The world that is emerging from our electronic interactions needs a lot of patches. It’s growing and in need of constant adjustment, reconfiguration, and stabilization. For my part, this week was dedicated to learning how to hide, lure, track and trap bad guys for 4 days and a total of 16-hours of training on Active Defense and Cyber Deception with Black Hills Information Security. This was one of three courses they offer for the very affordable price of pay-what-you-can. Don’t let the generosity fool you. John Strand provides these courses as a mission. He believes we are all far behind in the cyber security game and there is lots of ground to make up. After 15 years as a SANs instructor, he has lots of value to offer. Plus, his energy is contagious. He does seem to truly be possessed with a desire for the greater common good we all share.
What did I learn? Illusions, traps, and other cyber-bending ninja-detective tricks. Unfortunately, a good cyber-sorcerer-ninja-detective never reveals the mechanics of their tricks (that’s not true, they don’t mind sharing at all).
1st day was strategy and defining what active defense is and isn’t. It’s not waiting for the SIEM (monitoring system) to tell you something is wrong. The SIEM is designed to find threats that are known. We are looking for very sneaky people. They will find a new way in, something the SIEM can’t detect.
The key to stopping the attacker is understanding the path of the prey. Where do they need to go? Know this and you know where to lay the traps that suck up their time. The illusions that lead them down the wrong rabbit hole to infinite nothing. And this may be the key takeaway. Make it a time suck to mess with you. Make it not worth the hassle to hustle ya.
Show’em something pretty. Something they have to look at. Delay them, obfuscate the prize, and frustrate their basic efforts. Don’t be the low-hanging digital fruit, just dangling out on the internet waiting to be easily exploited.
How do you slow them down? Honey, and lots of it. Your main weapon is a long list of honey: honey-pots, honey-servers, honey-networks, honey-users, honey-files, and yes Honey Badger! What are all these honey-techs? They’re big fake data burritos wrapped in alerts, stuffed with traps, and trackers. These techniques and tools draw the attacker into a fake world with sweet-looking data. A juicy-ripe text file with a bunch of sexy financial information and contacts that can’t be resisted.
2nd day we talked about the legal issues that come with the territory. This is a whole new frontier as far as the law is concerned. Stand-out thought is how far behind the legal concepts of property and privacy are in relation to the digital dimensions of our lives. It’s an 8-bit paradigm trying to govern an Oculus world. It would do me some good to study up search and seizure law. The question to answer: when are you a detective and when are you the interloper violating someone’s rights?
Day 3, the slide reads “Don’t Get Shot!” and the class focuses on your safety as an investigator. As in, you may find yourself dealing with bad people. You might play a big part one day in locating said bad people and putting them in prison. Sometimes bad people hold grudges. You don’t want your name on anything bad people can reference. You want to be a ghost, a shadow warrior. That’s right, John added to my practical knowledge of how to make people disappear and attack from the shadows. Always happy to add a little more ninja to my bag of tricks.
Day 4, how far does defense go until it becomes offense? We learned techniques that trapped our network baddies in infinite loops that “inadvertently” shut down their systems. Is that wrong? Well, it’s complicated. How far is too far depends on your warrant and what 3-lettered agency is writing the check. But that’s the justice side. Maybe you’re not working for the government. What about private clients? What would you do for the cash? What wouldn’t you do for cash?
In some cases, your client might not be interested in taking any of this to court. As in, they aren’t concerned with the legality of your work and whether it might stand up in court. That’s when you have to decide for yourself what kind of InfoSec operator you are. Are you a mercenary, a kinda cyber-gun-for-hire? Or are you going to be an agent of justice? Or chaotic good and you just can’t help yourself because of some twisted extreme perceptions of fair and foul play? Or maybe your just smart enough not to get involved in clandestine cyber-pissing contests.
It’s easy researching and studying security to get paranoid; to think that there is a never-ending wave of threats. And while that might be true, there are ways to limit vulnerability. For a business or an individual, it’s not that difficult to avoid being easy pickings. Remember you don’t have to be faster than the bear, just faster than the rest of the campers when the bear arrives.
My CompTIA Security + certification test is coming up in a few weeks. Time to buckle down and memorize an ocean of acronyms, hashes, ports, and protocols. But while that test is important, my mind will still be on the terrors of a Spider Trap and the devious capacities of Honey Badger. I look forward to building a digital hall of mirrors and digging cyber-tiger traps filled with my own assortment of deadly links. That’s right folks, two can play at the sneaky link game. Actually, we should all be learning how the game is played.
After all, ya got be a cyber-sorcerer-detective-ninja to catch a cyber-sorcerer-ninja.