviously disrupting operations. But unless you're in it, unless

074you've been hit by that, unless you're already whacked over by the head with it, you might not think of all the things that get in the way. And I realize this is a screenshot uh and I apologize from a college here in 2022 just a slight bit dated but they're in the situation this is Howard University hit by ransomware and they can't do even online classes or some of the education some of the work that they're doing because they're just crippled. They can't they can't operate and however long it takes to recover from this. They're spending all this and it's not going anywhere because they can't get up in action and even online classes are canled. Power school, uh, sorry, I know that might be a sore subject. Needless to say, that got its time

075in the limelight. Headlines, news, of course, we've all kind of lived through that. But that's another strange scenario because that's a supply chain threat. This wasn't even a fault of oh the security perimeter endpoints and host that we have inside our environment. We're kind of almost pointing the finger like oh this was a solution that we use but there's a weakness there's a gap and that's when we all need to have some of that security scrutiny. But if we actually pull back the thread on, oh, the troubles and tribulations from power school, who was at fault? Little kiddo, another college student was the one that was kind of hoing, making a lot of the damage done from that incident. And I don't know if that likens back to oh those silly scrappy stuff that I

076was doing over at Laconia High School, but it's that wonder. Okay, the adversary, the threat actor that you're up against could be kind of anyone, anything, even just kids. And I know we were discussing in just some of the previous demos and sessions that like look, this is so commoditized now. It's so easy to access. Whether it's a link on the dark web, whether it's some tooling you can get off the shelf, see on GitHub, etc. Those are all the things that are all the time everywhere. Here's another recent example. I think this is again 2022. We'll keep getting closer to modern day. But Los Angeles, Los Angeles school district had one that was quite in the crosshairs because from that incident, the threat actors now doing this extortion, now doing their blackmail, demanding payments

077weren't getting anywhere. They didn't see the money and the revenue and the income that they wanted. So, they started to pressure parents. They started to straight up call mom and dad or any of the individuals, okay, are now at the home life with the students to say, "Look, your school district is neglecting this breach, this incident." And now they're putting some hard pressure on mom and dad, on even the parents and guardians at home trying to say, "Look, your school district needs to get up in action here." And that made a lot of noise. I don't know if folks were tracking some of the timeline for that, but press releases, TV, radio, all of the commotion and chatter where you've got a certain kind of uh reputational hit, right? That does not feel good to

078get up on stage to get up in a podium and try to talk through the cyber incident that we're working through. Ow. Anyway, I'm sorry. I was alluding to some of the work that I know I do and forgive me, I don't want it to be too selfish here, but this is just the vantage point that I can offer you. When we over at Huntress are chasing hackers and malware and working through different incidents to help protect, one thing that we like to do is share the incident report or threat report across the whole year. Can we look back and see what were the trends? What was the trade craft? What different techniques are these bad actors using? Well, it's always okay. Maybe sometimes it boils down to ransomware, but what else did they do?

079And how does this look across all the different sectors and different industries across the whole world? So, if we take a quick look at one of those most common threats, and I I know we're looking in the past year, this is 2024, but info stealers kind of reign supreme. Uh because again, that's the malware, that's the payload that could allow the threat actor to move around and find new opportunities, new access points, etc. Ransomware will follow suit a little bit down, but there are a couple other interesting tidbits that you might catch. RMM abuse, folks familiar, remote monitoring and management solutions or tools that you already have that you naturally use inside your environment to help provision, to help configure, to push or patch updates to all the different hosts that you might manage. And

080hackers when they have an opportunity to latch on to that system, that's the trusted white glove opportunity to now have access to each and every computer. And it's like they're using your own tools against you. that comes with some vulnerabilities, maybe a weakness in that software or info stealer malware opening the door, finding that to get credentials to log in to a management portal for that RMM. We'll touch on that a little bit more, but I did want to at least keep that one in the back of your mind here. When we get to the industries, the sectors 2024 again looking back, you got technology sector, you've got health care, you've got manufacturing, government here and there, education, 21% of all of the incidents, all of the in like infection reports that we sent out

081the door to last year in 2024. Now, I know that just percentage isn't extremely helpful for you, but know that it is less than a quarter, just a smidge. If we actually take a look at all of the reports that we sent out the door, the different malware infections, the incidents and breaches that we've been trying to track, and these vary, maybe low priority incidents like some potentially unwanted program, or absolutely critical alarm bells going off, ransomware, right? I think we sent about almost 300,000 incidents last year, 285,000. And if we did the math, our 21% for our education focus, about 60,000 throughout that year. Um, which is a lot. It's not zero. It's not an exorbitant number compared to everything else, but you don't want that to be you, right? It only takes one

082and of course SIZA cyber security infrastructure and uh security agency is tracking this. Uh they've had a lot of work with their shields up campaign. in Italy was doing incredible work there and I know they put this front and center and there has been more and more conversations of like look we got to start to get K12 and education security right because we can see the damage and it's not good. Now, Siza harps on the fact that a lot of this comes from fishing emails, which to a security researcher nerd and geek like me, fishing emails aren't that sexy. It's something we kind of oh roll our eyes at and scoff, oh, another another fishing email, right? And maybe you have that same mentality talking about, oh, some awareness training and all, but it is

083so necessary. It is so vital. I have a couple screenshots here and again a little bit old. This is 2017. You might be able to see some of the time stamps here. But when uh our FBI individual was up speaking when Chris was alluding to look, threat actors and hackers are going to do their homework. They're going to research. They're going to look and try to understand what systems are in your environment. What technologies do you use? And truth be told, maybe sometimes you just put that out on your website. Maybe that's an easy thing to profile when you say, "Hey, other parents and guardians, if you want to check your students grades, log into this system or use this specific software." Unfortunately, I know that's some necessary evil, but when threat actors are starting

084to profile and look at how could they attack you and your attack surface, they're going to be more specific and more granular than this sort of cast out, oh, easy option of, hey, we're updating our software. Click this link to get the new update. No, they're going to be saying something targeted to maybe the student, maybe the faculty, maybe the teachers there, and it's not always going to be just this kind of cast abroad wide net. Another one similar, stupid and dumb. Hey, you run out of storage space. Maybe that Z drive, your personal network drive, whatever the case may be. But it's always that click this link, go to this website, log in here. Certain amount of urgency that you all know. I know you've heard that time and time again. But this is

0852017, right? That's boring. Okay. However long ago, do you want to know the latest hotness? You probably already seen it. Maybe it's already maybe circulated and you've heard some stories here. The old uh capture the old click this box, verify you are human. We're probably pretty desensitized to that, right? Whenever you're browsing the internet, whenever you're online, you're filling out a form, going to different pages, and you're so used to clicking and checking, verify you're human, I'm not a robot, and then normally if they let you through the gate or the turn style, maybe Cloudflare is their renition or the Google capture. Other times they tell you, "Hey, click all the fire hydrants. How many bridges are in this picture? Can you count the cars?" And I know that's silly, but hackers and threat actors

086have gotten a little bit smart because they know you might let your guard down when you're just doing this stupid internet boilerplate. So, has anyone ever seen when you click the button to verify you're human, they give you a couple steps? They say, "Press and hold the Windows key on your keyboard and press the R key and then press controlV on your keyboard and then press enter." I Our nerds and geeks are giggling. This is good. I'm glad we've got folks know what this is. Know what this is doing? Anyone willing to shout it out? Clickfix. Yeah, this has become known as the clickfix malware. And that Windows key and R button on your on your keyboard will open up the run dialogue box. So on a Windows operating system, just a simple quick and

087easy way to start a program. But when they tell you to use CtrlV, well, that's a keyboard hotkey to paste, like when you're copying and pasting in your clipboard to work on your computer. But the website here, our fake stupid microsoft.com, that's probably a lie. Of course, the page could be anything. Social engineering trick where they're going to prey off of the folks that just don't know. You're gonna start a program and paste in whatever the website poisoned and pre-prepared for you to run a payload to fire off malware to invoke and detonate involuntarily voluntarily in this point because bypassing your security controls you've just tricked the end user to run whatever code. I got to be honest, this has kind of been running rampant. Maybe a couple of you have seen this already the

088past year. probably just as prolific as fishing. But I know another thing that we were discussing were those RMM solutions or remote monitoring and management. I don't know if any of you have these in your environment, but you can think of those utilities that let you connect to a computer to help troubleshoot or to prepare, provision, configure. Maybe it's Team Viewer, maybe it's Ultra Viewer, maybe it's Anyesk, maybe folks use Screen Connect or Ninja One or Aterra or Synchro Action One. That list goes on and on and on, right? But I know that is probably a CIS admin's worst nightmare when the hackers have suddenly the keys to the kingdom because these tools grant access to each and every other downstream computer and that is how they could push out ransomware. Here's a case study

089from this. Again, apologies. This is a huntress screenshot, but we're looking at the processes looking at the computer code that happens here. That agent, the software Aera agent.exe is taken over by whatever bad actor. Now it's already running as system. It is running as the highest level of privileges on each and every computer. But it will push down through command prompt, PowerShell, nerd gobblygook to add a backdoor user, add more access. So they have their hooks and claws in the environment and in each and every computer in the environment and there are other things to think about and maybe some of us will roll our eyes and scoff at this but I hope this is a little bit more tactical because you don't always think and I was alluding to your oh maybe website just

090tells outright some of the technology software that you might use for letting teachers, parents, faculty, everyone be able to work with this even from home. What is your exposed attack surface? What are those ports or protocols that are easy for anyone on the internet to just poke at? RDP, remote desktop protocol. I know we're thinking, look, okay, 2025, this should not be a conversation. But more often than not, more often than they should, hackers are still breaking in the door just by brute forcing what could be the password for your remote desktop protocol if you have that open out naked to the wind. So, let me fall down the rabbit hole just a little bit for probably all the stuff that you already know as to why it's hard for what you all have to

091do and deal with. Uh, and this is me, I'll admit, kind of taking a guess because I'm not in your world. So, please help school me if there are a couple things that I miss. Although, we'll chat a little bit more about this. But, you are kind of splitrained. Is that right? like you're managing of course not only the students in the school districts here and the faculty and the staff that's an extra handful and I think this is kind of across different locations you may or may not have a building here or a campus here or one location or another right so you're splitrained even more and you can't keep an eye now in today's world on each and every device in the environment. Students, faculty, teachers maybe are bringing their own laptops. They're

092bringing their own phones and you don't really have the visibility and telemetry to keep your security blanket on top of them. Is that fair to say? Am I right? Am I wrong? Am I barking up the wrong tree? A couple nods. Okay, cool. And then even worse, maybe this doesn't apply to everyone, but a lot of the education spots I know are doing some research or they're trying to look into, oh, what are the new innovations, new possibilities for our world? And that has, of course, student data as they're doing that real work. And it's looking across the horizon as to what they might be able to do next. Some of that could probably be what you consider confidential or personal or private PII, etc., etc. So, um, there's one asset and resource that I

093really wanted to bring to you all. If you're willing to take a look, I think this is some crazy cool recommended reading. Uh there was a write up an article by 74 million or the 74 million that goes through some recent case studies, some recent incidents, past breaches of school districts of K12 scenarios and they're talking about how this all happened. You get to see some of the ransom notes. You get to see some of the conversations and interviews with the people, individuals affected. and they get into some of the raw nittygreedy good, bad, and ugly aftermath of each of these. Let me please give you a warning and caution. It is scathing. It might kind of feel like a swift kick in the pants uh because some of it is not is not good

094to read. Some of it hurts. I'm going to be honest. They do give you a cool tool. They do let you actually oh maybe even just scroll through or select hey what were some of the recent incidents in your region in your location or recent district. Um so if you have any interest maybe it's worth taking a look seeing what else is out there seeing maybe what's close to home or what else uh our whole industry is seeing on that front. So if you're willing to scroll down if you want to read it I know it's a lengthy article but I do genuinely want to give that to you as some recommended reading. And there are a couple excerpts that I'll pull on here. The first people kind of alerted oftentimes from an incident or

095a breach with schools here isn't always the public or the police. from this reporting here. A lot of the incident response plans that maybe your districts might be up to are going to put insurance front and center and lawyers and privacy concerns and putting all the kind of buttoned up stuff first. Primarily so you're not getting parents and guardians angry and causing a bigger stir and commotion and news trouble than it needs to be. Right? The public is often unaware, they say, and I know this is maybe sometimes hurts, when school officials will quietly agree in closed door meetings to pay a cyber criminal's ransom demands just so they can get this over with, just so they can recover their files and unlock those computer systems. And hackers kind of caught on to this. Even

096if you're hit with ransomware once, have you ever considered what if you get hit with ransomware a second time or a third time? Because well, if you never patch or fix a solution, they'll come right back and they'll know you're a repeat customer, you'll pay again. And cyber insurance, now that that's kind of in place, well, if that just helps foot the bill, maybe sometimes the payments are guaranteed. Uh that's a tough pill to swallow because I don't think we particularly want to pay that ransom. But you got to think about what what are you worried about? What are the people what are the students faculty? I know we were discussing student data is the real high target because those are identities that they could use for the future and maybe that includes all of

097their history, all of their medical information, all the documents that are necessary for them to be part of the district and the system here. Of course, the social security numbers, PII concerns, government program details in case anyone is in a specific kind of environment and setup. I'm sure you can extrapolate all of the things that we start to wonder and worry about when a breach or incident would occur. If you look back at that uh 74 million reports, if anyone has happened to be scrolling through it, maybe getting a chance to review maybe later, but this I think is another damning kind of picture here. Security cameras, security footage, right? students walking down the halls, opening their lockers, doing whatever they might do. But our bad actors, our cyber criminals put this on blast and

098they share that out on the dark web as just a small sample of the data that could be in there. Blast it out to the dark web after the school district victims refuse to pay the ransom. So that's the threat. That's what they dangle over your head. And a couple more of those challenges. Again, I'm sure you already know I'm preaching to the choir here, but I have a hunch. Yeah, it's hard to find some cash in the couch. Uh limited budget, limited resources. You've got all this extra overhead from Okay, mom, dad, grandpa, grandpa, federal government here and there, too. And you can't always get what you feel you need to get security right. I know that's a hard topic and I need you to start to kind of demand it. Not to parallel

099and mirror our silly ransomware analogy, but like look, seriously, this is what we're up against. Medusa ransomware, this is 2023. The ransom demand, which beat this up, was a million dollars. Um, I'm thinking this was Minneapolis. I think that's okay to say. I've got a link down here so you can spot check me on all the things. Now, Minneapolis, they did not pay. They said, "No, we will work off our backups and try to get back in action." Thread actors, of course, then put this on blast, shared everything out on the on the dark web, put this out on the internet, and that hurts. But I really wanted to drive home that financial or that fiscal amount because I know that is the sobering tough pill to swallow. Even if you don't pay the ransom,

100the recovery efforts to repair, remediate, try to get back up in action is still a pretty penny, a million dollars. Again, Tucson was saying, "Look, we're going to need even more than that. that million dollars plus in recovery efforts to bring this back. And there's an interesting thing though. I know I showed you a couple of those case studies from 2023, but if we look at 2024, and again, I know we're talking money, dollar bills, and stuff that may not be everybody's bag, but I think it is still something that we care about here. Now, 2024 into 2025, if we're catching on to the trend of, yeah, we should not pay the ransom if and when we're hit, not a matter of if, but a matter of when. Getting back in action is still what

101hurts. Disregarding that reputational hit, those press conferences, the TV commercials, the news, the radio stations. So, in 2024, link down below again, please spot check me. I'm trying to get the the facts here and all from recent reports here almost four million more than double what it used to be. But interesting thing, ransom demand payment, what the threat actors are saying, oh, pay us this x amount in Bitcoin, has gone down, truth be told because schools are getting smart and not paying the ransom, as we shouldn't, to embolden and encourage more cyber crime. But the recovery amount obviously going up because there's more to fix, more to patch up, board the windows here and there. I'll try to get these slides to you if that's helpful or if anything is worthwhile if you'd like to

102review or maybe catch a QR code here and there or other links if you're interested in it. But look, I I've been rambling for too long and I apologize. I think I know what folks tend to do. I think it's easy to buy whatever product, whatever shiny new blinky box to check a box and to just say we did it. We got it. Yeah. Cyber insurance. Yeah. Okay. EDR. Sweet. sock. Good. But that still needs your attention. That still needs your understanding of okay, what is the firewall actually configured to do? Is the antivirus engine running? Do we have exclusions that are being set where we shouldn't? That needs you to be with it and have a little bit of understanding. And I know at the same time that's hard. you're busy, you got plenty

103of stuff to do. I think if you can get some endpoint detection response or any of the new fangled o buzzwords and all look, try to bolster in your team, have the trained staff and individuals to manage this work or if you're willing to outsource, know that you've got the right experts, know that you've got the right expertise bringing this all home. And even if and when, remember I said it's not a matter of if, it's a matter of when disaster strikes, that disaster recovery plan that we haven't tested in a year or so or however long, when we haven't gone through that tabletop exercise to know who do we call, who is the breach coach, who is taking point on what effort, what are the orders and operations here. That is what we need

104you to kind of practice and prep and prepare. And I know again that's not super duper fun. So the whole industry has tried to make this fun, make this better, make you wanting to play and practice and get sharp on can I test myself in the scenario that is usually fight or flight, but in whatever critical threat or critical incident, you are already trained and ready for whatever randomness it throws at you. There's a game uh little back doors and breaches kind of a card game that uh I think you'll get a chance to play a little bit later and to walk through these scenarios. Maybe you've seen this before. I know Jason Blanchard, our Black Hills infosc friend is running around. Um but this is awesome because it saves you from coming up with

105the ideas as to what went wrong and a little bit more tactical as to how did the hacker get in? How do they pillage for credentials and get more access? And how do they move around and what do they do for their impact and all of this? So, you get a whole real scenario to walk through and you can start to talk who does what, who is owning what. One of the coolest things that I love about back doors and breaches. While it might look like, oh, a card game, you might be able to catch it in another picture. Maybe this is nerdy, maybe this is geeky. We've got like the D20 Dungeons and Dragons roll a dice to get that randomness, but that's really it. That That's really to have a certain amount of

106randomness for things that you just can't expect. Uh uhoh, CFO decided screw this, I want to go be a rockstar. I'm going on tour. Leave you guys at home. Good luck. It could be anything. Hey, the person that's our vital bus factor individual that manages all the infrastructure here, they're on vacation. whatever. We can't get all someone on call. All of the things that you never expect, the never things you never think of could just be bad luck from a dice roll. So, that throws an element of uncertainty in there while you get to practice and play. What are the defensive things you do while the offense is working against you? But, let me try to wrap this up. I'm sorry I've been rambling for too long. I think when we get to the end

107of this, while I have dragged us through the doom and gloom, uh oh, financial money risk, the reputational damage, the concerns from PR, from parents, from guardians, when you get a chance to make this better and right, when you get to fortify the walls here, I'm going to be honest, you're going to hear a lot of us saying the same thing. And it's going to be stupid. It's going to be boring because you've heard it all time and time again. Multiffactor authentication, long complex secure passwords, don't click on links, don't plug in USB drives, blah blah blah. Patch, run the Windows updates and make sure Defender is running cool when it works. See those vulnerabilities and maybe some software that you use and make sure you're on top of that. Test those backups. It's one

108thing to have them. It's another thing to make sure they work. And if you can catch up, I think a lot of the manage endpoint detection response stuff is coming in clutch to help save your bacon here and there because it's best to have another set of eyes and some other experts here in the mix to help when you're already busy. But the risk to it, I've been beating a dead horse. I have been banging a drum. And I'm sorry for rambling, but when we boil it down, yeah, fishing, infos, stealer, malware, oh, the lead hacks, the ransomware stuff. It's important to know what those techniques are just so you know what you're up against, right? And maybe it's kind of cool. Maybe it's fun to see some of the fireworks. It's more important, it's

109essential to know how can you stop those threats and those risks. the silly Windows key and R click fix malware, the info steelers that might have some specific triggers and footholds there. It's good to have that awareness, but I think when you get to zoom out, when you get to be the leaders, and you get to be the decision makers, the biggest thing here for you is that context and awareness as to how bad will it get when something hits the fan? Whatever money, whatever dollar signs, whatever millions of dollars people are saying, I think you got to keep in mind your people, your faculty, staff, students, your colleagues, your peers, you know who the victims could be when breach of data like this happens and you need to know what damage could be done

110from that that impact. That is absolutely critical. So, my last final final takeaway. I'm sorry. I know I'll shut up. We'll get a chance to take a break. Stretch your legs. Thank you all for bearing with me. I think it's so cool. When uh David was up here at the very beginning of the intro, he was saying, "Look, your work matters because it's not just for you. It's for the district, the school, the education, the future, the kids and generation that you're helping teach and train." And when cyber security, which usually feels like a cost center, usually feels like, oh, an extra thing to have to deal with, you got to stay with it. You kind of got to be on the pulse because it changes day in and day out. And it's something that

111you want to earn your cyber security posture. Cyber security is something that you need to earn each and every day. But that's enough from me. Thank you all so much. I hope that was still some good messaging for you. Thank you all. Enjoy the conference. >> All right. Thank you again, Mr. John Hammond. Appreciate you. Um, I didn't want to leave you all hanging about this cable. Anybody curious about what this cable is? >> Yeah, I've had a couple people. Yeah. So, this is an OMG cable. It's $200. You can buy it online. Anybody can buy it. Looks, smells, probably tastes like a USBC or lightning cable. I haven't tested that. Uh, you cannot differentiate it from another cable. We've had to manually mark and label them so that they don't get mixed up with

112the real ones. Um, they have built-in keyboard emulator so they can type commands when they're plugged into a computer automatically. They could launch websites. They could put files on PCs. Uh they also have a built-in wireless that allows us to connect to it from a phone. So this gets dropped off in your the attacker doesn't even have to be in the building. And the real threat is what what's the first thing we do when we when when somebody goes, "Ah, my computer's having a problem." Right? We go in, we look at it, we say, "Okay, well, what was the user doing?" We check out logs, that type of thing. Uh well, what happens if this has been latent and sitting in somebody's office for three months? And then you come back after the fact, there's

113no logs. You have no idea. attackers been on your network for literally ages. So, uh anyway, if you want to see it afterwards or during the break, I'll be over here. Uh but we are now going to move on to uh the first prize wheel. I don't know if you guys knew, we we've got a lot of prizes to give away today. Uh you must be present to win uh void in Canada and Delaware. Um we ready? All right. Um, so again, excited. Hope you guys are excited. I appreciate John's message and you know what he was saying. Uh, that's why we're here, right? Is that we don't want to have to pay the ransom. We don't want you, your school divisions to be put in a position, which is why, you know, we took

114our time to to create this uh this event uh for the state today because we care about school systems. Um, John and I have both been in it for uh many years. um worked at a couple different school divisions and this, if you can't tell, is extremely important to us uh because we care about our kids and we care about your kids and your school divisions and we want you to be uh protected as well. So, uh what we're going to do is I'm going to give away three prizes here uh real quick and then we're going to take about a 10-minute break. Uh restrooms again are right back here. There's a coffee and water out there. They'll be setting up some drinks out here as well. Uh but let's get to it. Let's see

115who we're going to give away. Uh the Beat Studio Buzz. Who wants to win that? >> All right, let's let's spin the wheel and see what we got. >> You only win once, right? So, Carl, we're going to remove you from the wheel, bud. All right. Next, we're going to give away this F S17 drone. Who wants to win that? Anybody? Let me see your hands up in the air. Only a few. Okay. Lean Davidson. Wait a minute. Was your hand up in the air? Yeah. Okay, dude. That'll teach you, right? All right. And the last for that right now is going to be a uh retro Nintendo uh 621 games. Who wants to win that? >> Oh, y'all didn't learn, did you? You didn't learn. All right, Molly. Anybody else? It wasn't rigged, I

116promise. I don't know any of these people. All right. Well, again, so we're going to take a 10-minute break uh while we get set up for the next one. Um and go ahead and clear your tables. Uh so this next event we're going to pass out. Um can you hand me one of those, John? So we had these specially printed for us today. So this is the back doors and breaches. um mat that we'll be using uh for today. We're going to try and go through two of those uh tabletop exercises. Uh obviously depending on time, but go ahead uh use the restroom while we get set up. We'll be back in 10 minutes. back to your seats. Start making your way back to your seats. We're going to begin shortly. Wow, that got quiet

117quickly. All right, so we're going to be entering in a um I think this is exciting. I think it's exciting uh for our tabletop exercises. Uh it's g it can be confusing. So, we're going to go through and explain it and how the game is actually played. But I do want to tell you, all right, when we get ready to play this game, we're going to have cards and everybody in this room is going to get a set of the these playing cards to take home with you. Okay? And we're going to be we're going to ask the volunteers later on to lead the second session because the first one we're going to do as a group, as a whole room. Then the second one we're going to play at each individual table. All right?

118We're going to need volunteer for somebody to lead at that table. And as your reward for leading, you're going to get to take back the uh playing mat with you. All right? So, be thinking about that. We're going to ask for volunteers. Now, here's the critical thing. You're gonna see names of programs and stuff on these cards that you've never heard of. Okay? And I want to tell you it's okay. All right? It's okay because guess what? I'm a certified ethical hacker. John's a certified ethical hacker. We're in this stuff all the time. And there are things on these cards we've never heard of. All right? So, don't let that bother you. Play the game. Answer the questions the way you would do it. And if you don't know what it is, then we're going

119to write you. If this was real, you'd write it down and you would evaluate it and look it up later. Okay. So, having said all that, I want to introduce to you Jason Blanchard. Jason is with Black Hills infosc. So, I do want to say a thank you, a huge thank you to Jason and his team that are here. Y'all raise your hands back there. >> Jason's team back there. They have volunteered to do this. They created this game. It's available online as well. You can go buy these things. I would encourage you to do it. Play these in your division. All right? It helps. It'll help you. But they have donated their time, their effort to do this. They didn't charge us a thing for this. So that's I cannot say enough. Thank you

120to Jason, his team, Black Hills infosac for being here, being a part of this. And honestly, for me, I think this is the most important, one of the most important parts uh because you get to go through live or or real base scenario uh instant response. So, having said that, Jason, the floor is yours. >> Thank you, David. Appreciate it. Working. Can everyone hear me? >> Yep. >> Cool. I'm not used to having a microphone like this, so I might start yelling. Uh, let me know. Just like, okay. All right. So, my computer just went to sleep, which was the perfect timing. All right. So, what we're going to do today is we're going to learn about a game called Back Doors and Baches. John Hammond mentioned it briefly. Essentially what we did is we

121created this game in 2019 because at Black Hills Information Security we do about a thousand penetration tests per year. During that period of time we get to test everyone's security and during that we find what is working and what is not working and then we give people a report. When we give them the report it's normally like a so what did you find? It's like still we found some stuff and then there's like that feeling of like how are we compared to other people and you're like whoa whoa whoa don't do that don't do that don't compare yourself to everyone else but then there's also the part where people go was there anything we could have done ahead of time to prepare for this engagement and we would give them a list of things you

122could do and one of those was tabletop exercises and when we mentioned tabletop exercises the teams would go tabletop exercises except for normally one person. That one person played Dungeons and Dragons in high school and said, "I love tabletops." And so everybody else is like, "Ah, tabletops. It's not real. All this other stuff." But that other person's super excited. So if you are that other person and you're sitting at the table, we're going to need your help during the second part of this where you're going to go out here to the hallway. We're going to give you a scenario. You're going to come back to your tables and you're going to lead a back doors and breaches session with the people at your tables. And if you're like, seriously? Yes. Seriously. All right. So, what

123I'm going to do is show you the online version of Back Doors and Breaches. Now, like I said, this is completely open sourced. You can use it whenever you want to. It's at play.backdoors & breaches.com. It is completely free for you to use. We don't want to charge you anything. We want you to be able to use these. Plus, we're handing out free decks of back doors and breaches today. Shows do cost a little bit of money because it costs us money to print them. But if you're educators, we give you all the decks that you need for free for your classrooms, for your schools, whatever it is, because we want you all to be safe and we want you to teach the next generation how to do cyber security. So that way when I'm

124retired, my life savings is not destroyed in a day because an attacker is like this guy. All right. So, this game I recommend we're going to play using the purple deck today. There are many decks of back doors and breaches, but this one is the purple deck. This is the core deck. It's everything that you need in order to play this game. Now, raise your hand if you're a cyber security expert. Okay, good. All right. So, what we're going to learn today is what type of expert or not expert you actually are. The thing about back doors and breaches is it reveals what you know and what you do not know. When you have a list of things you don't know, now you know what you can learn. When you have a list of things

125you do know, you're like, "Yes, I got those down." So, I'm gonna introduce the cards. You can see it at your different monitors, I believe. I'm going to introduce the cards. We're going to go through all this. I'm going to teach you how to build a scenario. I'm going to go through the game actually with you all today. We're going to play collectively as one big group of people, and then we're going to break off into your individual tables and play that way. Does that all make sense so far? Fantastic. The more interactive this is at appropriate times, the better it is for all of us. All right, so what we're going to do now is go through the cards. So the first card is the initial compromise card. It is how the attacker gets

126into your environment. And so this one is a password spray. So I'm going to bring up the card. I'm going to explain it. So each card has a headline. The initial compromise is an external password spray. There's a brief explanation of what this is. Then there's the detections. What detects it? And then there's the tools. CRM master, MSL spray, fires, find me access. So the brief explanation is the attackers gain access to your internal network by There was a beeping noise. I was ready to flee. Uh passwords like season across multiple accounts. So, I don't know about you, but if your organization has a 90-day password policy, most of your users will choose winter 2025 exclamation point because it has the capital letter. It has enough letters in it. It's got numbers and it's got

127a special character. So, winter 2025 exclamation point is one of the first things that we start with. I'm going to have a heart attack up here. So, in the fall, we use fall 2025 exclamation point. We use spring 2025 exclamation point. We use the the name of the town that you're from and the team that sucks, right? Like we look at commonly used passwords and then we use the same password for every single user. It's not different passwords for different users. It is the same password for every single user because we know at least one of you uses a commonly used password and we do it in a slow and low method uh methodical way using a tool called Firerox. Raise your hand if you've ever heard of the tool called Firerox. Anybody? One, two,

128cool. Three, four, couple. All right. For those of you that don't know what Firerox is, here's what happened. This is a tabletop exercise. Here's my number one tip for all of you, especially when you're running your own sessions. And I didn't do it today, but I'm going to do it right now. The tabletop has begun. You're currently in a tabletop exercise right now. My daughter re recently was evaluated for how she learns, how well she learns. She went to she's at Catholic University in DC right now and so she went through an evaluation process of how she learns and they said if they tell her this is important, please pay attention. She retained 90% of the information. If they just talked to her and then quizzed her, she retained 10% of the information. So when

129you're starting a tabletop exercise, always tell everyone at the very beginning the tabletop has begun. And all of a sudden, people start to listen and they lean in a little bit more. So your tabletop has begun. So darn monitor. All right. So what you're looking at up here is a tool called Firerocks. Only a couple hands went up. So what happened was at Black Hills Information Security, we were, you know, bypassing doing password sprays and people kept catching us because we're using the same IP address to do the attack from. People got smart. They're like, "Hey, all these failed login attempts are coming from the same IP address. Let's just block that IP address." And our attack stopped. So, our pentesters were like, "No, that's not cool." So, they wrote a tool called Firerox that

130runs it through a CDN network and allows us to attack you from a never-ending stream of IP addresses. So, it never looks like the attack's coming from the same location. Problem solved for us. Massive problem for you. And this is a tool available on GitHub. Moving on. Oh, you know, whenever I play this with high school students and I always say that this tool is available on GitHub, they pay attention so much more. They're like the the tools on GitHub. Yeah, it's the one that we use. Okay. All right. So, here's another one. This one's unauthorized cloud access. Do the attackers gain unauthorized access to your organization's cloud infrastructure or software as a service applications? Anyone here use a cloud application for anything at work? Right. Uh what can detected a SIM log analysis, cloud

131event log analysis, permissions audit, user and anti behavior analytics. And the tools to do this are Graphrunner, Road Tools, Scout Suite, and Paku. Anyone heard of any of those tools? Cool. So we created a tool last year or two years ago called Graphrunner. We were doing a lot of work uh taking apart of Microsoft 365 from the inside and we discovered that it's all connected and then we discovered that it's all just features that we were able to abuse and then we turned it into a tool called Graphrunner and we're like here you go. Now if you run Graphrunner most organizations today they're like that's Graphrunner and it immediately gets blocked out. But if you don't know how to block out Graphrunner, then people are still using it. You can get into someone's Teams. You

132can send messages spoofed as another user inside Teams. Like, it is ridiculous. You can get into people's email accounts. You can do a search for passwords. You can find everything using Graphrunner. It is ridiculous. Moving on. All right. All right. One more and then we'll move on. Trusted relationship. So the attackers exploited a relationship between your organization and a third-party vendor that has service level account within your organization to gain unauthorized access. What can detect this is SIM log analysis, user entity behavior analytics, firewall log analysis, cloud event log analysis, permissions audit and the tools to do this are X free on GitHub. Uh compromised service accounts and publicly available breach data. Okay, so that is how the attacker gets in. All right, then how do they get from one system to another? How do

133they escalate privileges? So in this circumstance, it was credential harvesting. The attackers collect and exploit usernames and password pairs found in open shares and files within your environment providing access to more valuable systems and data. Question for you. How many open shares in your environment currently have password files in them? Does anyone think that might exist? When's the last time you searched? Daily. That's awesome. So, one of the reasons that we do these tabletop exercises, especially with people that may or may not know each other, is because you have the opportunity to find out how other people are operating in their environments. And they might say, "Well, we do this and we do this and we do this." And you're like, "You do? How do you do that?" You're like, "Well, we do it this

134way and we do it this way." So, all of a sudden, knowledge sharing starts taking place at the tabletop exercise. So, in this one, uh, Graphrunner again, uh, sometimes whenever I'm asking the the pentesters what tools they use, they're like, Don Papy. And I was like, is that real? Are you messing with me right now? I was like, no, it's Don Papy. I was like, fine, Don Papy. And then I was like, what else? Snapler. And I was like, okay, stop. If you're messing with me, you have to tell me. They're like, no, it's Snapler. And I was like, fine. And then mimikats. I was like, I've heard of mimikats. Okay. So that is these are tools that you can run in in your own environment to see do these things exist in your own

135environment. So what I'm encouraging you to do is run attack tools in your own environment to see what the attackers would see in your environment. All right. So once they came in through a trusted relationship they had credential harvesting. Well, how are they using command and control? And so this is a cloud-based services Xfill. The attackers use common cloud services to blend in with legitimate traffic to send sensitive data from a compromised system to their servers. What can detect this is network thread hunting, firewall log analysis, endpoint analysis, sim log analysis. And the tools to do this are GCAT, Sneaky Creeper, and Goss. So, I was working with a team. I've I've gotten a chance to do like 300 of these tabletop exercises with organizations all over the world. It's been really cool getting a

136chance to do that because I learn so much, right? Like I'm facilitating these games. I ask lots of questions. People give me their answers back. I learned so much. One of the teams I was working with uh the the card that came up was different. But then I started asking them questions about would they be able to detect this type of network traffic and they said no. I was like cool. And then someone just nonchalantly on the team goes I mean if anyone uploaded anything to G Drive we wouldn't be able to see that either. And there was like this moment where the siso was like, "Damn it." And and you just start thinking about how much open space there is, how much opportunity. I showed a bank one time that in LinkedIn, LinkedIn, you

137can connect any file and send it as a message on LinkedIn, that you can have a zip file, you can have a spreadsheet file, you can have anything. And I was like, LinkedIn as Xfiltration. And all of a sudden the the person who was running I was like well we got to lock down LinkedIn. And then the head of sales said over my dead body. And then I watched them talk it out and have like the best conversation about the business versus the risk. And the CEO during this said I'm really glad I have you guys talking this out. Right? All that was taking place during the tabletop exercise where they got a chance to have that conversation ahead of time instead of during the incident. And then lastly, how are the attackers keep getting

138back in? So in this circumstance, it's a malicious driver. The attackers install or modify a device driver on a compromised system to retain control even after the system reboots. What can detect this? Endpoint security protection analysis, memory analysis, endpoint analysis, and the tools to do it are impact. If you never heard of impact, this is a robust tool for compromising your organization. PowerShell, metas-ploit, kernel driver, utility kit, and stay sharp. These are the tools to do this type of attack. So essentially what happened was the attackers came in through a trusted relationship. They found open uh shares that had usernames and passwords to compromise more accounts and admin accounts. They used cloud-based services to extrate all the data that they wanted and they use a malicious driver to keep getting back in on the systems

139that they compromised. This is how you were attacked. So the question for everyone in this room and you can only answer with a yes, no, or maybe. And I want you to do it all the exact same time. I'm going to count to three and I want you all to answer the exact same time. You can only answer using one of three options. Yes, no, or maybe. On a count of three, are you susceptible to this attack? >> I didn't get to three. >> One, two, three. >> Wow. Unanim unanimous. Darn it. I'll think of that tonight while I'm sleeping. All right. All right. So, what happens is you create the scenario, you show it to your team, you get them to walk through like how to solve this and then you talk through is

140this an acceptable risk for us? Are we okay living with this risk or should we mitigate this risk or should we transfer the risk to cyber insurance or somebody else? Is this someone else's fault or someone else's problem? Right? So the tabletop exercises allow you to have that conversation during the not incident. So what happens next is I'm going to hit refresh. And the way the game works is that these four cards remain hidden until revealed during an actual game play. Did anyone here play Clue growing up? It's Clue meets Dungeons and Dragons meets cyber security. That's what this is. And the sole purpose of it is to have great conversations ahead of the incident so you can talk through what do we know and what don't we know. Here's the one thing I want

141you to always look for during a tabletop exercise. It is it's an answer from someone that involves these three words. If anyone on your team says hope, sprry, or probably, what it really means is I don't know. Don't allow anyone on your team to say the words hope, try, or probably during a tabletop exercise. If they say hope, try, or probably, you're allowed to ask a follow-up question. Now, also, let me set the stage for your tabletop exercise. A tabletop is not to be used as an interrogation. A tabletop is not to be used to guilt anybody, and a tabletop is not to be used to shame anybody. I've had tabletop exercise before where I ask a question, a simple question. Well, do you do this? Well, I mean, geez, I was the other day

142I was like, oh, yeah, there's a there's a lot of emotion behind this right now. And really, the only like thing I I'm genuinely curious is like, do you do this? Right. So, one time when uh my wife and I were starting to budget, I was like, what was this for? Right? You're like, "Hey, what was this purchase for?" And I was like, "Why are you looking?" I was like, "Whoa, I'm just curious of what bucket to put it in in the budget." Right? It's all about the tone. It's about setting the stage. It's about creating an environment where you can ask genuine questions because you're curious about the answer, not because you're trying to make a point. Okay? So, it is important during tabletop exercise to set the context for what's going to happen.

143All right. So my screen just came back. All right. So what's going to happen next is I'm going to create a scenario. And the way that you do that is you go here and then in this bottom right hand corner you choose scenario tools. And then you go to custom. And then in this field you choose what you want the card to be. You choose the scenario based on what you want your team to learn. So you always think theory like well what do we need to really focus on? what do we need to learn? So you choose what you want your initial compromise to be based on that. So if I wanted the team to think about social engineering, I would choose the social engineering card. Then for pivot and escalate, if I wanted

144the team to think about how a new service creation modification may or may not be caught by EDR, we're going to choose that one. And then for C2, if I want the team to really think about bits, because no one here has ever heard of it. Okay, actually let's raise your hand if you know what bits is. Okay, couple hands went up. So for those of you that didn't raise your hand, can someone who raised their hand please explain bits? Can you explain bits to everyone in the room as loudly as you possibly can? >> Background intelligence service Windows updates. >> That's it. Background intelligence transfer service Windows updates. It is how a Windows updates gets into a Windows system. It is their essentially their own network protocol. How they transfer data from the Microsoft

145servers into a Microsoft device. And sophisticated attackers know that you never ever ever look there. Why would you? Most of you don't know what it is. A and so if you ever ask that question during a tabletop, does anyone here know what bits is? And you have nobody's hands that go up. You're finding from today's tabletop exercise. No one knows what bits is. That's it. There's no like how dare you not know what bits is. It's just we didn't know what bits was. I played with or like 300 of organizations and normally there's only a handful of people who like I know what that is and the rest of them. It's not my job to know what that is. But someone else's job to know what it is. And then they can teach the other

146people sitting there at the table. Here's how it works. Okay. So once I've chosen my scenario, I get to see it here. I get to see the scenario here. So I know that it's social engineering where they use new service creation modification. They used bits as their form of vexel and they installed a new user as their form of persistence. I know that. So I come up with a scenario based on those four cards. And normally I come up with a scenario based on just the first card itself because that's the thing that gets people to notice that something is happening. So I come up with a scenario and then I give it to the team and then what happens is they don't know what the scenario is. I just tell them the story and

147then they have to use these different cards to try to figure out the rest of it. So I have prepared ahead of time your scenario. It's like seeing the turkey, you know, it's already like I have the turkeys all you may not get. It's a Julia Child's reference. Anyway, that was deep. It was PBS channel 3 growing up. She was like, "I don't have five hours to cook a turkey. Here's what the turkey looks like." Anyway, so what we have up here is I've already chosen a scenario for you. I'm going to tell you the story of the scenario and then all of us are going to try to play this, but you're like, "How?" I'm going to get to that next part. Right? So, you introduce the scenario, then you introduce the blue cards,

148which are the incident response tool cards and detection cards. And then we're going to introduce this scenario one more time. And then I'm going to ask you all collectively, what would you like to do? And then some of you will go, I know what to do. And you'll raise your hand. And then someone will like, I know what to do. Which is different than that other person knew what to do. And then we're going to talk it out. Okay? That's what happens during a tabletop. So here's your scenario. Everybody ready? So about four months ago, your property manager or the person who manages the property, who oversees the janitorial services, the infrastructure of your school system or the the school itself, got an email from your HVAC provider. It went to the point of contact

149on the contract. And when it went to the HVAC provider's point of contact, the email said this. We recently had a breach, a cyber security incident, and we have conducted an investigation. We have consulted with our cyber security insurance. We've had incident response teams come in. We have figured out what happened, but we do not believe it reached any of our customers. We're letting you know due to due diligence and because of contractual agreements of what happened. That is all that email went to that point of contact four months ago. that point of contact saw the email and was like and now it's cyber security awareness month. So you sent out some cyber security awareness things and that person's like breach incident. Huh? And then they forwarded it to you like is this important? And

150that is what you get to go on. So what you can do at this point is you can take a look at your servers and this is any server any server that you have looking for abnormal. The one thing about abnormal behavior on a server is you need to know what normal behavior looks like first. So having a baseline of here's what normal looks like so we can understand what abnormal looks like. Also on the tool section because remember hey we have the tools for all the attack tools available on GitHub for free. I was doing a I think we talked about it earlier today but I was doing this for a hospital chain and the CEO and the seauite all were there and the CTO stopped and said hey can I just stop for

151a second and just let everyone know here that every tool that he has mentioned on every single attack card is free and available on GitHub and like you can see the eyes just go like wait a so the attack tools are free yep how expensive are our tools very suck. Okay. So, whenever we get the chance to put actual tools that you could use, we do uh put them on the cards that you could use. Uh so, SIM log analysis. Does anyone here use a SIM? Okay, couple hands. Anyone here not use a SIM? Okay, cool. Uh for those of you with a SIM, here's my favorite question to ask your team members. Do you feel like we have a data pond, a data lake, or a data ocean? Do you feel like we have

152a data pond, a data lake, or data ocean? And so the question really is, do you think we collect not enough, just the right amount, or too much? And you'll have one person on the team's like, we do not collect enough logs. And the other person who pays the bill says, we collect enough logs, it's fine. And there's this debate amongst the team of like, well, do we have enough? Do we not have enough? How much is enough? Right? Right? And so that's a good conversation to have with your teams, especially those of you that have SIMs. Do we have enough to do what we need to do? And that question can come up during a tabletop exercise. Cloud event log analysis, taking a look at all the different cloud accounts that you have, seeing

153what is being used by who at what time. Uh then we have memory analysis, pulling the the memory of a suspected uh compromised system and seeing if you can find critical data there. Isolation, uh, being able to isolate an account or user or a network if you need to. Endpoint analysis is physically touching the endpoint, physically touching or remote accessing into the endpoint to see what is going on with that system. Permissions audit is taking a look at does this account is it too permissible and if it is too permissible, what is it has it been doing and is that appropriate for that type of account. User and anti behavior analytics. I like to explain this one to high school and college students where I go, "Have you ever logged on to Instagram on another

154device and you get an email from Instagram saying, is that you?" Like, "Yes." I was like, "That's this normal looking behavior. Is this?" So, anything outside of that normal behavior would be an alert or flagged for additional inspection. Okay. Uh, endpoint security protection analysis. Anyone here have an EDR? Okay. Is it deployed to 100% of your devices? >> That's a good question to ask during a tabletop. >> And what you're listening for is hope, try, or probably. All right. So, next, firewall log analysis, taking a look at all that inbound and outbound traffic. And then we have network thread hunting. Uh so what we've learned doing about a thousand pentest per year is that generally you're all doing a really good job. Multiffactor authentication, having uh good password policies, all that stuff. Most organizations have

155a pretty good hard outer shell. If you gave us enough time, we will get in, but it will take longer, right? So most of you have a really good hard outer shell for the normal easy stuff until someone gets past that perimeter and then the inside is just so gooey just just a truffle. It's so good. All right. Uh so the tools that you can use are uh Rita which is a free tool I highly recommend. Uh I'm not here to sell you anything. It's just that a few years ago we realized that if companies could find our network traffic, they could kick us out and that would stop the attack. So we created a tool to catch ourselves and we gave it away for free. Said here's a tool, go use it, please. It's

156called Rita, real intelligence thread analytics. It is a free open source tool for you to do thread hunting all completely for you to use. Okay. All right. And then active defense and cyber deception. I have another question for you. On a count of three, I want you all to lie to me. Ready? On a count of three, please lie to me. Are you currently using cyber deception? One, two, three. >> Probably. >> All right. >> So, we are massive, massive fans of cyber deception. The owner of our company, John Strand, teaches a class on called Active Defense of Cyber Deception. It is free for anyone to take. It is 16 hours of just learning how to really annoy attackers. I I think of it this way. Has anyone here seen Home Alone with Kevin Mallister?

157Right. It's like building your network to be the Home Alone house of like when an attacker comes in, they're like, "What is I don't know. I don't know these things." And they're just like tiptoeing through. like all of a sudden you're like because you just set up traps all through your environment. Uh one time we got does anyone here ever heard of the internet scorecard of like you know security scorecard type thing. So we got a a grade one time of like an F. Our website got an F for the security scorecard and we had a client say hey I don't know if we can work with you if you can't secure your own website. And so we looked at it and we're like, "Ah, darn it. We have so much cyber deception on our

158own website because that's where attacks start, right? They take a look at our website, they start looking at stuff. We have so much misinformation on our website, right? Like that's weird, right? To have misinformation on your site." One of my favorite cyber deceptions of all time was a pentester said, "I got caught in 20 minutes." I was like, "How'd you get caught in 20 minutes?" He's like, "Let me tell you the story." He's like, I went and I did my normal thing. I did my recon. I scraped their LinkedIn accounts. I started logging in using their first name, last name to the into their uh their accounts. And within 20 minutes, I got a phone call from the client saying, "Gotcha." I like, "How?" He like, "Cuz that employee is not real. It's a fake

159employee on a LinkedIn account." So that if they used the first name, last name, all of a sudden they knew they had an attacker that had scraped their LinkedIn profiles and were trying to log in from that. I was like that's awesome, right? So if you start thinking through like what what can we do in our network? What admin account can we create that can be so enticing that an attacker would touch? And the moment that one gets used, you're like we have an attacker in our network, right? So you start thinking through like how can we be deceptive to the attackers who are deceptive, right? And then lastly, crisis management. I have a question for anyone willing to raise their hand. Right? I I will ask this question. If you want to raise your

160hand to answer it, interactivity would be fantastic. Does anyone know where the threshold is or where where is your threshold for when an incident becomes a crisis? Does anyone here want to say where is their threshold for when an incident becomes a crisis? Anybody? when you don't know what to do. Okay, so your threshold is I don't know what to do. It has become a crisis. Okay, anyone else? Where is your threshold for an incident becoming a crisis? Publicity. So that's your Okay, there's no wrong answer here. It's not like probably publicity, right? It's it's just money and users factor. How many >> user? That answer right there is fantastic. I don't know. But here's where I want to start or let's talk start talking through it. I've asked this question to 300 different organizations

161and I've gotten 4,000 different answers because I asked every team member on on that like what about you? What about you? What about you? What about you? What about you? What about you? And I've gotten two really good answers back. One was, "Oh, Jason, that is easy. It's when you hit the fifth level of seven levels of severity. That's when it's a crisis." >> Exactly. Right. And I was like, and remember, tabletop is not an interrogation. It's not shame. It's not guilt. It's not this. It's just genuine curious. And I was like, "Do you have seven levels of severity?" Like, "Yes, very clearly defined. Seven levels of severity." And I was like, "Can I know what they are?" And so they went through them and I was like, "Okay, yeah, level five crisis. Got it."

162And then I was like, "Does everyone here?" Right? Because I could see everyone's faces. And I was like, "Is everyone here all know all seven levels of severity?" And the senior leadership was very confident in their head nods. And the junior people were like, Right? So sometimes the tabletop exercise is an opportunity for you to share that with other people, other departments, other or like people inside your own organization like hey this is the threshold for us. This is the threshold for us. Maybe not the threshold for you but it's the threshold for us. Here's the best time to figure out the answer to that question before the incident. have a very conf like very so this game right it's a game but it's a consequential game where you get a chance to ask questions

163that other times if you were like hey when's an incident become a Christ like why are you bugging me right now like but we're in a tabletop exercise and I'm on this card I'm going to ask this question right now because it's the card that we're on and so it gives a chance to ask those questions ahead of time so when does an incident become a crisis it's one of the good questions to ask at your tables during the breakout sessions where you get a chance like hey for you when's an incident become a crisis or for you when's an incident become a crisis one other good right because I said there was two good answers to that one was the level five or seven level of severity the other one was this a senior

164leader came off mute there was 45 people on this zoom session and I was doing the the demo for all of them and a senior leader comes off mute and says Jason that is an unfair question. Can you tell me why that's an unfair question? She said, "Because we don't use the term crisis here." I was like, "Thank you." Tabletop exercise finding. They do not use the word crisis. What term do you use? And then we had a chance to talk about culture and we had a chance to talk about policy. We had a chance to talk about, you know, verbiage and words and so it was a good conversation to have that would not have come up unless we had a chance to have that conversation. So every once in a while you might

165say things where other people like I don't know about that and you get a chance to talk about that. Okay. So remember your scenario was four months ago your H the person who responsible for the management of the infrastructure the physical building that you're in got an email from your HVAC provider said that we had an incident but I think we're okay we just have to let you know and then for four months the person just sat on it until security awareness month and then they forwarded to you and said is this a thing so that's what you have to go on you are all the security team right now. You can use any of my blue cards to try to figure out what to do next. So, as a room full of people who

166are trying to figure out this incident, what would you want to do first? >> All right, Jason, one second before we actually get started with that. We actually have senior level superintendents and senior staff here as well. >> Can you explain to the group why it's important that they participate in this? It's not this is not just for IT people. >> Y >> right. >> Yeah. So for the senior leadership in the room, the reason why you want to have these conversations, I had a chance to do this with the COOS, chief operating officers of the nation's largest law firms. So all the law firms came together at this event and I had a chance to explain this and their very first response was I would talk to my CTO. I was like, okay, what

167would you ask them? Like I would ask them to fix it. I was like, "Okay, all right. What if you didn't what if you had to fix it? What would you what do you think you would do first?" And so during the conversation where we actually went through the entire incident, they got a chance. It took about 15 minutes for them to get used to it, but they got into it and then by the end of it, we were talking and one of the CO said, "You thoroughly scared me and then you showed me I don't need to be scared." I was like, "Cool, right? because everything is solvable using tools and people at some point. And so for the senior leaders in the room, one thing is to do is like start to know

168what the terminology is so that you can ask better questions of your team or not better questions just different questions and like hey tell me more about that. How is this incident work? How do you think we were attacked? And for the senior leaders in the room too when you do these tabletops with your team one of the cool things that you learn is that your team is capable. And for the TE people in the room, when you get a chance to do it with senior leaders, you can show them why you need the tools, why you need the personnel, why you need the training, why you need this, because this is what you're up against every single day. Every attack is different. There are 3880 different scenarios in this deck with all the different

169combinations of the attacks. 3880. And then we went out and made another 200 cards. So, it's a never- ending supply of attacks that you're facing on a daily basis. So for those of you in the room, you got an email HVAC provider. What would you do first? Out of all the tools that I mentioned, server analysis, SIM log analysis, cloud event, memory, isolation, endpoint, permissions audit, user and anti behavior analytics, endpoint security protection analysis, firewall log analysis, network thread hunting, active defense and cyber deception, crisis management. What would you want to do first? Anyone want to raise their hand and go first? Yes. isolation. Okay, so the very first thing that was thrown out is isolation. Now, whenever you're doing a tabletop exercise and someone says one of the things, you can follow up and

170say, "Why? What are you looking for? What do you want to accomplish?" >> Okay. So, do you know what device it is at this time? Okay. So, you would start looking at the HVAC devices. So, would that potentially be something more of like a server analysis or endpoint analysis or your EDR logs? So, you're trying to just ascertain is there an actual problem here? Is is that where you're heading? Okay. So, maybe it's not isolation, maybe it's one of those three. Do you have a different one of those three that you would prefer? >> Probably. Endpoint analysis. >> Endpoint analysis. All right. So, you would physically want to touch that system that may be connected to the HVAC or remote access into that system that's potentially Thank you for going first. I appreciate that. Yeah.

171Yeah. Anybody else? What would you want to do? >> So, you want to take a look at the email? So would that fall under >> okay so the so this is falls into you're looking for more clarity in the scenario so generally you don't have to pick something when you're looking for clarity so they will provide a report if requested is so you want the report so you're going to send off an email saying I would like to report what are you going to do in the meantime while waiting for their response >> are you going call. All right. So, he's going to call. Do we want to roll the dice to see if the call works? >> All right. So, we're going to roll the dice. So, I need a uh one 20-sided dice

172over here. So, Tatia's going to come and hand you a 20-sided dice. So, this game works like Dungeons and Dragons. You roll the dice to see if it works or not. So, we're going to hand you a 20-sided dice. You're going to roll the dice and then let me know what number you get. It's right there. And then when you let me know what number you get, I'll tell you what happens next. >> An eight. All right. >> A nine. All right. So 1 through 10 is is unsuccessful. 1 through 10 is unsuccessful. 11 through 20 is successful. So one of your turns was just used to call the HVAC provider. So you have nine turns left. One of the things I did not mention at the beginning of the game is that you have

17310 turns to try to solve my four cards. You have 10 turns to try to solve my four cards. So, you contact the HVAC provider. So, here's the question that happens when you have an unsuccessful attempt. If you want to take notes, this is the most important part of back doors and breaches. And when you're running your own sessions, you're going to ask this question whenever you have an unsuccessful role. This is the most important part of backdoors and breaches, especially when you have an unsuccessful role. Here's the question. It has four parts to it. You ask your team, can anyone give me a reason either politically, human beings and their behavior. Financially, do we have the capacity, the resources, and the ability to do the thing that we want to do? Technology, do we

174have the tools and the capabilities to actually do the thing that we're trying to accomplish? And then personnel education wise, do we know how to do the thing that we're trying to accomplish? So it's either human behavior, financial limitations, technological limitations or human skill limitations. So the only thing here is that he tried to call the HVAC provider and it was unsuccessful. So you would ask that question, can you give me a reason politically, financially, technologically or personnel wise why you would be unable to contact the HVAC provider at this time? Yes. Okay. So, you want >> Sure. You want to take a look at the email itself and see like is this an actual email from the actual HVAC provider and then see if it's a credible the answer to that is yes. You

175don't need to roll the dice for that. That's just some clarity. The answer is yes. It is your actual HVAC provider who sent it to your actual point of contact and they did have an actual breach. Okay, I'm not going to count that turn against you. You help me get started. All right. What would you all like to do? Oh, that's the dice. So, what would you all like to do? >> Permissions audit or >> Okay. So, you're looking at permissions audit or user and behavior analytics >> because mostly I've got documentation about HBAC. Okay. >> My environment quickly is through I would have points of contact direct points of contact that aren't like just like a generic help desk or that or I would have hey these IPs I know immediately what access should

176be expected behavior I don't see one specifically about documentation so I'm going to say permissions audit >> okay >> so he's chosen permissions audit The rest of you right now are probably thinking about what you would do. So that also happens too when you're doing a tabletop exercise, especially at your own tables, is that some of you will remain quiet until engaged. And so the person who's running the session, it is up to you to ask the people who are not answering questions. So that way everyone is engaging. But for all of you right now, you're probably thinking through what you would do in the circumstance. And I saw another hand go up over here. Did someone have something different be than permissions audit? Anyone have anything different? All right, we have one more over

177here. You had something different than permissions audit. What would you want to do? >> Yeah, similar vein though. I want to look at >> which logs. >> Okay, so EDR logs would be your endpoint security protection analysis card. All right, so right now we're between permissions audit and EDR. Raise your hand if you want to do permissions audit first. One. Wow. Raise your hand if you want to take a look at the EDR. More. All right. All right. So, we're going to take a look at the EDR. So, let's go ahead and get a 20-sided dice over here. What's your name? >> Michael. Michael's going to roll the dice and let me know what number he gets. >> Nine. That didn't work. >> That didn't work because the technician that that runs that is out

178sick today. >> It is possible that it's personnel reason. Here's the other thing that here. Why did we create dice rolling for a tabletop exercise? Why do you think we have dice rolling for a tabletop exercise? >> Randomness. Because every once in a while we would do a tabletop exercise before we created this game and before we created randomness and you would present a scenario and someone on the team was like ah easy. We would do this then this then this then this then this then this then this then this then this then this and other people on the team are like that sounds right. And so what we wanted to do is like I do this roll the dice someone's sick didn't work or you roll the dice and oh no that account is

179special because they asked for special permissions and we gave it to them six months ago because they needed it for this one thing and we totally forgot to go back and change the thing. So all kinds of stuff happens in security. There's the way you would want it to be and then there's the way it is. All right. So, if I take this number three over here, I'm going to put it on this card. Same thing for you all. Instead of putting numbers on cards, what you're going to do is rotate it once this way. And then next time you rotate it this way, and next time you rotate it this way, and then you rotate it again here. The reason why is because you have a three turn cool off period whenever you do

180something in back doors and breaches to make sure you don't keep using the same tool over and over and over and over and over. And really what it was was sim stem sim stim stem. And you're like, "Okay, guys, you have other tools. I'm sure you have other capabilities." So, we have a three- turn cool off period. All right. You have now rolled essentially two turns. I'm not counting that one against you. So, you still have nine turns left. Uh, you still have not revealed my four cards. Would someone else like to go since your EDR is not working right now. We did have one suggestion for permissions audit, but would anyone like to try something different? Yes. Firewall log analysis. And I would do the same thing. What are you looking for? Okay. Okay.

181So, looking for that HVAC account, essentially that one user, that one endpoint, and seeing if there's any kind of firewall logs going to an external source or something that should not be going to. All right. So, you're gonna roll the dice and let me know what number you get. 17. Did that feel good? Right. It's the other reason we have dice rolling. When a human being rolls a dice and it doesn't work, they feel bad about themselves. And when they roll the dice and it works, they feel good about themselves. It is the closest thing we can do to mimic the human response to incident response because when you find something during incident response, the adrenaline spikes. You get excited. You're like, oh, we're compromised. Oh crap. But as you go through, if you can't

182find anything, you're like, I suck at my job. They're just going to take everything, aren't they? All right. So, I'm going to move this number three over to firewall log analysis. I'm going to move the number two here just to keep track so I don't forget. Same thing at your tables. You would rotate one, you would rotate the next one. So that way you have a three- turn cool off period. That will make sense. You can always ask questions during your actual tabletop. You can ask questions. We'll come and help answer all your questions. All right. So you've done this and you're like, what what did that do? Well, it showed you that that system is excfiltrating data using HTTPS to an external source that has nothing to do with your HVAC provider. That system

183is excfiltrating data to an external site. Has nothing to do with your HVAC system. So, you have revealed and here's how you revealed it. Network threat hunting, firewall log analysis, SIM log analysis, and endpoint security protect analysis would reveal this attack. If you were successful in any one of those four things, it would reveal the attack. Does that make sense so far? Okay. So, the previous turns you were not successful. It did not reveal any cards, but you used a correct detection. You were successful with your detection and it revealed the card. We all good? Okay. So that was your second turn. You have eight turns left to go. You have three cards left to reveal. And now you know how HTTPS is being used for exfiltration. But guess what you can do during your

184tabletop exercise. Does anyone here know how HTTPS can be used as excfiltration of data? And if the answer is I'm not quite sure how that works, then a finding from tables today's tabletop exercise is to learn how HTTP S could be used to exfiltrate data from an organization. And what would it look like? What would it look like to see this actual activity? So, here's one of the things that you can do since I love education is that you can assign someone on your team to do a lunch and learn three weeks from now to explain what this looks like and to show what this looks like and and they ran a test to see would it be capable for us to detect that and the answer could be yes, no, no, that's it. Yes

185or no? All right, moving on. What would you like to do next? All right, so we revealed one card. We still need to figure out what is the initial compromise. How' the attackers pivot and escalate? What are they using for persistence? What do you want to do next? Isolation, permissions audit. So, right now I'm hearing isolation and I I'm hearing permissions audit and I'm hearing crisis management. You know, one of the questions I do like to ask periodically through the game is this a crisis yet? You know, because I like to ask that question, is this a crisis yet? Because that way it will help you find your threshold. You're like, like I do this game all the time where I like reveal something and it's like to me it's really bad and the team's

186like, "No, not yet. All right. Okay. All right. So, we have one for isolation, one for permissions audit. Raise your hand if you want to isolate the system. Okay. Couple. Raise your hand if you want to do permissions audit for this. Left hands. Left hands. Yeah. At some point, you may I don't know. All right. So, we need someone uh to get him. You have a dice. All right. So, you're gonna roll the dice and let us know what number you get for isolation. >> Is it a squiggly mark? >> Okay. So, it's like the Okay, so that is the Black Hills logo. We have it on the number 20, which means you rolled a 20. Except except whenever you roll a 20, a one, or have three failed rolls and back doors and breaches,

187you all get an inject card. That creates chaos in the game. I will reveal that in a second. All right. So, you were successful with your isolation card, but it doesn't reveal any part of the attack. you're just essentially doing some maintenance or incident response work to block out that account. So, here's the questions you ask whenever you isolate. For the senior leaders in the room, these are some of my favorite questions to ask of your team. So, here is the question. There's going to be three parts to this question and you can ask them at any time during back doors and breaches, but I really love it for the isolation card. First question, can anyone tell me the name of the person who will do this action? If you're going to isolate somebody, do

188you know the name of the person that's going to isolate it? And a lot of times what I hear is it's the network team. Like, cool. Who on the network team will do it? They're like, I don't know. I just send in an email. Okay. Yeah. Uh so the first question is who? Can you tell me the name of the person who's going to do this action of isolating that system? Number two, the second question you ask is who authorizes that person to do this action? Who's the one that says yes? Sometimes I work with organizations are like oh you don't have to ask anybody here. I was like seriously yeah anyone. Everyone on the security team has the ability to isolate any account if they suspected of being compromised. I was like nice cool.

189And then other organizations are like, well, what you need to do is you got to contact this person, then that person. Okay. All right. So, what's the name of the person that does the action? What's the name of the person that authorizes the action? And the third most important question of all, who takes the blame? If you do something by isolating this account that brings down your ability to do business, I was getting a chance. I got a chance to do this with a large financial organization one time and the the attack was ransomware on the trading floor and so the decision was made to shut the server down to isolate the server and I was like okay who does it and they're like well it's this person who says yes to doing it well

190it's this person and I was like and who takes the blame as you lose millions millions of dollars every single minute and guy goes me. It's me. Right? And this helps you start putting that crisis management plan together. It helps you start figuring out who are the people you contact and when do you contact them. All right. So, I'm going to move the three over here to isolation. I'm going to move the two over here to here. And I'm going to move the one to here. And you got an inject card. didn't reveal any cards, but you got an inject card. And let's see what happens. Your inject card is legal takes your most skilled handler into a meeting to explain the incident. Who brought a lawyer to the party? there's always one person who

191pretty much runs the whole IR process. That one essential person while the legal team just took that person away for very important reasons. Uh we used to have for this card that that your most important person would be silenced for the rest of the session. But we saw that that was pretty detrimental to teams that they would be silenced. That person would be silenced for the rest of the session and you would see teams just like what do you all want to do next? And they're like ah [Music] and I one time I was playing virtually and you could see that the person who got silenced just kept like like looking at the like the IM that kept coming in and he finally was like guys stop I can't participate anymore. Okay. All right. So,

192in this circumstance, you all will lose the plus three modifiers for the next two turns. And I haven't gotten a chance to explain those yet. So, do you see up here where it says established detections? Up there says established, and the other says other detections. So, when you play back doors and breaches, you have four card slots up at the top. You kind of have five, but you have four card slots at the top. That is where you're going to randomly put four of the blue cards. You're going to randomly put four of the blue cards in those top four. And then you're going to put all the rest of the cards in that bottom blue portion. All right. And the what this means is those four that you've chosen are are called established detections.

193What that means is that you have them written down somewhere that you had a meeting one time and you told someone, "Hey, could you write down how to could you explain how to do this to other people in case you're out or something like that?" And you're like, "Got it." and you wrote down all the things that you needed to do to do that that different detection. The other detections are just the other things that you know how to do. You just never wrote down. How many of you have everything that you do at work written down for someone else in case you were hit by a bus today for them to pick up the pieces? Yeah, exactly. So, we assumed that you have some things written down. you just don't have all things written

194down. So, one of the ways that you can make it uh accurate to where you work is you can ask your team, do we have a written policy for this? And if the answer is no, it goes in that bottom row. Do we have this one? Nope. Bottom row. We have this one. Bottom row. Do we have this one? Yes, it goes in that top section. Do you have this one? Yes, it goes in that top section. Do we have this one? Nope. Do we have this one? Nope. So it could be a a way a road map for you to like, hey, let's start writing these things down. Let's just knock out these types of things that we do and have them be written procedures. And if you do that in the game, you

195get a plus three modifier for dice rolls, which means that earlier eight would have been successful, that earlier nine would have been successful for those types of detections. And I know it just got real geeky real fast. And that's where the Dungeons and Dragons part comes in. And that's where some of you are like, "Yay, modifiers." And the rest of you are like, I showed up to the wrong event today. I uh All right. So, you have seven turns left to go. We're going to kind of expedite this so that way you can all have your own sessions. But now you've got a chance to see what a successful role looks like and an unsuccessful role. You've got a chance to see what an inject card looks like because you rolled a 20. Good job.

196We talked about what it looks like when you actually have a successful role. Unfortunately, who does that action? Who says yes to doing that action? Who takes the blame if doing that action is a problem? You've gotten a chance to see if you have an unsuccessful role. You ask the question, can you give me a reason why politically, financially, technologically, or personnel wise, why that does not work right now. So, you've gotten a chance to do that. So, let's do one more turn. What would you like to do next? Permissions audit. Yes, back there. Server analysis. Okay. So, I'm gonna ask the followup question. What are you looking for? >> Okay. So, you're looking on the server to see like where are the the requests coming from for all that data that's currently being extrated.

197Okay. All right. Anyone else have something different? Because we have permissions audit, we have server analysis and Okay. Okay. So you want to check the other systems and see like hey is this is this isolated to this one or is this like across the board? So are you thinking like network thread hunting? Are you thinking what are you thinking for that stim? Okay. So start over on another system. Uh Endpoint analysis feels good for that one. All right, so we have server analysis, permissions audit and endpoint analysis. So raise your hand if you want permissions audit. You're getting a couple new fans. Uh server analysis, that's more endpoint analysis. All right, server analysis it is. So roll the dice for us. Let us know what number you get. >> Nine. Oh, if only we did

198not have that previous inject card where the incident captain was taken to legal, you would have that modifier for this role. Wow, legal. Thanks a lot. If only legal hadn't taken that person, we would have had a successful attempt here. So to answer uh this or you know the question that I would ask is can you give me a reason politically? Can you give me a reason politically, financially, technologically, or personnel-wise why server analysis would be unsuccessful at this time? I have one one of my favorite questions to ask whenever I'm working with a team is raise your hand if you're the server analysis expert, right? Couple hands went up. Cool. When I'm playing with a team, that's what I'm looking for. Is someone willing to say I'm the expert in that thing? And if

199there is not an expert in that thing, guess what you could do over the next six to seven months? Become an expert in that thing. And gives you a framework of like, hey, how about we have someone that's an expert in this and an expert in this and an expert in this and an expert in this. Let's let's find our expert on our own team. Let's give them the training that they need. Let's give them the time that they need to do some research and development so that they can become the expert at the thing when we need them to do the expert thing for the thing. Okay. All right. So, you had another turn. It was unsuccessful. So, what happens when you've either run out of time or you've revealed all the cards? I

200will say this. You've had unsuccessful attempts. It feels not great, right? Like, ah, I wish we would reveal the cards. That'd be cool. One of my favorite things is that as you get closer to that your 10 turns, the anxiety starts going going up just like five o'clock on a Friday. You're like, I really wish we could figure this out by five on Friday. All right, so the other thing that happens is that when you have unsuccessful attempts, you get to learn about your own security. When you have successful attempts, you get to learn how the attackers do what the attackers do. So, the one thing that has made this game so robust and how many people use it all over the place is because of the unsuccessful attempt where you get a chance to

201write down all the reasons politically, financially, technologically, or personnel wise why you're unable to do the thing in this moment. So, what we're going to do is we're going to ask one person from every single table. Do you want to take a break first or do you want >> Yes. So, what we're going to do is we're going to take a a quick uh bathroom break so we can get that organized. >> So, if we could have uh right now, can we see a show of hands? One person from each table to volunteer. And I'm going to have you meet us over here in the hallway. So, one person from each table to go ahead and come over here. We need one. Somebody's got to do it. >> So, come on over here to the

202side. We're going to give you further directions. So, uh, looks like we got most of everybody back in. So, that's great. Uh so um what we what we're going to do is we're going to uh do this round till um about an hour, just shy of an hour um till 12:15. At at that time at 12:15 we'll stop for lunch. That'll give us 45 minutes uh for lunch. Uh they're setting out uh this the food and stuff now. So I just wanted to go over that. So whatever you selected when you registered, it's going to be out on the tables. If you had put down you had a food allergy or something like that or special request, uh yours is going to be in the back with your name on it. If you didn't have

203a food allergy or a special request, then uh just whatever you ordered uh will be out here on one of the tables. Okay. All right. I'm going to pass it back over uh to Jason. >> Okay. So, your facilitator has instructions for how to get the game going. If at any time any of you have questions about, well, what about this or what about this or what about this, just raise your hand. We have four uh me plus three other volunteers that are going to come around, help answer your questions. And if you're like, I don't know what I'm doing exactly, right? Like you're learning how to do this right now by doing this right now. It's just like any other board game. You learn by doing it. And so you're doing it. And if

204you don't know how to do it right now, you will by the end of the session. And so if you have questions at any time, feel free to ask. And good luck solving your incidents. [Music] Heat. Heat. [Music] Down [Music] Heat. Heat. Heat. [Music] Heat. [Music] Heat. Heat. [Music] [Laughter] [Music] Heat. [Music] [Laughter] [Music] Heat. Heat. Heat. [Music] Heat. Heat. [Music] Heat. [Music] Heat. [Music] [Laughter] [Music] [Laughter] [Music] [Applause] Heat. Heat. [Music] [Applause] [Music] Heat. [Music] Beyond Christ is here [Music] from the The earth [Music] I still hold [Music] Holy [Music] bishop [Music] mercy I wish is much [Music] Heat. Heat. [Music] Oh my god. [Music] [Applause] [Music] Heat up [Applause] here. [Music] Heat. [Music] Yes. Heat. [Music] [Applause] Heat. Heat. [Applause] [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. [Music] Heat. [Music] Heat. Heat.

205[Music] Heat. Heat. [Music] Heat. Hallelujah. [Music] Heat. [Music] Heat. [Music] [Applause] [Music] Heat. [Music] [Applause] Heat. [Music] Heat. [Music] Heat. [Music] Heat. [Music] Heat. [Music] Heat. [Music] Heat. [Music] Heat. [Music] Heat. [Music] Hey. [Music] Hey. Hey. Heat. Heat. [Music] [Applause] [Music] Heat. Heat. [Music] Heat. Heat. [Music] [Applause] [Music] Heat. Hey, Heat. [Music] [Applause] [Music] [Applause] [Music] Heat. Heat. [Music] Heat. [Music] Heat. [Music] Heat. Heat. [Music] Heat. [Music] [Applause] [Music] Heat. Heat. [Laughter] [Music] [Applause] [Music] Heat. Heat. [Music] [Laughter] [Music] Heat. [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. Won't give me [Music] the spirit. be the senior [Music] he is all [Music] So next [Music] [Applause] [Music] spring all the Let us begin. [Music] Z is the fullness. [Music] Heat. Heat. [Music] My lif. [Music] Holy rock. [Music] She [Applause] [Music] don't sing from the

206Strong feeling strong. [Music] Heat. Heat. [Music] Heat. Heat. [Music] [Applause] Heat. Heat. [Music] [Applause] Heat. Heat. [Music] Heat. Heat. [Music] [Applause] Heat. Heat. [Music] [Applause] [Music] [Applause] [Music] Heat. Heat. [Music] [Applause] [Music] All right, attention. All right, we're going to give you about 60 seconds to finish up and then we've got a quick announcement and then we're going to do lunch. [Music] All right, everybody. Hey, thank you so much. Thank you very much for playing back doors and breaches. Thanks for leaning into doing something you've never done before. Thanks for having a conversation about security in ways that you probably never have. And so at the end of a back doors and breaches session when you've revealed all four cards the question that you ask and some of you got there some of you have

207not yet but the question that you ask everyone who participated is this a plausible attack where we work and you ask every single person who participated is it's a yes no or maybe answer and if it's a yes you choose to either live with the risk or mitigate it. If it is a no, I would love to hear why it's a no. And if it's a maybe, well, then that's an opportunity to do some testing and then figure out what you can do to find out if it's a yes or no. And then when you are finished with a game of back doors and breaches, you ask everyone who participated, can you give me your one takeaway from today's tabletop exercise? Can you give me your one takeaway? Every single person, even if they were

208spectating, if they were senior leaders, every single person who participated. So, would anyone like to raise their hand and give me one of their takeaways from today's tabletop exercise? Yes. Push. MFA. Okay. Yeah. You need to do them on a regular basis. Here's the one thing I've learned about that is that every time you play this, you might have a list of 10 to 15 to 20 things to fix or address. Don't fix them all. Roll the dice. And if it lands on 13, just pick number 13 on your list to fix. If your team figures out that every time they play this game, they have a list of stuff to do, they will stop playing the game. But if they only have one thing to do every time they play, then that makes it

209more manageable. Anyone else? What was your one takeaway from today? Yes. Invest in more detection analysis tools. Okay. Yes. control plugins in the browser. Yes, people are the weakest link. Any one other senior management is important. Thank you so much. All right. So, the way that the scenario worked, just so that you all know, it was a trusted relationship. So, not only do you have to care, Nope, sorry. It was fishing. Uh, so it was a fishing attack that led to curb roasting. If you don't know what curb roasting is, well, that's a lunch and learn three weeks from now where you get a chance to think figure out what this is. There's a guy named Tim Medí. Tim Medin is the person who created or figured out curb roasting. So, Tim Medin Well, I

210can't type Med. and then type in curb roasting and you will get everything you've ever wanted to know about curb roasting because thankfully all security engineers and security researchers generally publish what they learn so there's an opportunity here for you to learn what curb roasting is and I know that you're going to lunch so I'm going to wrap this up uh bits we talked about bits and malicious browser plugins being installed that is the attack scenario that happened and then you get to talk through is this something that's plausible where we work I have uh some people ask So, uh, Deb at Blackhillsinfosc.com, she's right there. If you need decks for your classrooms, if you need decks for your organization, all you have to do is email her and we will mail them to you

211for free. Our company was founded by an educator. I'm a former educator. We love education and we want to make sure that you have the tools and assets that you need in order to do your jobs well without having to figure out how you're going to pay for it. So, we love to help support you the best we possibly can. And thank you so much for your time and your attention today. I think we need another round of applause for Jason and his team. Thank you, Black Hills. Quick quick show of hands so Deb knows how many of you are going to be emailing De like or have already. Okay. All right. Uh we will be getting started with lunch here in just a minute. Uh few quick announcements. One, if you had a specific

212uh allergy type food request, I think there are about six or seven of you. Your food is located on a cart in the back as if you're going to the restrooms. Everyone else, your food will be located out here. Please don't grab a box that you didn't sign up for. Um your name is on the box. Oh, yeah. See, now we got to look for boxes. Um, uh, I do, uh, I I do want to take a minute just to say, uh, thank you first of all for all of you who are who have made it this far. I know some of you are not going to be able to stay for this afternoon. That's how these things go. Um, we do hope you are able to because we're when we come back from lunch,

213we're going to do actual incident response planning. Uh, not just tabletop, but actually building this stuff out. And while you are here together, it senior leadership, uh it's the perfect time. You're not going to get another opportunity. Um and you can tell jokes and there's food and water and you know, so uh and you turn your cell phone off. Well, that's up to you. Um uh the uh I I do want to say uh a thank you to um Secured Tech Solutions. Um they provided all of the shirts that you all have. Uh a special thanks to uh Clinton Learning and Clear Touch. they provided some of these uh wonderful panels that we have here today. Uh and uh right now I'd like to introduce Vanessa Slogger who is with Cybernut uh and she's got

214just a uh they're sponsoring lunch. So huge thanks to them. Uh >> well first I want to say thank you John. He is one of our wonderful partners here with CyberNet. Two, we provided you lunch and here I am the lucky winner holding you from lunch. So, I will make this as fast as I can. First, I will say I was pretty shocked earlier. You are nothing like teachers. Have you ever been to a conference with teachers and you say, "Hey, do you want a prize? Do you want a drone?" I mean, they're like crawling over each other and you guys are like three people. So, let me ask you again. Who wants to win a prize? Anybody want to win? Okay, that's much better. So, I will be giving some prizes away at the

215end with a few little questions. So, you might want to listen up. one have who here has heard of CyberNet? Oh, we've got some hands. We are a young company, so I am very excited to be here to talk just really quickly about what we do. One, we are the number one human risk and security awareness training program. We are exclusively designing our program for K12. And the way we've done this is we've kind of gified the the entire experience. So just like you guys and the teachers always wanting to win prizes, they get just as competitive for what we call digital acorns. So what we do is one, we have our awareness piece which is our compliance helps you check those boxes, make sure everyone knows why cyber security is so important. Let me

216ask, should we stop there? Like we've given them this 30 minute little course and now what? They're going to be completely protected. Everything is good. They watch that course. No, we need to keep them building their skills. So, what we do at Cybernet is we do a weekly fishing simulation that is also leveled for that individual user skill. So if they click on these simulations as an admin, you'll know what your click rate is. But the individual will also move to a little bit easier simulation so that they continue to build on their skills of identifying what could potentially be a fishing email. Now, not only do we do this for staff, but we also do it for students. So the great thing about it, too, is that we gamified it by giving away acorns

217if they report. But what if they click? They click, they instantly get a microlearning that's less than 30 seconds showing them that email and highlighting what they should have flagged, continuing to learn. And they also get acorns for it. And then there's the leaderboard where they can see where they're placed either by team or by individual to see how they're doing with their skills. And then lastly, because I told you I wasn't going to keep you too long for lunch, lastly, we also help you manage reports. So you get a reporting tool, they see something that looks suspicious, they're able to click on it, and you as the admin, you're able to see that, and then you can actually delete it across the entire district. So, lots of great things that we're doing. Again, making

218it quick, but I do have a table out here. I am going to be here all day. So if you want to learn a little bit more, we'd love to talk to you. We also provide you with a free assessment. So if you wanted to do a twoweek quick assessment to see where are your staff members or students today, we can give you a baseline assessment for free. You'll be able to come back and go, "Oh my goodness, did they click 30% of the time? Was it 5%. Let's see if you need a tool like this to help them learn." Okay, any questions right now before I start giving away some prizes? Awesome. So, let's see the first question. What is my name? >> That's right. Here you go. You get a blue squirrel and

219I would throw it, but I'll probably hit someone in the head. This is Chip, our mascot. So, you'll see Chip. Uh, if you're not following us on social media, you certainly should. We definitely have Chip sharing different tips of cyber security. Now, who is the valued partner that I thanked when I first came on stage? Very good. Here you go. Nice job. Oh, sorry. You got it. Okay. And who sponsored lunch today? I wish I did. Who Who said? Okay, there you go. Cybernut, I'm sorry. I know I heard a lot, but I saw you say it. There you go. And last question. Can anyone determine where I'm from? What state I might be from? Oh, I sound like New York. I love Oh, that's probably closer. I'm actually from Who? Someone said Texas. Who

220said Texas? Got it. Awesome. Here you go. Here's your blue squirrel. Now, last prize before we go to lunch. This is going to be a secret surprise. under your chairs. One lucky person here has a cybernut. There you go. Koozie taped under your chair. So, take a look under your chair. I have no idea where it's at. So, oh, we found it. Yay. You I'm going to get your information because you're the lucky winner of a Cybernut cooler backpack. A I this thing is so cool. If you've never seen it, it looks like an AirPod, but it's actually a Bluetooth speaker. It's really cool. And a lot of other Swagen goodies from Cybernet. So, I'll come find you and make sure I get your information so we can get that shipped to you. Don't forget

221to come see me if you're interested in a free assessment. And thank you so much. Enjoy your lunch. All right. Thank you, Vanessa. All right. So, we're going to go ahead and break for lunch. So, uh like I said, lunch is out here in the hallway. Drinks and water are down here. Um, and we're going to start back promptly at 1:00. So, be back in your seats at 1 o'clock. Ready? We're going to do incident response planning. So, I know it doesn't sound like fun, but it's critically important. Heat. [Music] Heat. Heat. Heat. [Music] Heat. [Music] Heat. Heat. Hallelujah. [Music] Heat. Heat. [Applause] [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. Heat. [Music] Oh, [Music] [Applause] [Music] heat. [Music] Heat. Heat. [Music] [Applause] [Music] Heat. Heat. [Music] Oh, [Music] hey. I love you. [Music] all

222the way around. [Music] Heat. Heat. [Music] [Applause] [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. Heat. [Music] Heat. [Music] Heat. [Music] Hallelujah. [Music] All right. All right. All right. All right. So, uh, if you're eating lunch, still keep eating. We got a f a few more minutes before we actually officially kick off. Um, but in the interim, I wanted to go ahead and take an opportunity while we're here to give away some more prizes. All right. Uh, we have uh plenty of prizes left. Uh, so right now, I'm going to give away another pair of um Beats uh wireless headset, um, a mug, and a game called Coup. It's a uh really cool uh card game. Um it's it's a short game, so

223like each hand lasts what 20 minutes if that. But it's it's a fun game. Uh but we do have some uh even better prizes at the end. I'm going to give away a new iPad uh later on and a brand new uh Lenovo laptop. So uh you got to be present to win. So that we'll be giving those out towards the end. All right. So, this is going to be for the mug and you can click it. Yeah, that's everybody's names up there. Who wants it? All right, three people. All right, this is great. All right, Nathan Carter. It is not the same table. Okay, this table is now disqualified. You can't win anything else. Did you raise your hand, Nathan? >> Of course. >> Okay. All right. Go ahead and click remove because Nathan's

224not going to win again. All right. So, here is the coup game. So, we're going to spin for the coup game. Who wants to win coup? All right. Well, you're disqualified. Nobody at that table. All right. Go ahead and spin it. Is she here? >> She's not here. You got to be present to win. Remove and spin again. I know her. here in the lobby. Police story. All right. Do we trust that? Where's our seat at? Is there stuff there? Oh, you coming up to get it? He doesn't know me very well, does he? All right. Awesome. Do this and we'll do that. All right. And then so a set of beat studio buds. Go ahead and click spin for me, please. Who wants it? Nobody. Nobody clapping over there. All right, Gary. No, I

225got to yell at him. All right, remove and spin. Do you see what he missed? All right. >> Okay, cool. All right, we also have uh a handful of these really super nice custom Virginia Cybercon backpacks by OIO. These are like the really nice ones actually. Uh we've got a couple to give away at the end, but we'll do one now just to say thank you for staying. Greg Gillette. Greg, where are you? >> Hey, Greg. >> All right. Awesome. Awesome. All right. One one final thing and then we'll get started into instant response planning. So, I did want to make you aware. So, inside of your bags, you have a flyer from CrowdStrike and a flyer from Sentinel One. Okay. Again, I want to I want to say very clearly, we are not here

226to sell you any products. All right. Um I personally spoke to Sentinel One and Crowd Strike and got them to do this uh for the conference. Um if you look at that, pick either one or do both if you want. Um they're going to give you three months uh trial run of their product. Um and so I would preface it with this. If you do not have an EDR solution, if you're still working on an endpoint protection or or a legacy type system, please add to your layers. This is yet another way to do it. These are both great companies uh to work with. You can't go wrong with either one in my opinion. Uh but you have this opportunity to go that they're offering there for three months of the service uh for free.

227So give that a try and uh hopefully uh it'll help you uh be prepared. All right, so now we're going to move on to incident response planning. Now, so this is not the fun part of a conference, right? It's paperwork. It's planning, but it is hugely critical. And I'm not going to steal his thunder, but only to say that this is important. So, we do need and this is where senior leadership and uh technical people, we all need to be together because we all got to know the plan. All right. So, I'm going to introduce uh uh Chris uh Cruz with the um state police and he's going to walk us through incident uh response planning and we'll go from there. So, Chris, >> awesome. Thank you, sir. Um good afternoon everyone. Really excited to

228be here. Truly an honor um to be here. one of your presenters and and workshop facilitators for this first CyberCon. This is so much more people than I was expecting. I wasn't sure what the number was going to look like. This is amazing. This is incredible turnout. So, um amazing to see how many school, you know, technology school leadership and technology professionals are devoted to this. Um I'm worried today might be the scariest day for cyber security in schools. If you're all here, I hope other people are at your jobs covering for you to some degree. So hopefully we don't get a bunch of reports today. Uh but my name is Chris Cruz. I'm going to um introduce myself and I'll let my um analyst friend over here introduce herself as well. Um but I

229just want to point out on the slides there's this QR code. Um so we'll be handing out um a worksheet that we'll be using for some of the the things we're going to work on today for incident response planning. Uh but you can access virtual copies of what we provide. A copy of this presentation and then a metric ton of extra documents, templates, and other stuff you can leverage um all from that um QR code. If you scan it, takes you to a link. If you are on a phone, you can put your email address and it will email you the link so you can get it easily on your computer as well. So try to make it as easily accessible for you and try not to rip down a whole forest by printing out

230180 copies of everything. Um, so my role I work for I'm the cyber program manager for something called the Virginia Fusion Center. Who here has heard of fusion centers? Oh, beautiful. My god, music to my ears. Thank you. Uh, so fusion centers, for those who don't know, um, I'll talk about what those are in a second, but I oversee our cyber intelligence and our cyber response teams that are part of the fusion center. And really my job is to help coordinate cyber across um, state and local government and public safety as a whole. So I work really closely with other state agencies like department of education, department of health, um the state corporation commission. We also work really really closely with lots of local government partners. We've worked with many of the IT directors and

231many of the counties that you are coming from. We've done a lot of work with K through2 in the past. Um our job is really to kind of help raise the bar for cyber security kind of statewide. Um using as much public safety resources and capabilities that we have at our disposal. Um, I'll let my peer here introduce herself. >> Hello. Thank you all for being here. We're very excited to present. My name is Maline Espie. I'm a senior intelligence analyst under Chris. I am on the cyber intelligence team. I just joined in June, so I'm barely very newly added to the team. And I'm actually a former educator, so this is near and dear to my heart. And we're excited to work with you all today. Thank you, Maline. So, Maline will be coming

232around um at some point giving you guys your handouts. Um and then as we get into some of the exercises, me and Maline will both be kind of walking around in case there are any questions um or issues you run into. Um just for people who don't know about the fusion centers, um fusion centers, the Virginia Fusion Center was created back in 2005 through state code. Um the fusion center concept was created by the federal government in direct response to the information failures that led to the 9/11 terrorist attacks. So federal government the 911 commission said information sharing across federal, state, local government collapsed and that is one of the things that enabled those attacks to be successful. So they developed the fusion center concept to be these state-run um information sharing centers that sort

233of work to push information up and down the different chains of government as well as engage across different sectors um and different critical infrastructure partners whether public or private. Um we handle all threats, all crimes, all hazards. We're colllocated with the state emergency operations center in Richmond, Virginia. Um so we we support all types of emergency response, disaster response, and threat response across the Commonwealth. Um, I want to jump straight into like level setting on a couple things, giving you some perspective that we get. Um, we are fortunate being a law enforcement agency, we have access to lots of information from a lot of different sources. Um, they we are also the recipient. Um, starting in July of 2022, General Assembly passed a new code section. I just want to preface, we did not ask

234for the code section change. They just uh lauded it upon us. uh but they implemented a code section requiring all public bodies to report cyber incidents to the fusion center within 24 hours. So we act as the clearing house for that reporting. We share it with certain um federal law enforcement partners. We provide assistance if you ask for it. Uh we provide intelligence if you need it. U but we also collect that data and look for trends and patterns in major cyber attacks across the Commonwealth. And I can tell you that unfortunately if we look across the broader targeting of state and local government, particularly school systems, these are some of the biggest problems we see popping up over and over and over again. So the number one thing we're seeing is bad guys are

235using and abusing bad passwords. Part of this is users who have lousy passwords. Um either there's not uh strong enforcement or you've got old accounts that um have legacy password requirements that are still floating around. We see a lot of service accounts that people have forgotten about uh that are floating around with really really really bad passwords like password one two three password. Um but we also see um credential stuffing which we'll talk about in a second as um definitely a growing trend that's being used to target a lot of school systems. Second big thing we're seeing is still a lot of issues with it misconfiguration. So, you stood something up, you put something in AWS, um, when it's not down. I guess you put something in AWS, uh, missed missed a button, missed flipping

236a switch. Um, and now some of that data is exposed. Bad guys are scanning it, finding it. You put something on the internet, within 30 se within 30 seconds, someone from China has already scanned it and is already looking for a vulnerability. That's how fast bad guys move nowadays. So, we still see tons of issues with lots of open ports, lots of unused services still accessible from the internet. If you have no use for RDP, I should not be able to see that RDP is turned on or available on any of your ports anywhere on your network. Third thing, we see lots of missed updates, lots of issues where there was a security configuration that was a result of non-patched, non-update, outdated software. This happens time and time again. We're also seeing some user issues.

237Um, poor cyber hygiene in general. Still lots of link clicking, lots of downloading attachments, lots of surfing, uh, nebulous websites that maybe users should not be at. Uh, but we're also seeing lots of misuse of privileged accounts. Generally, we always uh, strongly recommend if you have admin accounts, if you have privileged accounts, you limit the access and capabilities of those accounts. for example, um should not be browsing Reddit on your admin account, but people do it all the time for some reason. Should be checking your email from an admin account, but people do it all the time. So, we're seeing some misuse of admin accounts that puts those at significantly increased risk. And we're seeing a lot of bad guys uh getting easy credentials and their first foothold in is with a random admin account

238that someone was just kind of messing around with. Some of the big trends, so ransomware continues to be a major issue in Virginia. Um, I've highlighted for you some of the major groups we're seeing right now. So, I can tell you right now, killing the top one, Q Lin, top ransomware that is kind of going crazy right now, um, impacting tons of state and local government, not just in Virginia. Um, seems to be up and down the East Coast. Um, North Carolina, is anyone here from North Carolina? I think if you someone was earlier, um, North Carolina is getting like, oh, my way in the back. North Carolina, just so you know, is getting like slaughtered with killing right now. There are tons of local governments getting popped with that. Um, we sent them some

239information. They sent us some information. We saw it spike in Virginia earlier this year and then it kind of went quiet and now we're seeing another big spike of killing ransomware specifically. Um, Glo is the other one and I'll talk about them a little bit more in a minute. The credential stuffing is really bad. Um, what we're seeing some instances where a lot of times that initial access into an account or into a network is through already known credentials. So bad guys are not often as often leveraging um really advanced techniques. Sometimes they're getting in because they already have a valid username and password and they're just jumping right in through your VPN and getting into the network and then moving around from there and then using some more advanced techniques to either move laterally

240or privilege escalate. Um some of this credential stuffing is coming from lots and lots of reused passwords. So people are using their Netflix password is the same as their school system password which is sometimes the same as their admin password. And so if their Netflix account gets compromised, all of their school accounts or work accounts are getting compromised. Uh we also know that bad guys are collecting and storing all of these stolen credentials over time like Pokemon cards. Um there are huge databases that are in the billions now. They are in the billions of login credentials that are routinely shared traded. So if you have any old password that's been popped any time in the last 20 years, that password will live forever in infamy on a series of lists and will be used and

241reused over and over again to see if it ever is accessible again. So old passwords and reused passwords is really what's empowering um a lot of bad guys to take advantage of credential stuffing. Tons of fishing still. We still see fishing as one of the number one ways a lot of attacks are initiated, including ransomware attacks. Um, some of the specific trends we're seeing in Virginia include QR code fishing. Seeing lots of emails coming in that have that QR code. Sorry, I started my presentation with QR code. Um, I promise it's not a trap. Uh, but we are seeing a lot of emails coming in. This is an example of a real fishing email that came in that we got reports of um, from a number of partners um, that was im imitating uh, Microsoft

242with QR codes trying to get you to scan. Um, we see less impactful for you all, but we still see it impact some localities and schools is business email compromise. Bad guys are getting in, watching email traffic go back and forth, waiting for the perfect time to like intercept the communications, and then they're interjecting fake wire transfer instructions and getting money sent to the wrong place. Um this impacts private sector more often, but we have seen several instances where counties or schools have gone to pay an invoice for something and accidentally because of a compromise sent the money to the wrong place. Um when that happens, there's a finite window to stop that me that transfer or reclaim those funds. So you must act quickly if you catch it. Um and if it gets reported

243to us, we go directly to the FBI because FBI has the resources to stop it. Um, and then we still see lots of spear fishing, very targeted, uh, well-crafted fishing emails. Um, I'm sure it's been talked about earlier today, but if not, with the proliferation of AI and all these new tools, many off the shelf, uh, we're starting to see that uptick in like more capable, advanced, and interesting fishing emails popping up. Some of the education specific threats that we see or get reporting on, um, according to Microsoft, education is the third most targeted sector like period. um really only surpassed by general government and health care. And from our perspective in Virginia, it usually flips between healthcare and education as the number two. Um so you guys are on the front lines of the

244cyber attacks. Unfortunately, you are targeted the most more than most other sectors and areas. Unfortunately, um Microsoft estimates that well over 15,000 fishing emails per day just hitting um education sector. That's just the education sector alone. Um, we do know and we do see that nation state actors, so you might think Russia, China, Iran, North Korea, don't care. We're just a little rural school system with a small number of students. They are attacking school systems. They are compromising school systems in certain circumstances. You are not exempt, unfortunately, from that particular threat group. Um, and oddly enough, or maybe not oddly enough, but it seems statistically that K through 12 um is actually targeted more than like higher educations. We actually are seeing that K- through2 schools are taking the brunt much more than universities which

245I would have thought it wouldn't the opposite but it turns out um K- through2 is being targeted at a much greater rate. Um most of these attacks really are about making money. These are financially motivated cyber actors that are typically targeting schools and they're trying to turn data access or disruption into some form of illicit profit. That is their goal. Their goal is to make money at the end of the day in almost all of these instances. And at least according to Microsoft information, 80% of the time, over 80% of the time, these attacks are again targeting passwords. They're exploiting bad shared lousy passwords um from their reporting at least. So, we do see that as a continuing problem in this space. Um just to highlight some I'm not going to pick on anyone in

246Virginia, but I am going to pick on some people outside of Virginia because they're not here to defend themselves. So, um, the Highline Public Schools in Washington State, I have to go to my notes for some of these. Um, was hit with a ransomware attack, uh, back in 2024. Um, it was over, they serve over 17,000 students across 34 schools. Um, they had a ransomware attack in September, caused an entire um, district-wide shutdown for the school system. Um, and it took them about three weeks to recover. The Toronto District School Board um had a ransomware attack in 2024 as well. Um they are very large school system. They service over um 235,000 students um across their different schools. Um they had a significant ransomware attack. Um actually started uh bad guy gained access in 2023

247but stayed there for an extended period of time. Did not s uh actually flip the switch to a ransomware attack till 2024. They were probably exfiltrating tons and tons of data over that long period of time. then implemented the ransomware. Um it is uh believed that uh a large portion of student data um everything from names, addresses, birth dates, all sensitive data essentially was successfully excfiltrated during that incident. And then I mentioned um a few of the ransomware groups, BOG ransomware group um it's one that has been a little bit less active recently, but in 2024 they set out on a mission specifically targeting schools. This was a ransomware group who said, "We think the most money we can make right now is specifically targeting K- through2 schools." And that's what they did. They targeted

248all of their ransomware efforts towards the education sector um as a way to make as much elicit profit as possible. So, what are we going to do today now that I've like hopefully sufficiently scared you into like waking up post lunch or at least um caring a little bit about what we're going to talk about? So, we're definitely gonna try not to keep this too boring. We're definitely gonna try to keep this interactive. We're going to go through a few different um some longer and some shorter kind of exercises or or practices, practicals, whatever you want to call them, but essentially we're going to use one particular incident as our kind of case study for today. We're going to walk through that incident. Then we're going to practice going through setting up what we call

249an incident uh response plan matrix. This is like the barebone elements of what an instant response plan should have or should cover. So, we'll walk through that and then we'll kind of put you in an exercise to go through those steps at your tables together. Um, we'll talk about prioritizing recovery and why that's important. Then we'll do a decision-making simulation because we have found that in all the incidents that we have worked on or supported, the biggest fault that is not technology tends to come with decision-m. Usually it's lack of clarity on who needs to make which decisions or who um how fast do we make decisions. We sometimes see people hit uh what we call um analysis paralysis where they are so overwhelmed with the incident that decision-m stops and they kind of hit

250this spiral of like doom and gloom. This is horrible. This is terrible. They start focusing on all the things they've lost or all the things that are disrupted and it takes a lot of push to get them back into like traditional response practices. So, we'll practice putting you through a little bit of a doom and gloom scenario. You're going to relive our our case study scenario a little bit, and you guys will practice decision- making in shorts amount short amounts of time essentially. Um, and that decision-m will cross both technology and organizational decision-making. So, if you're an IT leader or an IT person or a security person, there'll be lots of decisions for you to make. But even if you are not, there will be lots of decisions for someone else to make. And if

251you don't have someone else non-technical, then play devil's advocate for them. Today, um, we'll do a debrief, a mini hotwash because doing postaction, post incident reviews is critical. And it turns out the majority of our partners across the state are not doing it. So, we're going to force you to do it today. And then, uh, I'll give you some homework at the end, uh, because I have to lean into the school theme as much as possible. So, um, our goal today is to kind of equip you all with some core elements of either how to build an instant response plan if you don't have one, how to set that skeleton up, or if you have one already, how to vet and refine it, how to see what am I missing, what do I need to

252add, what do I need to improve. We're going to go through basically everything you need to have a minimum viable plan um, when you leave here today in theory. So, our use case is going to be um an incident that happened in Jefferson County, which is in Georgia, right? Alabama. Sorry, I keep getting confused. Um Jefferson County, Alabama. So, Jefferson County School Systems in Alabama in 2023 had a major disruptive ransomware attack. And some of this is on your handout, the overview of this. So it was a successful ransomware attack that included data encryption. So huge amounts of data was encrypted by the bad guys. It included a ransomware demand. It also included an unknown amount of data being excfiltrated from the network. Until this day, we're still not sure how much. Uh it was

253a district-wide outage that knocked out payroll. It knocked out student information systems. It knocked out attendance systems. Pretty much everything was offline. Um it lasted eight days. So, eight days with all systems um disrupted and it took them three full weeks to get back to normal. Essentially, some of the issues that uh Jefferson County in particular ran into, they did not have offline backups. So, one of the fastest ways to recover from ransomware is to restore from clean, secure, immutable backups. They unfortunately did not have that which made recovery significantly more difficult. Um they ran into lots of communication issues, lots of lack of clarity on who notifies who, when, and how. Um and there were a number of instances that we'll see as we go through today where uh communications were significantly delayed uh

254which may have caused this incident to become worse than it should have. Um there was found to be um some major uh missing training opportunities either security awareness training for personnel training on the actual response plan, what it says, what does it mean, how do we put it into practice, things like that. Um there was no priority map for recovery. So if everything was down and you had to decide what comes back up first, Jefferson County's an Jefferson County's answer was I don't know. We don't we are unsure what has to come back first. Um and we'll see that they may have made um not the strongest decisions in some of those scenarios. And then finally, they didn't have uh a fully updated and tested response plan. So today, our workshops are about going through

255some of these shortcomings. We're not going to cover all of these, but what you have access to from that QR code is something that aligns to every single one of these. We're going to cover a few of these in class today, but your homework covers the other things we are not. So you have templates, you have guides, you have what we call a SER in a box, a cyber incident response plan in a box, which is a guided workbook on everything you need to build a response plan and then a template of what it could look like. Um, so everything you need you will have today. So let me ask a couple hard questions uh because these are the questions we find uh most prominent when dealing with major incidents. Who here knows where do

256technical teams often freeze during an incident or where have you experienced like just a huge stoppage of work or confusion when dealing with a major incident. I will call on people. So task assignment who is supposed to do what? And like how do you know what you're supposed to do? Who's going to take the initiative to do? Who's responsible for doing completing each task? Essentially having clear roles and responsibilities defined and the tasks assigned to those. Is that fair assessment? That's a great one. Who else has one? Order of operations. That's a really good one. So we do find um sometimes people have an incident and um not that this is the wrong answer, but some people go straight to recovery. uh and that's there's there are scenarios where that is the right answer and

257there's scenarios that is the answer that works for you uh but a lot we find a lot of organizations don't know what the clear order of operations is what are the steps I should be doing and then what are like the thresholds or triggers how do I know when it's time to go to the next step how do I know when I'm stuck in the same step and how do I know if I've been stuck in the same step too long essentially so that's a great one um anyone else have Yes. Where's the plan? That's a great one. It seems intuitive that yes, we have a we probably have a plan and it's there somewhere. Um we have seen incidents where the they have we say, "Do you have a plan?" They say, "Yes." We're

258like, "Cool, where is it?" And they're like, "It's on the server that is no longer accessible." Um, so we do see funny instances where the plan only exists digitally and when your digital systems are no longer there, your plan is suddenly no longer there. Um, we do also see uh not as often but sometimes uh the question of where's your plan and they pull out a binder and they go and a bunch of dust flies everywhere and the plan is older than I am and I'm 40 years old. So the plans uh sometimes are forgotten, sometimes left to uh sit uh for a while and so knowing where your plan is and what it says is such a critical component. Any other times where we see technical teams freeze? Yes, communication between team members so

259critical. We see this a lot where um going back a little bit to the original one of uh who does like who's responsible for which actions or which steps. Um we sometimes see um particularly if you are activating like your cyber insurance or you're bringing in like a thirdparty security provider it sometimes becomes unclear on what are they going to do and what do you have to do and who's responsible for which part of it. That is a great one as well. When do we see times or when do we feel and um this is a safe space you can say what you you can say what your heart says. Uh do you feel like leadership is not investing in what you need to be more secure or do security better? Yes, just just a

260flat yes, it's happening. Are there any specific are Let me let me rephrase it. What do we feel like they're not investing in? We had to pick one thing. Time. Interesting. Did you say can you span expand on that? Ah, okay. What else? Training. Not investing in training. Training is that training for users or training for your actual IT and security personnel? All of the above. Of course, there was a hand over here. Marketing. Ah, so almost acting as like um like a support mechanism. I don't want to say a cheerleader, but kind of like being the the wind beneath your wings to help you be successful. Right. Okay. There was a hand Oh, a hand way back there re technical and third party resources or actual hands-on keyboard people that can actually do some

261of the work. There was a hand right next to you. Sorry. Yeah. interesting funding. Yes. So, yes. And Yeah. So, sometimes you're competing for funding. Sometimes the funding has to be cut. Your shop may be the first on the chopping block. Sometimes it's hard to convince senior leadership to be like, particularly if you haven't had a bad incident. Knock on wood. Uh, in a hot minute. Sometimes it's hard to justify more spend if we're already secure enough. Um, there was another hand in the back. Blue. Yes. Blue shirt. he said. Uh, so yeah, more more people, more hands- on keyboard. Great. So, these are all things um that we definitely see. These are also things that we like to hear, not that we like to hear them, but things we like to hear you all

262talk about because we take these back as discussion items and action items at the state level to figure out what is the state doing to support organizations like you and what do we need to do differently based on the problems you guys are having, you guys, and girls and and everyone else. So, we're going to kind of get into the response planning um discussion here. Before we go into the exercise, we're going to talk through kind of a core element, the incident response life cycle. So, there's a lot there's a lot of variations with this. A lot of people have different variations, different versions of it. We're going to go with this one. This is the one that I think SANS has sort of officially endorsed and uses in a lot of their training and

263core elements. Um this to me is probably the simplest one. And I think this is the one that is most straightforward and easy to translate. Um you can really think of it as um your response exists in three phases. There's the pre-inccident, the incident, and the post incident. Right? Everything falls into one of those buckets. I like to think of it as you have a phase dedicated to learning. You have a phase dedicated to adapting to what happens. And you have a phase dedicated to repeating, applying those lessons learned so you can do it again, but do it better the next time. So what typically happens is we focus on these core incident response processes but sometimes we've get there are lots of underlying processes that exist here that are not captured in many of

264the fun interesting graphics all over the internet. So while incident response has the six phases that we're going to talk through um it also is uh essentially subject to a variety of other policies, processes and procedures that directly impact whether it works, whether it's successful or how capable you can deliver on it. So things like funding and budget come up first before you actually get to preparation. Your ability to prepare for an incident is deeply rooted and is dependent on your funding and budget. Right? So that issue sort of comes up first before the cycle. Things like policy and planning um play a critical role particularly when you transition to the start of an incident. Technical training uh is a major component and feeds into how successfully you navigate the identification, containment and eradication parts

265of an incident. That is a lot of where the boots on the ground, hands-on keyboard technical work is happening. Right? Similarly, uh critical communications. We see that when communications uh sucks essentially this is the first area of failure. It's this cycle and figuring out who does what when and how starts to fall apart. We know that things like resilience, the ability to sort of deliver a critical service in spite of an incident, even if you are the victim of an incident, even if capabilities are disrupted, the ability to figure out what is most important and keep delivering on that um occurs somewhere over there and feeds into this larger effort. And then commitment to change. You can survive a hundred incidents. you can respond to a 100 ransomware attacks, but if you don't commit to

266improving afterwards, um you're going to go through a hundred more probably. So there are lots of underlying processes that sort of feed into impact and affect the core incident response phases. But what generally is going on? So I'm going to hit at a very high level the core elements that are happening at a technical team perspective and then an organizational think of like organizational leadership perspective for each phase. Um that QR code that you have which is also on your handouts um has a much more detailed cheat sheet for each of these. So I am giving you the highlights but there is a laundry list of actions for each of these available um in the incident response cheat sheet that's in your um in the box folder that you have access to. So at the

267preparation phase, you should have really good asset inventory. You cannot protect what you do not know you have. Essentially, we call these dark corners in in my world of cyber security where you have these dark areas of your network where you're like, I'm not really sure what's over there, but there's probably some stuff that I own and I'm technically responsible for. Uh we find that this comes up a lot where people lose track of equipment, they lose track of services, they lose track of accounts, and those create more security risks that you um often struggle to keep up with. Um having any kind of EDR, endpoint detection and response tool, any type of uh intrusion prevention or detection system in place, um doing your vulnerability scans, patching, upgrading, um doing good backups or just having

268any form of backups. All of this is the te technical work that is happening and the preparation phase. Organizationally, you need to make sure you have defined roles. Who does what, who specifically is responsible for which actions. Uh and those should be defined by title. Don't define it as it does X because you probably have more than unless you just have one guy in it or one girl or one person. Um you probably need to be slightly more specific. um having that communication plan, knowing who to contact and how to contact them. Uh and we'll talk about why that's important and then having approval. We find sometimes people create beautiful, amazing, just awe inspiring plans and then they PDF them, they put them on a network drive and then they just sort of forget about

269them. Um it's important that you share your plan. Make your plan viewable to as many people internally who have a need to know. Make sure your leadership sees your plan. Your leadership should ideally review and approve the plan in some capacity. So that puts responsibility on them to know what it says and how it works. At the identification phase when we are stepping into real incident response, we want to confirm an incident. Sometimes things seem like incidents and they are not. Sometimes we have to know the nature of an incident before we can call it an incident. In my time in private sector, we drew a very strong legal dis distinction between an incident and an event because the law defined lots of things for incidents, but it did not define anything for the word

270event. So every cyber attack was an event until we decided it met a particular threshold and then it became an incident and then that's when all of our legal obligations would kick in. So understand how do you define an incident for you and what are those triggers and thresholds going to be and who makes that call? Uh this is the the area as well where people are doing a lot of log collection analysis trying to figure out what is happening, what is the impact, what services and capabilities, what endpoints have been touched, um have been disrupted, have been disabled. And then for some people, this is where they start preserving evidence. Um it's not necessarily a hard requirement, but this is where you might start collecting lots of information and data and holding it somewhere

271safe and secure in case you need it later. From an organizational perspective, this is where if you have like a formal response team or if you have dedicated response roles, you might want to start activating them and you should have a process to activate those capabilities. You want to ensure and this is gets overlooked a lot particularly if you are a nonIT leader. You are the support team for your technical team. So you should be ensuring they have a place to work. They have a a a a um like a a war room essentially. They have all they have meals. They have uh clear shifts. They have a clear designation when they can stop working. You become that like uh warm blanket of peace when they are dealing with absolute chaos. The last thing that

272an incident responder needs to worry about is like when am I going to eat lunch or am I going to get dinner? When do I get to go home if they're already in the midst of responding. So as organizational leaders, you should remove those barriers, remove those concerns from your IT and security team so they can focus on IT and security. Make sure they have all the pleasantries of life that they potentially need so they can focus on the work. And then helping coordinate the information flow. We find often that while the the technologists and the security teams have a lots of information, the flow of that information ultimately falls on organizational leaders leadership to decide who gets to know what and when. And so having those clear partnerships and agreements in place, having that

273written somewhere um and taking responsibility for helping coordinate that information flow is what we like to see from organizational leadership at this point. When we get into the containment phase, right, we're talking about isolating systems, disabling accounts, potentially anything we can do to stop the bleed, right? How do we stop the spread further now that someone has successfully done something? Um, we might implement block blocks. We might start preserving formal forensic evidence. From an organizational perspective, you should have questions like what level of incident command should we be act activating? Are you dealing with a cyber incident or have you now are you now dealing with an emergency? A lot of our local governments at the county level draw a distinction between this is an event and this is a disaster and there is a

274not only a legal distinction but there's a resource distinction there is a process distinction that comes with those and you might want to consider doing the same thing. Um are you dealing with just an IT issue or are you dealing with a disruption to the education system as a whole and how does that change the processes and responsibilities? Um, you want to organizationally lead organizational leadership should think about how you're coordinating communication still. Um, you should also be assessing impact. Should not be the IT director stressing about whether or not there's going to be classes tomorrow, whether or not you're going to open, whether or not uh the chess club is going to be able to meet tomorrow. That's an admin issue. It's an organizational issue. So, organizational leadership needs to pick up that part

275of it and deal with those impact problems. Um but it and security needs to be head down dealing with the technology problems. And then finally making sure particularly at an organization organizational level you are logging documenting decisions made. This is probably one of the biggest u misses we see with major incidents is you start making important critical decisions and no one has documented who made that decision and when. And so we run into an issue where someone says why why is it this way now? Why did we take the system offline? Why did we isolate these 300 computers? Why did we disconnect everything from the internet? And it's not always clear who made that call and who put that into action. And that causes spiral. That's where we see the spiral worse uh is when

276people are unclear on who made a decision for a significant activity. So please like document and log critical decisions, who made it and when so you can go back to that point in time if necessary. When we get to that eradication phase, right, we're trying to remove as much bad stuff. We're trying to prevent reinfection as much as possible, re uh reaccess by malicious actors. You might already at this point be wiping and re-imaging or restoring systems. You might be patching or fixing vulnerabilities potentially, just depends on the nature of the incident. Um, you might be validating as many clean secure systems and backups as possible and isolating these things. Um, organizationally, you might be looking at like cadenced reporting. You might say, "This is a three-day incident. I want an an update at 8

277am every morning on where what we've done and where are we going today." You might be taking over all the communications. Um, and again, you want to document milestones as things are recovered, as things are brought back online. You want to document what was done and then what can you share publicly or share with your critical stakeholders who need to know. as we move into recovery and typically it's a very blurry line on when recovery starts. Uh but we're probably restoring systems from clean, secure, validated backups. We're likely testing integrity of certain systems or testing integrity of backups before we implement them. We are putting things back online. We're moving slowly back towards steady state. And then we are monitoring. This is another area people forget. A lot of people go quick to recovery and

278put everything back online. um you should be like the most monitoring you should ever do is in like the 48 48 hours after an incident because if you are going to get repopped reinfected recompromised it's going to happen then probably at least um so please implement some form of monitoring so you know everything's good everything's up and everything's still safe organizationally you organizational leaders should be having the discussion and potentially making the decision on what comes back first is it bringing student systems back first Is it bringing teacher payroll back first? Like what has to come back first if everything's down. Um it's ensuring that documentation's been updated. Even for IT leaders at this point, you're looking back to see what did we change? Did we create new security baselines? Did we create new backups?

279We need to document those changes. Um providing support to users. um communicating out what is safe, what is not safe, what new actions users need to start taking, what what information do they need to know? And then overall uh while it is verifying the stability of networks, organizational leaders should be verifying the stability of the organization. Should we focus on can we move forward as an organization? Can we deliver on what we need to at this point? And then finally, once you're through the the worst of it, you're on the other side, there's light at the end of the tunnel. We strongly urge and always urge to do some kind of lessons learned afteraction report. If you hate doing afteraction reports, call me. We will come and do it for you. We will coordinate the

280meetings. We will sit down. We will take all the notes. We will let you yell at us as much as you want to. We will write everything down. and we will write you an afteraction report if that's what you need. At this point, you want to verify everything you fixed. You want to archive any evidence you kept. You want to update if you uh if you've implemented monitoring, you want to make sure any new detection rules or new uh security implementations you've made are updated and documented. Now, um organizationally, you want to do that afteraction review. You want to make sure you document the outcomes. What did we learn? What did we change? what do we improve? But more importantly, you want to document what do what other work do we need to do? What

281homework do we have to fix the problems that allow this to be successful? And then you want to provide transparency to whatever leadership is necessary. Here's what went wrong. Here's how we fixed it. Here's how we're going to stop it from happening again. So that is your crash course in like core elements of the instant response phases. Like I said, in that link and your QR code, there is a much more detailed breakdown of a variety of actions that happen at each one. I don't want to sit here and school the masters because I know some of you are masters at it. Um, but know that that resource is available. Now, we're going to get into an exercise where we are going to practice developing essentially the base uh elements of an instant response plan

282based on these six phases. So, we're going to walk through what needs to happen. Um, they call it an IRP matrix. I call it an IRP skeleton because it's spooky season and I have to stay on brand, right? So, um, it's really the skeleton of an incident response plan, the core elements that should be there. This is an example of what an IRP matrix looks like. So, it's broken into those six core phases, the six response phases we just walked through. For each one we need to define what are the core action what are the major action steps that have to occur. Who is responsible for those actions? How is how does communication happen at that point? Is it phone? Is it email? Is it in person? Is it some alerting system you have? Is

283it text message? Is it carrier pigeon? Is it smoke signals? Whatever you got. Um and then what is the trigger that activates that phase? This is the part where people sometimes get confused. So, think of it as like what activates my preparation activities. It could be something like an audit failure. If I'm auditing my backups and I see a problem, that might activate my process of uh improving or or updating my back off my offline backups. If I have a ton of enduser reports of a system outage, that potentially might trigger my process to start doing detection and analysis to see, do I have an outage or do I have an incident? Right? So, this last column is what triggers this phase to go into effect. How do you know when you need to potentially

284start doing that phase of work? Any questions on this matrix? Because you're going to build one now. So this is your last chance before I unleash you. So for this exercise, you're going to have uh basically I'm going to set you up for each phase. I'm going to give you some basic information. I'm going to give you a couple discussion questions to think through. You're going to have five minutes per phase. Five minutes seems like a lot, but I promise it's not. So you have five minutes to look through. We're going to do one at a time. So I'll tell you when the five minutes is up and we're moving to the next. You're going to think through for preparation. What are the key actions we would take? Who's responsible for those actions? How do

285we communicate? And then what triggers that phase? How do we know it's time to do that phase of work? So your goal is to think of like smart goals. Think of this as smart goals. Is it specific? Is it measurable? Is it actionable? Whatever the R stands for, I don't remember. Um, oh, when you're talking about communications and things like that, remember, use job titles. Don't say notify it if it is seven people. You can say notify it if the guy who does your IT is named it. I guess that works. Um, you want to try to base this on what you do now. Don't do pie in the sky. Don't do 10 years from now. Don't do my billion dollar budget plan. Just do what you do now. Keep it grounded in what you

286do today. Um, if you get to one of these and you're like, "Our detection and response is sort of in progress. We're rebuilding that. We're implementing a new EDR tool, so we don't know what that looks like today." Put TBD to be determined, right? You'll figure it out when you're done. If you get to one of these and you're like, I have absolutely no idea. Just put unknown. And that's how you know it's a gap you need to go back and look at and think through. So, just to summarize, we're going to walk through each phase. Five minutes per phase. details are going to be up on the slides. You're going to complete each row of the matrix one by one. Five minutes per phase, five minutes per row. Um, your answers don't have to

287match each other. It's like big groups of you at tables. If you have different ideas, different responsibilities, different actions that you would take, you can document yours differently than the person next to you. Um, just don't fight with each other. Um, your first phase, so preparation They're level set. Here's what Jefferson County did not have. They did not have offline backups. They did not have an up-to-date contact list. They didn't know who to call and how to get in touch with them. And they had minimal awareness training. So, you have five minutes to think through what do you have that could what are your preparation activities that could potentially prevent a ransomware attack? Who's responsible for those activities? How do you communicate? And what triggers those actions? Your five minutes starts now. I got back

288the table so everyone >> we have extra worksheets if anyone needs one still. >> Hey Chris, how's it going? >> Good to see you. >> Nice. >> Thank you so much for being here. This is awesome. >> Such a great resource. One of the things that we're starting to hear best Yeah. Yeah. Sure. We can definitely make sure >> I really Yeah, we're getting going on just get the What are our first steps for a long way to go? We'll see if they like it. >> We'll see how they feel about the decision they >> having a talk afterward. >> It's the tough >> fantastic support. >> Nice to have a coworker education back down. Yeah, we're, you know, different different than every other [Music] minutes. Phase two. So, Jefferson County, we they received a

289ton of login errors getting reported. They dismissed it as server issues. Did not think it was indicators of the start of an incident. They also delayed significantly in communicating any confirmation that a potential ransomware attack had occurred. Your steps complete row two that identification uh I'm sorry should be detection and analysis not identification. Um and talk about how could you today detect a ransomware attack potentially? What would you how would you handle unusual login and how would you verify an incident? So what are the key actions you need to do those things? responsible parties, communication methods, and triggers to know when to do that. Go. Five more minutes. [Music] Heat. Heat. [Music] All right, that's five minutes. Next phase. You have moved into containment. Jefferson County made the mistake of leaving their student information system

290online for three afters after they'd already discovered ransom notes uh showing mass infection. So they did not take critical systems down or isolate them during this phase. So to fill out the containment row, think through how would you isolate or segment infected parts of your network or systems, who's making the decision for shutting things down? Use SIS as an example, but pick anything you want. If you have something important and it's got to come down, who gets to make that decision? Who needs to make that decision? And then what's the plan to communicate if the network fails? If all communications electronically falls flat, no more email, no more internet. How do you communicate during this phase of the incident? Think about these three things. Answer again your key actions, your responsible roles, how you communicate,

291and what how do you know when to start this phase of the process. Five minutes again. Go. [Music] All right, that's five minutes. It flies by. Next phase is eradication. So Jefferson ran into the issue. They only did partial reiming of certain systems. They did not fully wipe and restore. This led to a reinfection by the malicious actor. they got back in the ransomware was not fully removed. They also did not vet that they had systems that were fully clean. They didn't do the extra due diligence to make sure certain backups or certain systems were completely clean uh removed of all infection. So for eradication, think about what partners or vendors might be involved. Are you relying on a third party service, cyber insurance, who is helping you potentially navigate this and what are they

292doing? How do you verify that a machine or server is fully clean after a ransomware infection? And what are the legal obligations you might have at this point? Do you have any? Do you know what they are? So again, think through the your row. Five more minutes. Go. [Music] All [Music] right. Five minutes. Next phase. You're moving into recovery. Jefferson County chose to restore their email communications before they restored student information systems or other critical learning tools. So that caused huge confusion on whether or not students were supposed to return to classes or not, whether or not teachers were supposed to return to work or not. Um, no one knew what was supposed to happen next. when they went to leverage backups for parts of recovery, they found backups that were multiple weeks old, even

293though they thought they had running like 24-hour recent images that they did not have at their disposal at all. So, think about your recovery. Who approves the priority with which you restore critical systems? Who has to make that call? How do you communicate that something is safe and operational again? Are you doing that? Is someone else doing that? How do you get that messaging out to students, staff, parents, whoever needs to know? And how do you restore from backups today? Do you know if you had to do a largecale restoration from backups right now how to do it? Can you comfortably do it? So think through those five minutes. Fill out the col row. Sorry, fill out the row. Go. [Music] How much longer you think you have? You have plenty of time. All right,

294five minutes is up. You've survived. You've made it. Light at the end of the tunnel. You got to the other end. Jefferson County never did a formal afteraction review. So post incident, what is your afteraction review process? Do you have one at all? Even if it's informal, even if it's just buying pizza and yelling at each other. How do you assign and track improvements? How do you know what went wrong? Who's responsible for fixing it in the future and making sure this doesn't happen again? How do you assign and track those tasks, if at all? And can you translate, this is a tricky one, can you translate lessons learned from an incident into a budget request to your leadership? Can you do that? Yes or no? Think these through. Five minutes. I might give you

295less than five minutes. [Music] Hallelujah. [Music] Hallelujah. [Music] All right, time's up. Who learned something new about your response intentions? We'll say we won't even say response plans. Who's learned something new about the way you do response today by doing this exercise? Show of hands. Good number of hands. Did anyone learn something new they were willing to share with everyone? I saw a lot of hands over here and new volunteers. >> The post incident, >> you didn't have that at all. So >> that was that was mine too. So thinking through the post incident, how do we translate lessons learned? How do we like set action items and track doing them? How do we do budget like translate that into budget? All that kind of stuff that happens post incident. Great one. Anyone else have

296like an interesting lesson learned that came out of this that they want to share besides buy pizza and yell at each other? >> Say what? You like that one? That's how I run my team. Maline knows All right, I won't call on people. I teach at VCU. I'm used to looking at people who just stare back at me. Um, so we're going to move into a next like a mini exercise. I'm going to give you a break and then we're going to move into our decision-making simulation. Um, I'm going to keep the break kind of quick though. Um, so we talked a lot about response planning. We walked through those core elements. What we want to really emphasize is that importance of that um recovery priorities, right? Knowing what needs to come back first and

297potentially who needs to make those decisions or at least how do you communicate that to the people they need to know. Why does this matter? Having the priorities allows us to minimize downtime. Um so we can avoid making an incident last longer than it needs to. It ensures that data and continuity are protected. So some we have seen incidents uh incidents where people bring certain systems back up too quickly and there are in systems that probably should not have been brought back up that enables either reinfection. We've seen people bring back up the system, but in the wrong state, which leads to misconfigurations, which leads to new risk or new attack potentials. Um, so it's not just about like flipping switches back on or plugging stuff back in. It's ensuring you're bringing back the right

298thing at the right time. Um, and then it's about aligning it. And this the the words you use for this part really depend on uh what perspective you're coming from or your background. and private sector we'll call it business critical systems or business impact analysis understanding the most critical business processes and how do we get those back first in government and like my side of government like law enforcement and public safety and emergency management we call them mission essential functions what are the most critical things you need to deliver the mission for state police the mission is public safety it's law enforcement um for Virginia Department of Health it's public health it's that type of thing so you have to think through what is your ultimate mission deliverable or there is actually a whole subset

299of people that have developed learning continuity plans. So helping prioritize critical learning systems. So how do you either keep delivering on learning um in spite or during a cyber incident or how do you prioritize recovery and return to steady state in a learning environment? in that box folder in the QR code stuff that you have access to, there is an entire document that just talks about learning continuity plans, what they are, how you can build one, how you can learn more about them. So, I am not the expert on learning continuity plans. I would look as many of you as the experts, but there's an extra resource in there if you want to go down that specific rabbit hole. Just know that when it comes to like prioritizing returned to steady state and understanding impact,

300there is a whole field of study. There's lots of math and statistics and measurements that go into it that ties into like the fair model if people are familiar with that with creating like measurable uh mathematical measures of risk and things like that. But a big part of it is understanding how much data loss can you sustain. If you have rolling seven days of backups, you potentially can sustain seven rolling days of data loss. Maybe I should say six rolling days of data loss. Um if you don't have that, your data loss measure is different. Um, you need to understand how much downtime can you sustain? What is the acceptable amount of time to have no payroll system functional? We have seen government agencies who go a long time without payroll because they have excellent

301processes to go unfortunately full paper, full manual cutting and writing hundreds or thousands of checks. Um, the the finance people hate it, but it can be done, right? So, what is your recovery objectives? How long could you go? And then think through what is the maximum amount of time you can go without something. That is like the absolute bleeding edge of how long you can stand to not have a particular service, a particular app, a particular capability. So there's a lot of math. I don't like the math. I'm not a math guy. Uh but just know there is like some more research areas you can dive into specific to this. So your priority mapping, if you flip on your worksheets, um there is a disaster recovery plan tiers. Typically we put things into three tiers.

302You can use a different system if you want, but for the exercise today, we're going to use these tiers. So, Jefferson County, picking on them, sorry, not sorry to Jefferson County. Um, really struggled to understand what needed to come back first, who was going to make those decisions. Was the priority restoration of service? Was it restoration of learning or was it just restoration of any old system they decided to flip back online? So, to help build priorities, we put things into three tiers. Tier one are those absolutely critical mission essential business essential learning essential functions. What are the things that should not be gone more than 24 hours in the perfect scenario? Tier two are things you can live without for 24 to 72 hours and tier three are things you can live without for

303more than 72 hours. Right? So it's a small window for each. Um you might find in your plans a different set of timelines and windows works better. Just experiment with this for today. So again, tier one, most critical things you need to do to deliver on your mission. Tier two, things that are important, but you can live without them. Tier three, uh probably like the lunch menu, things you can sort of probably survive without. Um you must have some level of understanding and agreement of your mission like what is your critical deliverable? What either you responsible for deciding what is the most important thing that is delivered or your boss is deciding what is the most important mission? Again, is it learning? Is it return to learning? Is it return of critical services? Is it

304protection of data? Like you need to have that conversation if you haven't already. So your exercise, spend some time listing some of the critical systems. Keep your papers covered. Don't share because it's maybe sensitive. Um think through what is the maximum allowable downtime for each one. So if you list four of them, think through what is the maximum amount of time we can function without that that we're willing or capable of functioning without it. After you list them out, put them into the tiers and then for each one, who is responsible for that system and what dependencies does it have? If you have a system, for example, your SIS is entirely cloud-based. I would assume it is then dependent on internet access to function and be usable for you, right? So that becomes a dependency

305for that critical system. Think through what are the dependencies that some of these critical systems might rely on. And some of them might be dependencies that you don't own. might be a dependency from another agency. It might be a dependency from like the county you are in. Might be a dependency from a vendor you rely on. Just think through what are the critical dependencies for these important systems. Five minutes. Go. I see a lot of stressed faces already. No, some of the animations broke. Two of them didn't work. >> So, this man >> uh Yes, actually. We have [Music] time flies when you are having fun, right? So, I'm not going to ask anyone to please list me or announce all your critical systems because we don't need to share that too open. Uh, but

306did anyone did you find it useful to start thinking of what are my critical systems and how do they fall into some kind of tiered priority system? I see a number of hands. I see some yeses. I see some people actively aggressively avoiding eye contact. That's a okay. Uh, I'm going to blow through the break because you guys, you're adults come and go as you need. If you want to step out, want to use the bathroom, if you want to run away, that's fine with me. I don't care. You can't hurt my feelings. I'm from New York. Nothing can hurt my feelings. Um, so we're gonna move uh I'm going to do a setup and we're going to move into the decision maker simulation. This is going to be a little like loosey goosey like

307you're just going to get crazy injects and you're going to have to figure it out. Um, so you've got that IRP skeleton, you got that IRP matrix, you've talked, we've talked through the phases, you've got access to some cheat sheets online, you've thought through your tiers, you've got some other notes built into your worksheet there. You've got between what you have on paper, which you can get digitally and all the beautiful, intelligent people surrounding you, you've probably got everything you need to figure these out. I'm confident you will all do this better than Jefferson County, but we're going to relive the Jefferson County incident a little bit together. Right? The goal here is to practice decisionmaking. So, don't focus too much on like the nitty-gritty. Don't fight the scenario. If you're like, we don't have

308I don't have an EDR tool. This part doesn't apply to me. Just pretend you have one and go through the motions. The goal, you will have approximately five minutes per inject. Some might be longer, some might be shorter. It's going to be a little loosey goosey. Um, just remember with each inject, discuss, decide, document. That's the goal. Discuss what you know, what you need to do, decide what's going to happen, what actions are you going to take, and then document that. On the back of your worksheet, just a big sheet for notes, bunch of lines. So, if you want, if you need something to write on, you've got there. If not, I see a lot of you have notebooks and computers already. discuss, decide, document the most critical things we need to do in a

309critical incident. Just to level set, you're going to pretend it's today. It's Wednesday, October 22nd, but we're going to back the clock up. It's 6:00 a.m. in the morning, right? Bright and early. School's getting ready to start. Maybe it's starting already for some people. It's a balmy 71 degrees outside, mostly sunny. On the cafeteria menu, we got chicken sandwich, bean and cheese burrito, chef salad. Anyone excited for the bean burrito? Being a cheese burrito. No, I see a lot of notes. Um, Billboard top 100 today. Fate of a failure by Taylor Swift. Any Taylor fans? Any Swifties? I see a few who's French club is meeting today at 2:30 p.m. in the cafeteria. Friday, this coming Friday is Pat SAT day at your school. Do you all know what that means? Yes. I didn't know.

310I had to research. And cross country district finals are scheduled for next week. This is what's happening. This is all the information you have right now. At 6:00 a.m. in the morning, you start getting reports. Teachers are calling it. Google Classroom and student information systems won't load. I keep going to the thing. I keep trying to log in. I keep getting authent invalid credentials. Won't let me in. A bunch of staff are starting to report it as just, hey, I think the internet's out. I can't get to these systems. I can't get into Google. I can't get into the SIS. Internet's out. your tasks. Talk about what do you check first? What are the first things you're going to look at when you get these types of reports? What incident response phase are you potentially

311in? And how would you escalate this issue if you need to escalate it to someone else? Go. Remember, discuss, decide, document. [Music] Okay. [Music] All right. [Music] You're out. All right, new inject, new information. You are still working through your response. If you if you're still working through response and containment, keep going. You're still working on it. But now, additionally, the superintendent is calling. What's happening? How bad is it? They are demanding answers immediately. local news channel. You are hearing rumors that the local news channel is cold calling random faculty and staff asking for details on the incident, asking for any kind of comment. Major file servers cannot be reached using your remote management solutions or via remote desktop protocol. Um, and if you your remote management solution in fact is totally offline, you cannot

312remotely access any endpoints or systems at this point. What do you do next? What do you tell leadership and who drafts the message? And I'm so sorry if you're sitting next to your leadership. >> Go [Music] new information. An hour later, the great silence occurs. That wasn't for you. That's just the inject. Uh, email gateway totally offline. All emails across your enterprise, across your systems, all networks, stop. No more email communications. Any use of Outlook and Google is no longer functional at this point for email. Staff are still trying to email reports and issues. None of those emails are going through to it at all. Internal DNS queries are timing out internally as well. Students are now texting screenshots to each other of the ransom note that they somehow got and are posting crazy updates

313on social media um about what's going on. What do you do next? What are your alternate communication plans? Do you have primary alternate, contingent, and emergency communication considerations? And how does this impact what response, what technical response processes you're doing right now? Does this new information change anything? Are you in a place where you can keep chugging along without this impacting you at all? Discuss. Go. [Music] Administrative offices are now flooded with phone calls from worried parents. They are uh repeating a rumor they heard that hackers successfully stole tons of student records. They are calling to ask if sweet baby James had his data stolen. Um the SIS admin console completely inaccessible. Your firewalls, thank God, are still operational. But when you're checking the logs and the alerts, you see massive amounts of outbound traffic

314to an IP address in Melbourne, Florida. Anyone here from Melbourne, Florida? Any Oh, yeah. Did you steal all the data? Um, anyone here routinely do business in Melbourne, Florida? Would this be an odd thing or is it totally normal for your network? Um there is now a decision made by um school leadership to cancel classes for the remainder of the day. Throw all those kids on buses and get them out of there. What are you doing next? What phase of the what incident response phase are you in right now? You may have lost track as you're dealing with some of these injects. Rele set. What incident response phase are you in? How are you reporting technical updates to leadership? How are you keeping them in the loop on what's going on at this point? Um

315do you have a set cadence? We call it a battle rhythm sometimes. And then what message, if any, needs to go out externally? Are you going to respond to these rumors to parents? Are you going to publish something on Facebook? Are you going to put something on the website? Um what are you going to do, if anything, to communicate externally what's going on? Go. [Music] Your external website has been defaced with a copy of the ransom note placed on it. So now it's public display for everyone going to your website. Your initial attempts to restore some systems from backup fail due to some corrupted volumes. So now you got to double down and do some work there. A local TV crew is calling school district offices. There is a social media tag trending hack to

316school. What do you do next with this information? Do you confirm the incident publicly? Who decides if you're going to do that? What technical details, if any, would you share publicly at this point? Would you share anything about the incident? Would you acknowledge it? Would you say sought off? We don't care about the media. Go [Music] Two days later, you are still employed. You cannot leave. You cannot quit. You cannot walk away from this incident. The superintendent is demanding an ETA on when classes can resume. There are discussions happening internally on whether or not you should simply pay the ransom to get things back up and running or not. Partial restoration from clean backups was successful, but it's data from 5 days prior. So remember, we're two days into the incident. We have clean backups

317from 5 days prior. State and federal law enforcement have randomly arrived at your offices asking if they can provide any assistance or help with forensic imaging or potentially log analysis. They arrived, as we often sometimes do, uninvited and unsolicited. What do you do next? Do you even need law enforcement assistance? Have you potentially already called them at this point? What recovery estimate could you give, if any, with the information you have? How do you make that call? How do you make that guess? And what are the minimum services you need if the goal is resume learning? What are the minimum services you need, if any, to get learning back up and running? Or do those kids just get paper and told shut up, start learning? So go [Music] 60 sorry 60 hours later SIS and

318payroll systems are partially restored. You've confirmed reliable safe immutable clean backups. You did it. You found them. You're starting to restore all your endpoints. Your estimated ETA to full recovery is 24 to 48 hours. Your cyber insurance provider has reached out though and is now asking, can you please submit to our official uh secure portal copies of your incident response plan, proof that you have implemented multiffactor authentication on your enterprise and coverage list of where and if you have endpoint detection and response tools implemented. What do you do next that you're on the road to recovery? But now you've got this regulatory requirement. Can your school system produce any of these required documents at this point? Um, if you're restoring tons of endpoints, how many endpoints do you have in your system? How many endpoints

319are you responsible for? And how reasonably can you restore some percentage of them? Let's say 80% of them. Let's say 60% of them. Do you need more hands to do it? There was feedback before of one of the biggest shortcomings, one of the biggest pain points was not having enough people, not having enough physical presence to do work. If you had to do largecale restoration of endpoints, how many more hands do you need to do it or do you have enough? discuss. End of this decision maker simulation. Simulation over. End simulation. Um, think through Jefferson County encryption. Malicious encryption spread across,200 endpoints in 40 minutes. That's how fast their inspection, their infection moved. Email was offline for three days. SIS was down for eight days. No functional, reliable off-site backups. Recovery was rough. How would

320you fair in a similar scenario? What are the total number of assets and systems you're responsible for? And what's the worst case scenario? What's a high percentage? If a high percentage go down or if high percentage are impacted, what is that what does that mean for you? How do you handle major disruptions to communications? Does your instant response process still work if email is obliterated? If you cannot rely on email, how do you handle disruptions to critical services? Oh, I'm going to kill myself. Um, and do you have safe, functional backups? Safe, offline, separate, immutable, secure, use whatever combination of words you want. Do you have safe and secure backups that will not be compromised if your network is compromised? Those are the biggest differentiators if you don't want to be the next Jefferson County.

321So, we're going to do our own little hotwash. So, who found who experienced during this exercise, during the simulation pain points in the identification process? Do you feel like you would have run in a real world scenario, you would have run into some confusion or delays on clearly identifying whether or not an incident was happening or not? You just show of hands. I won't call on you. I see a few like Heidi hands. I call them. Um, who feels like they would have had trouble navigating the containment part? who feels like we would have had a lot of concern or confusion or lack of clarity at least on like how do we do contain containment at this scale for this type of incident. Show of hands. See a few more hands and I see a

322lot of waves. Hello waves. Um who feels like uh the priority like recovery prioritization um in your current state would be confusing or is still like up in the air? who feels like you still don't have a good idea of like your responsibility for recovery and how you prioritize it. I see a few hands. Any other takeaways? I won't call on you. I know we're we're wrapping up, so I'm trying to get you out a little early. Any other important takeaways? And remember, the takeaways you share are learnings for all of your peers. You are literally helping the school systems, the children of Virginia depend on you to share right now. So, who has something they would like to share, a learning experience? really tugging at the heartstrings, right? Anything you'd like to share? Something

323you got out of this experience, please? >> Talking to media. >> Yes. >> 100%. It's a great one that's overlooked a lot. We find most people don't have that consideration like anywhere documented. We were just talking to Meline who comes from education sector. She was saying, "I don't think I've ever been given that guidance or instruction in any type of scenario." Any other interesting tidbits, learnings, takeaways? >> Everyone feels that way. >> Great people, but not enough people. Not enough hands on deck when you need it or not enough hands- on deck on any given day perhaps. Any other lessons learned, critical takeaways, you so this you were able to sort of realize you could broaden your communication plan, who needs to be notified, who needs to be involved in some of those communications. Excellent.

324Any other interesting takeaways, tidbits, any insults? I'll take anything. >> Yes. >> Such a good answer. I wish I wish I could put it on a bumper sticker, but it would be really long. Um, yes, human securing. I think I had a slide at the very end and I took it out because it was like a little hokey, but it was essentially very similar to what you're saying that like human networks can trump secured networks. Essentially, if you have really good people planning and processes in place, you can navigate some of the worst scenarios. I worked for a huge company doing cyber security. We were um if anyone remembers victims of the not Petra ransomware attack which was a global disruptive ransomware attack cost billions of dollars in losses for tons of companies. My company

325should have been on that list of billion dollar losses. We were not. Not because our security was amazing. We had systems getting infected left and right. Uh we had an incredibly well-developed um and I did not develop it. I was just there when it happened. Uh, but we had an incredibly well-developed response plan that let us do containment, isolation, and recovery in what I call pizza rules. 30 minutes or less. As soon as a system was impacted, it was automatically isolated from everything. A ticket went to the help desk to issue that person a new computer. The computer was automatically reimaged with their last secure, safe backup, and that employee was back up and running in 30 minutes on a new computer with no issues. that dirty computer went in a pile and it either

326got thrown in the trash or wiped and restored and surplused probably. I don't know. But we had incredible planning in place so that when we did get hit, we had great processes to navigate an incident and ensure continuity. So, who here feels like today you outperformed Jefferson County or you could outperform Jefferson County today? Beautiful. I wish I could see more hands, but I love it. Um, my final takeaway for you all, your homework, my ask of you, and I will follow up with every single person in here if I have to. They'll give me a list of emails if I ask for it. Finalize, if you do not have an incident response plan, you have a bunch of stuff at your disposal to build one. So finalize your first rough draft of an instant

327response plan. If you already have one, dedicate some time to reviewing it and see what do you need to change, upgrade, or improve. Review your communications plan. Who notifies who, how, and when. That's what it needs to clearly convey. Think through those critical systems, the priorities of them, and the dependencies they have. And finally, test your backups. The fastest way to get through ransomware at the end of the day is nice, clean, immutable backups. Um, please, so many incidents could be um less. They could be insignificant in the grand scheme if the impacted organization had really good backups. We still see people who have no backups, people who have terrible backups, and people who have compromised backups. So investing in your backups is an investment in security and an investment in resilience. This is your

328homework in the next 60 days. If you don't do it, I will come find you. I swear I will make a police officer drive me to your place of work. You are done. You have survived. You have made it through the gauntlet today. You all are hopefully a little bit wiser, a little bit more prepared, or maybe just a little bit more agitated at the state. Either way, all of them are a win. and I'll take it. Thank you so much. You can contact myself and Meline up here. We live to serve you are. Our mission is to provide cyber support to state and local government. You are in that bucket. You are my customer. You are my stakeholder. If we can ever do anything for you, please reach out to us. If you would

329like to subscribe to the reports and intelligence that we produce, there's a link there as well. You copies of everything including the PowerPoint, the worksheet, and a bunch of extra goodies are in that digital QR code. help yourself. Share it with other schools if they're not here. Badger them the way I badgered you today. Thank you so much. We'll be around if you have questions, but really appreciate everyone's participation today. All right, I really want to give him another round of applause. That was very thorough. And listen, I know it can be mind-numbing. It's a lot of technical talk, a lot of deep work, but it's extremely important. Extremely important. All right. Uh, so here's our next steps for today. Okay. Um, we're going to go ahead and do our closing even though we're not

330done. There's one more event, one more session after this. Uh, but we're going to be dividing this curtain here because we're going to have two sessions. Um, of which, uh, John and I will be leading one on that side of the curtain over there. here. We're going to be going through and answering any questions, doing uh just round table um just chatting with with whoever wants to be in the session and um doing what we talked about earlier, right? Having that conversation, being there to support you. And when I when I say that, remember every one of us are in regions where we have um um support and if you need any support, reach out. reach out to your uh region uh chair um or you can reach out to me or John uh any

331of us we are happy to help and I and I promise you there is zero judgment if you call and you ask us hey how do you do this or how are you guys doing that okay and the reason I say that is we've been there right we were where you are okay so and we really want to help so if you have questions or concerns or issues that are going on please don't hesitate to reach out because I I promise you it'll be much better off if you ask and fix it before it becomes a problem. All right, so what we're going to do is we we're going to give away some prizes. Now, we are going to save two prizes for the very end. So, the we have an iPad and a ThinkPad

332we're going to give away at the very very end. Uh but for right now, we're going to go ahead and we're going to give away another 621 Nintendo. So, if we can spin the wheel, she had no idea she was going to be my assistant today. Mark Hudson, are you here? Mark, >> come on, Mark. This is probably too hard. I don't want to throw and hit somebody in the heads. Would y'all pass that back to Mark? At least it wasn't this table. Alrighty. How about anybody want a Yeti? >> I heard a That's good. All right. My wife saw this in a box and she's like, "Can I have it?" No. All right. Hit the ball. Awesome. All right. Remove and spin. You see what happens when you don't stay. Kelly need your assistance

333again. Could you pass it back to Greg? Right. All right. This is a wireless mouse, Bluetooth mouse. She almost missed me again. There you go. All right. And the final two that I'm have to give out and then John will be up in a second. We'll do the beats. All right. Uh, go ahead and spin again. She's actually one of our staff members. So, sorry, April. We didn't want to do staff and we didn't want to do seem rigged. Sorry. All right, Tim. All right. This is the Apple AirPod 3s. Just came out. Who wants it? A lot of a lot of hands up. All right. Good. If your hand didn't go up, you're not eligible. Here we go. Scott All right, Mr. Collins. >> Nice try, Scott, being on there multiple times. All right,

334we've got a couple more book bags. I've got uh three up here. Thank you, Vanna. Jason Hicks. Jason still here. There we go. All right. Scott Scott Lman. And the last one, >> Bill Carter. >> Congratulations, Bill. That concludes You know what? I've got one more. Let's spin it again. Y'all want to do one more? >> Yeah, let's do one more. >> All right, let's do one more. Okay. I think we got one more. >> It's another backpack. >> Taco George. >> There we go. Awesome. Let me grab it. You want to talk about those? >> Oh, yeah. >> What we're doing. >> Okay. So, that technically concludes VA CyberCon. Um, what we are going to do is we're going to take a 10-minute break and we're going to split the room in half. So,

335if you are interested in watching, uh, John Hammond do malware analysis and get into the nitty-gritty hacky stuff that he does. Uh, we're going to do that on this side of the curtain. If you're interested in roundt discussion, we're going to talk about some of those things that are the pressing issues, the big questions you all have, see how other districts are doing those things. We're going to meet over on that side. Uh break is going to be about 10 minutes while we get the the wall up. Uh and then our sessions after that are going to run about 40 45 minutes. Um but it's one of those cases where uh the bar is closing, you have to go home. Uh I I do have a closing slide that says really you need to go

336home. So anyway, uh, yep. And so one final thing. So we are going to send out a, um, a questionnaire for you guys. So as we said earlier, we we put a lot of work and effort into this conference, and we hope it's been beneficial to you. Uh, but we're going to send out a questionnaire to everybody that registered just to get some ideas. We want you to be honest. We want you to be critical of it because we want to learn from it as well. uh because we hope um that you know it'll be done again uh in the near future uh as we move along. So, and I will say anyone that's coming to mine and John's uh session over there, please when you come, we want engagement, right? Back and forth. It's

337not going to be the talking heads, John and I up there, right? It's going to be a lot of engagement back and forth because we learn from each other. Okay. >> Uh yeah. So, and then when that's done, we'll come back over to this side. Whoever still left, we'll do the final drawings for the iPad and the Secured Tech Lenovo laptop. So, other than that, thank you all for coming. It was a pleasure having you. I'd say look forward to next year, but we'll see. >> 10 minutes. >> All right, 10-minute break. [Music] Hallelujah. [Music] talk that I had this morning of just hacking training. And while I've been doing this whole silly YouTube thing for like a decade and a half, uh, we got to this thought where, man, yeah, okay, I know a

338lot of folks would like courses. They like more formal curriculum-like education on a lot of this practical hands-on ethical hacking, malware analysis, dark web dumpster diving stuff, all that in the whole wide world of cyber security. Um and one thing that I had done when I had brought a workshop to some other spots, this was for uh the Coast Guard for a little bit was um a workshop dedicated to scriptbased malware analysis. So malware, right? Malicious software, bad evil code, doing crazy stuff, info stealer, ransomware, blah blah blah. And I know that as a compiled binary like aexe, if you try to crack that thing open and try to understand what it's doing, sometimes it can get a little confusing and it can get a little intimidating when you rip it open to see assembly

339or like machine op codes instructions move x86 registers x64 ripex blah blah blah. So, uh, a fine in between is to hopefully try and bring some education and to get some more students and folks interested in that whole wide world of malware analysis, but looking at scripts or code that's a lot more human readable and a little bit easier to make sense of than just assembly lines and pages of all of that reverse engineering work that one might do, but making things a little bit more approachable. Um, so there is a just hacking training little exercise workshop thing that's out and about online. Uh, if anyone would like to follow along, I'm grateful. You certainly don't have to. We'll try to do some fireworks uh on our own, but learn.justacking.com justacking.com will bring us to

340the portal of all of the different things that might be available between things in Python and Golang and penetration testing and router firmware uh net exec for active directory environments etc etc but what we will do today for a little bit of time is that scriptbased malware analysis and I acknowledge that's got a silly price tag on it and I don't mean for that for you all uh so if you would like uh to jump into that workshop and if you want to play along or if any of your folks and friends or students might be interested, there is a code VA Cybercon SBMA for scriptbased malware analysis that'll let you into this thing for free. Uh I think that will expire at midnight tonight though. So again, if any of you are on your

341laptop, if you're curious, if you wanted to play along and just see what we could dig into, that's available for you. VA Cybercon SBMA. Um, but I'll show you what we have cooking and then we'll play along. So, this is kind of the usual interface for the simple just hacking training stuff. And it's trying to be friendly. It's trying to be something that's approachable and welcoming where I know we might get into topics that can be a little bit intimidating. Um, and just to give you a quick lay of the land before we dive into things, one of the coolest things that I've been so stoked about this platform is that look, you probably want to work inside of a virtual machine, especially if you're looking at malicious code, looking at malware. It should be

342in that sandbox isolated environment in a bit of a playground. Um, what we're able to do is attach or strap any sort of systems or virtual machines that you can connect to really easily within the browser or if you wanted to connect over a VPN and be virtual private network to access those machines. Um, for the nerds and geeks in the room that might be familiar with like try hackme or hack the box or some cyber range training exercises online, this is the liken to that idea. connecting to a VPN and then you can access each of those machines or connect over the browser. Uh so we'll open up a Windows virtual machine and then see what tools might be available to us and then we'll talk about a couple of the different things. Does

343that make sense? Okay so far. Sweet. Thank you. >> Uh and if folks would like that once again VA Cybercon SBMA and thank you. I appreciate that support. Uh, I know that's just oh, another spinning plate that I've kind of got going on, but um I hope it's fun. B A Cybercon S. So, if you were to connect and spin up a Windows virtual machine, that will bring you to something in your browser. Nerds and geeks. So, oh, sorry. Apologies. We'll make sure that is muted. Uh I for one like to connect over the VPN, the virtual private network. Uh because browserbased connectivity is nice and fun, but sometimes you get annoyed with different keystrokes, alt tabbing, control cv, copy paste, blah blah blah. Uh so I will RDP here and there. And forgive me

344if I have to toggle here and there to log in with the password, but that will be my DJ disc jockeying here. Um, inside of this machine and on the desktop, you'll see a lot of different tools that might be worthwhile for some of the investigations that you would go through. Um, of course you'll have regular Visual Studio if you're writing any code yourself or things for IL Spy to crack open some .NET assemblies, blah blah blah. But I know that's another rabbit. So, wanted to give you the lay of the land though as to what this thing looks like and we'll go back and forth with the material. So, when we're talking a little bit about malware and we're talking about some of the trade craft that hackers, thread actors, and cyber criminals use,

345I think gone are the days where they would have their own big payload bundled up all piled into one .exe uh that they just drop on an endpoint or a computer to do the damage that they do. Because more often than not that is signatured by antivirus engines by some security solution that could oh catch and see some of the bites some of the specific core components of that file that they say that's bad. I've seen that before. I know what that looks like and that is what will raise a flag, raise an alarm and okay now the hackers get caught. So one trick I think now in the modern age and we've been talking about this for some time a couple years but it's still very very prevalent is when hackers live off the

346land they use a lot of the tools that are naturally already installed or accessible on Windows the operating system the target environment like they're built in. So, you think of some utilities like I know Jason Blanchard was alluding to uh bits or bits admin, that background telemetry source download thing. I'll always forget that acronym, but I do know that's one of those techniques that some hackers could use to do some more postexloitation work. Um, if folks are not familiar with this resource, this is kind of a very cool catalog, archive, or big library of the different utilities that are just baked into Windows that might be able to allow someone to download another file like stage a payload or they'll bypass some application allow. Let's say, maybe they'll execute some other code. They'll smuggle in

347some data in alternate data streams. They can copy files. They can upload. They could encode or decode data. All of these things with some utilities that are just naturally accessible like in C Windows system 32. We might have already scrolled past, but there is our bits admin and how that could be used to maybe upload or download files or do anything clever. When you click into one of these, they'll show you some of the syntax, some of the actual code snippets that tell you how that's done and give you an example how that's used in an action. And they'll give you a little bit of description and let you explore the some of those. I put all this as this background context for you uh to know that this living off the land technique is

348really what hackers want to go for uh especially when they're designing payloads that use some scripting languages. They'll try to operate off of tooling that's already available there on Windows. So, if you're used to the command prompt, cmd.exe, big spooky black box, well, that could run batch or batch scripting or execute one command and then the next. You might be familiar with PowerShell, uh, the big blue box where, okay, maybe you'll automate, do some CIS admin tasks, but because that has so much power, C being a backing language behind it, you could do some shady stuff. But those are the two probably most easily well-known and I think we'll get to dance and play with those. But there are so many other options in the Windows world. Folks familiar with the hta file. Uh that

349is the hypertext application. One of the engines that will execute code even as if it were in your web browser like you're kind of browsing the internet but it's all local. It's on that host and on the endpoint. And that will allow that file naturally on your computer to run other languages. Something called JScript, something called VBScript, Visual Basic Script for some folks that might be tracking the history there. Or you might see some shady payloads just bundled into a Windows shortcut like an icon on your desktop. Um, that's an LNK file in Windows where it links from one thing to the next. pointing to that. And then you might find some other shadiness in C orn net files, maybe office macros in Microsoft Word, Microsoft Excel, and maybe folks are playing with other languages

350like Python or AutoIT, other tools and other capabilities that let you automate and streamline things, but they could just as easily be used for nefarious purposes. Um, I think for our play time, we'll probably just get into some of the batch and PowerShell stuff, but I did want to let you at least see some of the buffet assortment if there were anything else you were interested in. Um, and other nerds and geeks might be familiar with even more than this. Oh, what do we do when we're up against uh Lua code? Or what about if we see anything in Golang? Can they have any obfuscation or techniques where they'll hide and manipulate data? Could we beat any of that up without cracking open a disassembler like Dedra or IDA or Cutter or Adari 2? Lots

351of options, but we'll keep it simple and small and accessible with some scriptbased malware. Another couple of resources here for you though. Um, if you don't want to try and dig through all that code, if the static analysis method is too time consuming, which I know it might be for, hey, analysts or folks that are trying to triage, understand what a payload might have been doing, sometimes it's easier to just kick it into a sandbox. Sometimes it's something you'll want to do dynamic analysis for where you'll just let the malware run and then watch and see what it did. see what changes it made, see what it did in the registry, in the file system in connections that it made. Now, there are a handful of online sandboxes, uh, these quick and easy solutions that

352just let you pop a file in. You might be familiar with virus total, of course, and it has some little dynamic analysis engine, but there are a handful of others. Uh, I'm a huge fan of any.run run that gives you a kind of an interactive little display where you can click around and actually work inside of the virtual machine while it runs the malware for you and plenty of others. Maybe you've seen Joe's sandbox out on the internet or hybrid analysis things like that. All that is to say, you're running these in that isolated environments. you're playing with malware. Um, as like a security researcher, I am especially cognizant where I've got uh oh, okay, hundreds or thousands of malware samples, malicious files on a hard drive or in some little folder on my computer.

353And I don't always want Windows Microsoft Defender or Windows Defender to flag and eat and absorb all the malware that I want to look at for education's sake. But I am finding the balance so I don't accidentally infect myself or any of that strange shenanigans. Um, what I like to try and do is use an opposite operating system so I know that that code or that syntax won't detonate or it won't accidentally execute or invoke. Um, so if I know, hey, I'm looking at PowerShell code, well that's probably not going to run on Linux or the nerds and geeks that are familiar with Linux and those distributions or vice versa. Um, what I do like to do as just an added safeguard for myself is even simply rename or change the file extension to the

354end of a file like will naturally execute if I were to doubleclick on it like any other program. But if I said that were bad at the end or nal for malicious or nerf or whatever the case may be, then it won't register the program handler or the file executing thing with that. So that saves me in case I accidentally ever doubleclick at the wrong place or hit enter when I shouldn't have and I won't fire malware on my machine. small, tiny, simple tricks just to help protect yourself if you're doing some of that research and understanding what these samples are. Does that make sense? Yeah. Okay, cool. Thank you for letting me ramble. Let's talk about batch and cmd.exe. So, going old school, right? We could just straight up run cmd and that opens

355up the old command prompt. Maybe you all are used to, you've been doing some CIS admin work and um I don't know what commands you might be running day in and day out. Maybe you're oh be buffing around with cd to change directory diir to list file contents or pwd to see where you are etc etc. Um, batch or the language behind it and all the shell scripts is a whole like programming language, the scripting language, right? And with that you could execute any programs that have the associated file extension.bat. You've probably seen even com and cmd will fire off with that. So when you have malware or payloads and samples that try to stage things in batch, well they'll try because they know they don't have the shield of a compiled binary raw assembly.

356They'll obuscate the code and that means they'll manipulate and mangle and decorate with randomly named variables. long extra code that isn't necessary, but just to add extra noise and eventually confuse the end person, the user that's digging into this. Um, and you can do a lot of different things to do that to accomplish that. Couple different tricks. One of the very common ones, and I know this is so simple, but it will break signatures in an antivirus engine. Like if you had a malicious string, Mimiats mimicats.exe exe. I think Jason Blanchard alluded to that. One of the tools to oh dump passwords in a Windows host. What's to stop you from just chunking it up into different pieces? Super small tiny example, but since batch and other languages let you easily build out variables, let's

357just say the letter A means mean. And let's do that. set being the keyword to be able to declare a new variable. A super simple, you could choose whatever you want. That could be apple. That could be John. That could be anything really. Set it to one value. Maybe you build out another portion of what you're trying to hide and manipulate. And then aexe. So now you never literally have the string mimiats.exe, exxe, but you've chunked it up. And if you ever wanted to work with that value inside of batch here, normally you'll see percent signs wrapped around variable names to get that value. So if I were to echo out the value of a wrapping that around, easy, stupid, simple meaning. Okay, I think you get the gist, right? We could move on and

358now just sort of concatenate or put together all those chunks to get the full string or value mimic cats.exe small simple a- okay variables. So you could very well see that a lot in batch. And you might be able to do some more clever things though where you actually created variables that represented syntax. Does that make sense? Like I had the word set for each of these the keyword that I knew that I want to run. Maybe a space character just to maybe an equal sign to say one thing is equal to that. So what if this will start to look very weird. We set a variable random nonsense names and letters to the word set and then we used it those percent signs wrapping around it to now define something else be a literal

359space character and then set variable space character variable something else to be equal to an equal sign. So after those three lines of staging and preparation, now you've got a really stupid looking dump of nonsense, but now you could build out mimi cats or any other values you might like and just dumping it all here and there. Um, echo off. I don't know if you caught that little symbol on that note there. That's usually boilerplate in batch just to not show the commands that it runs as it's executed in a batch script. So, we could potentially peacemeal all of the variables and values that have been set and then we could try to see what maps to what maybe for every single possible character that could be printed on your computer or displayed and typed

360on the keyboard. It looks a little bit nonsense, right? but it will basically recreate the same syntax that was used to do any other accomplished task. Does that make sense? I know it's nonsense, randomly named variables, a lot of stuff in between those percent signs, but you're tracking so far. Silence means yes. So what you could then do is minify or try to compress and cram all that nonsense into one line. So this maybe if it were to try and display or echo or fire off running mimiccats.exe, you wouldn't know just by looking at this on its own, right? nor would your security operations center analysts, your junior technicians, maybe the folks that are exploring and seeing what malware really ran in our environment. Now, there are a couple other things you can do though

361um because these variables exist in your shell or in that command prompt and command line just as we've seen. Um, alongside those exist environment variables. Another easy idea. Okay, you're just putting something in a box. You're giving it another nickname for you to recall that data later with a different name. A like mimi, B for cats, whatever. But things that are specific to your computer might already be defined as environment variables. So when you're typing commands on the command line like diir or cd or who am I maybe those exist in your system path the programs that could be ran qu right off the cuff and that listing of oh your system path could be an environment variable and there are many others like oh different locations on your file system your users profile your

362application data directory or where programs exist computer host name details blah blah blah those like look like they have real values to them right cmd.exe exe or an absolute directory location. Those differ from nonsense of btpwj, right? So these stick out like a sore thumb when you run a command called set. And you might be thinking, oh wait a second, I we just saw set earlier when we were declaring or creating a variable. Well, if you don't give it any arguments, it'll just dump all the values and variables already available in your terminal session. So, just as a reference, if you let the code that you've seen and explored already run, you could see the variables that have been declared. And that is just one of the nuance things of batch. You might be able

363to catch a whole lot of other strange environment variables that are defined here, but it could mix in all of the other variables and values that are declared. You can see our A variable set there, RB variable set there, C, etc. mixed into the other things install available. Now, more nuance of bash and then I promise we'll I'll poke and play a little bit more. There is something called delayed variable expansion for folks that like to write scripts and automate stuff in this language in this command pop shell system language. There's a special syntax to turn that on. You might have seen at echo off previously, but some other boilerplate that you normally see at the beginning of scripts is set local enable delayed expansion. I got to be honest, you probably don't need to

364keep track of okay all the things that that would mean when valuable variables are determined at runtime as a script follows through. The gist though is that it could change or allow you to no longer reference variables by just percent signs surrounding it, but exclamation points surrounding changes the syntax just slightly. And maybe like you're familiar in other languages, if maybe in a viewer in Java or in C, other nerd things, you could also add comments in batch. Um, two colons is actually a kind of a hack. It's off of a label where normally you could define a go-to command to jump to another position in your code, but you just have a nameless label, two colons there to denote some data that you could fill in that isn't going to be executed as real

365commands or real code. But what's to stop you or some payload or malware having a ton of random colons and comments that do nothing that mean nothing but now you've bloated up a file to like 100 megabytes. So much so that all of those online sandboxes virus total any run Joe sandbox and all those quick easy buttons don't want to play with it anymore because the file is humongous and even if it's all just junk it's all just noise one thing that could get in the way and deter an analyst. So you might want to keep an eye on what those all might look like. Cool. Um let's explore some of the exercises here if that's okay now that we've ran through a little bit of conversations. So in the directory of our virtual machine

366I had tried to find and create a handful of folders that would include kind of sections for each of these languages that we'd explore and learn a little bit more about. Batch is where we could start. And you'll notice I have that simple small like MAL extension mal malware malicious just so I don't accidentally doubleclick on a batch script or some malware that might run. Right? Windows won't know what to do with this and it's not going to fire automatically. But it's all plain text. It's all a script. So, we could open that in a text editor like Notepad, Sublime Text, Vim Nano, if folks are in that Linux world. Uh, let me get into Sublime Text as just a text editor and we'll try and crack this open and see what this one looks

367like. Now, before I fall down the rabbit hole, uh, is there anyone that is familiar with batch and kind of the syntax in the language? Sweet. Thank you. May I lean on you? Could you help me walk through what this thing is, what this is doing? Could you make sense of it off the cuff in a moment? I'll turn word rap on for you if that's helpful. But I'll try and clean this up. And I'd love to ask, would anyone have a hunch as to what the heck this thing is? Yeah. Yeah. Sweet. Thank you so much. Well done. So, I know I threw us into like the lion's den, right? We just kind of jumped off a cliff. I'm sorry. Uh here's our at echo off little boilerplate little nonsense. So just a little

368decoration. So scripts won't display the commands as they're ran. But this type command is just displaying or outputting content out to the screen. Uh and our gentleman was correct in that look we had two arguments or two parameters, two files that followed suit after that type command. And it's interesting because they are displaying this zz whatever but then using this greater than symbol arrow waka waka to redirect that output and slap that into an executable file. So tiny clever cutesy thing. They just chunked up what we knew was eventually a valid file but just split it in half again. So antivirus engine. So your security solution is just kind of going to be scratching his head. What the heck is this ZZZ file, but when it's reconstructed from this payload that fires, okay, now it's

369something else. Now it's malicious. Now it's some damage that could be done. They fire it off and then this scheduled task orchasks.exe is looking a little bit weird. they just delete a previous scheduled task. Now, I'll admit, right, these are artifacts that will be from an incident, from an intrusion. So, we kind of just have to wonder what all the things might be as we make sense of it. We could presume maybe some other artifacts on that host or that computer had persistence. And when I say when I say persistence, I mean the hooks and claws that that malware or virus used to maintain access. But now they're cleaning it up. They're getting rid of it. They just deleted that task because I guess they're already running maybe whatever this file is. Romax is Trojan

370command and control info stealer ransomware could be anything, right? we have to go do our investigation as to what is that file. And then they get rid of those two little breadcrumbs they used. And then they delete this script. Cute little syntactic sugar here where they're actually going to clobber and remove this file itself. So these breadcrumbs, this whole script on its own doesn't come through. Okay. Tiny small snippet of malware, right? staging something else to execute. But now we'd wonder, your analysts, your technician, your folks thinking, what is M7HVM.exe? Right? Truth be told, I don't think we'll know quite yet, but that could be another exercise while we explore some of the other files that exist here. I will show you what some of the other nonsense might look like for batch. And this

371is when we get to some of that strange stuff. Let me uh set some colors here for us. And you can see they start to use that set trick or that set technique where they're just having nonsense set to other characters and values that they'll eventually tie together. some way somehow. But we could trace and follow through and sort of peacemeal one by one what do each of these values actually map to without getting too overwhelmed by all the random characters and nonsense here. And it's worth scrolling through the file and seeing what else they do. At the very end here, they're defining a chunked up piece of AWS, right? Maybe Amazon that they've defined with D1, DO2, other random nonsense. But we could see that all coming together if we tried to let that

372code basically run itself, right? We know maybe down below they'll start a download based off of that, but we don't want to run the download. We just want to see what's the real full URL that they're trying to access here. We could take just the snippet where it's combining all that together, getting an idea for what it is, and let's display it out. That included some uh double quotes in the mix. So, it's not super easy for us to read, but at least some more sense to it. Make that slightly less good. And what I'll do is I'll bring that into a tab in our text editor and then remove these double quotes here. Amazon S3 bucket, right? online cloud storage from some random thing out on the internet that they'll probably pull down as

373a payload to run and have it staged in potentially a startup location. We'd have to go trace and make sense of what that random variable would actually be. But it's staging in probably a dump.exe that we'd go back and trace. Now, you might be thinking, wait a second, this is apng file. at least according to that link. It It says it's supposed to be a picture, but then they save it as an .exe. Uh well, it's not both. It really is just an executable file, but they've just changed it. They just renamed it. They just said, "No, it's going to look like a picture." So that way, if you ever went to this link in your web browser, it wouldn't be able to load or display or see anything really. Some hackers might do this

374with zip files. or PDF documents uh where they'll smuggle in actual code but have it represented or at least renamed so it looks like big air quotes a JPEG picture PDF file a word doc but it's all make believe right you kind of need to pull back the thread and see what this all looks like for our finale for batch though if you're willing to entertain me Um, batch is one of those strange languages again in Windows that uh handles a lot of the encoding of characters. And I know we're going to fall down the rabbit hole a little bit here, but the way that you represent text in all the bits and bites of what's printed on the screen. Um, there's like UTF8 for a lot of those character representations. And there's even UTF7

375where you don't use the first bit in binary to display the 0 1 1 0 blah blah blah to display like the letter A or anything that you might display. So, if we play pretend knowing that everything that we read and see on the text of our computer screen is a lie, what if some malware payload looked like this? Would you believe me that this is totally real, valid, legitimate batch that could run and execute from your command prompt? Um, truth be told, it's just a different representation of a batch in the obuscated way. This is one of those things where you kind of need to have, okay, your technician, your analyst, your smart engineer having the experience and seeing this before because again, I know if you might just look at it, this isn't

376helpful. We can't make sense of this. If we were to flip and hot swap a lot of the bit obuscation areas, you could transform this right back to original readable code like we've seen previously. Cool. Thanks so much. Um I I I want to go track down where we might be able to go find that, but I think for the sake of time, let's pivot to PowerShell super quick, right? folks familiar with PowerShell probably using that for work here and there. I'm going to tell you a little bit of similar stuff uh because I think that's the easiest thing to latch on to here for us when we get into PowerShell. And there are some silly YouTube videos that are trying to tie this all together. Um PowerShell denotes variables differently with dollar signs and

377it's now PowerShell.exe exe rather than cmd.exe. And how you redirect data is no longer that arrow walka redirection symbol, but they pipe a lot of data back and forth. Um, when you get to use environment variables, they have a little prefix dollar sign env. Now, a lot of payloads that run with PowerShell, if you've ever seen them or you see some commands that ran from a malware intrusion or some other info stealer loader or stager, they have a lot of different switches to them. And you might have seen a TAC NOP or a TAC EP. Uh these are shorthand little nicknames for a lot of the different parameters or arguments or configuration switches that PowerShell could run with like no profile same as NOOP not interactive or an encoded command to mask and manipulate data

378in another representation execution policy that's that TAC EP that they bypass have any nerds geeks tried to run a PowerShell script and it said, "Oh, executing scripts is not allowed on the system. Change your execution policy to something else." Yeah, that is a not security boundary, right? Because Microsoft by default and Windows will say, "Oh, you shouldn't run PowerShell scripts unless you trust them and they are your own or you've got them from someplace you want." So, they have this execution pulse. You could set that to a special value like unrestricted or remote signed and then you could do what you needed to do to run your PowerShell script. Or you could just bypass it with literally execution policy set to bypass. Cool. >> Yep. Yeah, that's one of the neatest things and thank you

379for uh alluding to that because each and every one of these oh batch PowerShell Jcript BBScript whatever could chain from one to the next. Uh so if you saw that weird random Chinese characters obuscated stuff just a moment ago, well that could be stage one and then like a matrioska doll. There's another layer and another layer. stage two, stage three, stage four, stage five until they get building out all the puzzle pieces that they want to execute. There's a notion of encoded commands here. Uh base 64 that is one representation to display what would have been data otherwise in one format like we think of base 10. We counted our finger zero one two three up to nine. Maybe you said base two, right? That's binary zeros and ones. Um there is base 64 where

380you use all the characters of the alphabet, a couple numbers and some other special characters and then you can recreate what other data might look like. Um, and then batch or excuse me, PowerShell lets you really easily kind of index or grab just a specific character out of specific environment variables or any other variable. Right? So, when we were using this mimic cats.exe exe example. Um, what's to stop us from taking that old environment variable like app data we might have seen or all users profile whatever or comspec and we could carve out the specific characters or letters that might build just like we did in batch the set command or something that we could stage variables with toex. Does anyone know what ex is supposed to be? Invoke expression. So if I open up

381PowerShell, note that I have a PS prompt here. I know it's still a black window, but this is PowerShell. I could have a syntax of like oneplus 2, right? And that's some command or thing that I could execute and run. But what if I were to download something from the internet that weren't just that simple line? What if it were a string of data wrapped in quotes? Maybe like one plus two as the literal string. Haha. E dumb. ex or the handle nickname for invoke expression will take what is in string data that you can manipulate that you could uppercase lowerase jamble mumble up concatenation work that you've done before and then execute it or evaluate it as if it were real code. So invoke expression of the string 1 + 2 isn't just the

382literal character 1 plus sign 2, but it's actually executing it. So calc.exe could fire up the calculator literal string calc.exe. That's just the words. Those are the letters. That's that's how you represent it. But ex the nickname or the shorthand little handle alias for invoke expression fires the gun. Right? Please keep the calculator in mind as malware. Mimiats.exe. And there are a whole lot of other ways you could do this. There could be an amperand. You could wrap it in parentheses. And we discuss a little bit of some of those aliases in uh PowerShell. There are a lot of those and they can get a little bit complicated, but you could actually then use those kind of pieces of other variables where you get the letter I or you get the letter E or the

383letter X and then you could have small tiny snippets that don't look like those letters, but you could cram it all together to make the same similar sort of payload that you might have seen earlier. Uh let me grab this whole function here. So I'm pressing the I believe button. Here is some harness or cradle that will kind of manipulate that. So when we had pasting that all in what was that function obscate function say I wanted to run that calc.exe or a character map.exe exe or whatever my malware ransomware info stealer is here. Now I'm no longer just executing that. I'm executing this thing which looks like nonsense unless you try to piece it together. But firing the gun on that, I've executed my program. I've ran the code how I would like to.

384So you could try to manipulate this and use some format strings and use some environment variables here and there. Maybe you're looping in and out or finding and navigating out of things that could cause an error like raise an exception, try an accept block. Anyway, uh I want to speedrun us to one of the cool samples that kind of ties together all those little breadcrumbs that we've just worked with. Uh so let me get back to our virtual machine here. And if you weren't already happy with some of the fireworks so far, I hope this one will at least make us giggle. Um, here's our PowerShell directory. Let's back open up our text editor here and let's see what some of these look like just to get a feel for them. Here they're trying to

385pull with aliases IWR to invoke web request or pull down another file from the internet from paste bin or from paste. Something somewhere out externally that they stored a payload for us to pull down and execute whatever it could have been hiding up there replacing some strings to eventually get x. This one is the one I think that would be kind of fun for us though. Um, there's a giant try block at the very top and it's hidden because I just enabled word rap. If I turn that off, you might see a random string of nonsense. Noise, garbage, junk. Again, just to fill the space. But let me get to the goodness here. Knowingly, that will cause an error. So, that code won't execute. It's not real code. So, we fall down to this catch

386statement. We can ignore the other one because that won't really do much else. But then we have big random variable dollar sign prefix of a big long string that's eventually going to run through ex invoke expression and then decode the base 64 data. I'm going to take just this chunk and know that I'm going to remove this detonator here. I don't want IEEX to run. So, let me get rid of that. But let me just take however long this giant base 64 pile of nonsense is. Let me grab that line and then I will paste that all into PowerShell as if it could execute. But I know I've removed all of those problems there. I've defined that as a variable for me to be able to work with. And now I just want to let

387it unravel itself using the same syntax of that scripting language. I'm not going to let this detonate because we've removed the ex that invoke expression that you saw. So if I slap this in, I'm going to copy all this output. But you might be able to see, okay, this is starting to look like actual human readable code, right? This is this is PowerShell and not the nonsense that we just started with. A lot here. a lot of nonsense, but this is some fake Windows 10 key cracker that's actually a crypto miner. It's actually just going to download at the XMR rig and try to oh, use up all your resources, use your system TPU to disable the Windows Defender, set exclusion so your antivirus won't run it, and then all the silly, stupid, random variable

388names to hide and add a bunch of noise for them to keep mining cryptocurrency on your host. That's a slower way to make money rather than ransomware, but it still counts as malware, right? truly the the threat we deserve uh with cryptocurrency and all that. Now, I know a lot of this is silly. I know that's a whole lot of noise and nonsense, but thank you for letting me scroll through some of these strange shenanigans, the syntax and style that makes up some malware. But I hope you got to catch invoke expression. Hope you got to catch some variables. I hope you got to catch a little bit of scriptbased malware analysis. And I hope that was a little bit more approachable than digging through assembly and gedra or IDA. So with that, I'll turn

389it over to you all. Thank you guys. >> Thank you, John. All right. If the other group wants to come on in, we can get our last last two prizes. I might even have one more book bag. All right. So, what did y'all think of the final session? >> I think y'all missed a really good one next door, too. >> We did have a lot of great discussion. So, I appreciate everybody participating in that. I want to thank you guys so much for for being here. Yeah, we are putting this together. Our concern was going to do all the hard work. Thank you for your hard work. Thank you. say it it exceeded our expectations. I mean, we were like, dude, if we can get 100 people, but we're going to book it. We're going

390to plan for 150, right? We ended up having 180 180. So, I think that's phenomenal. Again, I do want to extend a huge thank you to John, to Joe, and the rest of our team behind the scene for all the effort and work they put into it. Just phenomenal. We certainly couldn't have done it without and you guys are being here going through some of this stuff. It is slow, a lot of fun in response, but critical So hopefully as I said in my opening remark you pick one thing at least one thing that you're going to take away from here today. And if you did that in my opinion this is you can prevent one more attack one more time. >> I want to say a huge thank you to our partners. I know

391that you go to I go to conferences all the time and they talk about partners and sponsors and I always go whatever um they're just looking for content. I will say uh every one of the partners that did something here today was all donation. They they truly did see the need and they every single one of them said we want this to be about you not us. So I'm just trying to extend that back. So if you are interested in any of their things, please please please reach out to to one of the the companies. Um we had high ambition when we started this and didn't really have a lot of experience with what something like this might cost. Um and if any of you have budgets like ours, uh it was not really doable.

392Uh we we originally said no sponsors, no sponsors, and that's not feasible, especially at this scale. So, uh, again, a huge thank you to them and to you all for coming. Uh, this is as successful as as it is because of you. So, um, thank you. Don Hammond's a nerd. I just wanted to say that. I was looking at some of his stuff going, "Does he read Chinese?" Like, I just Anyway, um, but, uh, that was really cool. >> You know, if he stalks you, right? >> Whatever. Anyway, um, but we do have a few more things to give away and we do want to say thank you. Um, and when you get the uh followup uh email that says, "Hey, here's a survey. I promise we're not trying to fish you." Number one, and

393number two, don't trust any cables any of us give you. And number three, please take just a minute to fill it out. That would be really helpful for us. Uh, so thank you. So, all right. iPad. >> Absolutely. Well, they could. >> You get about six seconds to say I'm here. Maybe we should just write down the people's names of might be fast. >> I'm thinking of a number. All right, let's do another uh >> deserved. >> We'll do another backpack and then we'll do the big pack. If you really wanted the laptop, I'm sorry. Uh they could be I not >> this been brought to you by You guys can't see the ads up here. I can't. Thank you all for bringing your superintendent, IT directors. We really appreciate and superintendent, thank you for

394being [Laughter] right. >> All right. So again, this this is a Lenovo laptop through Secured Tech. Uh they're a reseller partner here in Virginia. >> What's in the back? Yeah. All right, John. You got any more hidden backpacks? >> I don't know. Let me look. >> You do have another one. I got another one. They just keep coming. They're multiplying in the box. All right. Feel easy for people that aren't here. I'm here. Oh, that's a to go back and tell all these people what they lost. >> Everyone on the phone >> next year Oh yeah. Next time you don't get to leave until standing room only. >> There we go. All right. >> All right. All right. Well, that does officially conclude 2025. Thank you. Can't say thank you enough. >> Yep. Thanks. >>

395Thank you.