Selling your Information Security Team Part 7

Now for the Fun Hacker Ninja work: the Attack VM.  We will use an OS designed for penetration testing that has the tools and a framework to make this job easier: Kali Linux.  We’ve already built a vulnerable Victim VM, so we will take advantage of known vulnerabilities in that build.  This is the build I had the most fun with!

Onward with the Attacker VM.  In order to make the attack sequence easier during a presentation, everything will be scripted.  The best tool for that in Kali Linux is Metasploit.  Each phase of the Cyber Kill Chain introduced at the beginning of the series will have it’s own Metasploit script and will use it’s own set of ports so we can clearly separate each phase for our audience.  Things will be much clearer in the final post wrapping up this series, but for now, onto the fun.

Continue reading “Selling your Information Security Team Part 7”

Selling your Information Security Team Part 6

If you are followed this series so you can present a similar demonstration, this VM will be used by the audience member that volunteers to be the victim.  We are not going to patch it so we can take advantage of some vulnerabilities that exist in the SP1 build.

We are on to building the Victim VM.  This VM will be built with Window 7 SP1 32-bit.  Be aware that when SP1 was released, these vulnerabilities were either not known or were later zero day discoveries.  More on the vulnerabilities in SP1 later during the post on the attacker VM.

Continue reading “Selling your Information Security Team Part 6”

Selling your Information Security Team Part 5

Splunk Enterprise is the center piece of this entire demonstration. Clear visual indicators will let your audience know when things have gone bad during the attack demo. This is where we will build that center piece and the dashboard that will be used during the demonstration.

The center piece of this demonstration is the Splunk Dashboard.  The idea is to provide clear indicators when things are good (green) or bad (red) during the demo.  In Part 1 we discussed the Cyber Kill Chain in 4 phases, so we will build a Splunk Dashboard that shows those 4 phases clearly.

Continue reading “Selling your Information Security Team Part 5”

Selling your Information Security Team Part 4

Now it’s time to build the Swiss Army Knife of the demonstration: The Utility VM. This system will host the Snort IDS, the WebMail service and the cornerstone of the demonstration: the Splunk Service. In this part, we walk through installing the OS, Snort and WebMail.

Continuing the series on Selling Your Information Security Team, it’s now time to start building the Utility Virtual Machine that will host all the support programs and applications used in the demonstration.  This post will cover building that very importation Swiss Army Knife of the demonstration … the Utility Virtual Machine.  In Part 2 of this series, we built the host environment and defined the two networks joined by the firewall.  Then in Part 3 we build the firewall to join the previously defined networks together.

Continue reading “Selling your Information Security Team Part 4”

Selling your Information Security Team Part 3

Building on the framework that was designed in the previous posts, we are now ready to start creating our first Virtual Machine: the Firewall. This VM will join the two networks together and form the keystone of the demonstration before the Board of Directors.

As I continue this series on Selling Your Information Security Team, it’s now time to start building the Virtual Machines that will be used in the demonstration.  This post will cover building the keystone of the demonstration … the Firewall Virtual Machine.  In Part 2 of this series, we built the host environment and defined the two networks joined by the firewall.

Continue reading “Selling your Information Security Team Part 3”

Selling your Information Security Team Part 2

In this installment of “Selling your Information Security Team”, we discuss recommendations for your host computer and installation of Virtualization Software. We define the network types we will use and reveal what the virtual network layout will look like. Prepare to WOW your Board of Directors!

In the previous installment of this series, we discussed how Information Security can be similar to insurance … it’s only discussed when bad things happen, and it’s rarely a revenue generating center.  We also talked about how one might show return on investment in the Information Security Team.  Finally we walked through a four phase Cyber Kill Chain that could be used to simplify a complex demonstration of Information Security that could be presented to non-InfoSec managers and Board of Directors.  In this part of the series we will install Virtualization Software for the Virtual Penetration Lab that will be the foundation of our demonstration to the Board of Directors.

Continue reading “Selling your Information Security Team Part 2”

Selling your Information Security Team

How often have you had to argue or prove the value of your Information Security program to management? Here is an innovative way to do just that (without arguing).

Information Security can be similar to insurance … it’s only discussed when bad things happen and it’s rarely a revenue generating center.  So how does one show return on investment?  I was recently asked to do just that by participating in a presentation to our Board of Directors.  Senior management wanted to show off the new security operation center and the SOC team to the board.  My first thought was: <sarcasm>That is a great idea … they can walk through a SOC and see all the “Security Bling” screens on the wall.</sarcasm>  But after brain storming with the team, we actually came up with a great idea that I will be writing about over the next several weeks.

Continue reading “Selling your Information Security Team”