SANS Information Security Reading Roomhttps://www.sans.org/reading-room/Last 25 Computer Security Papers added to the Reading RoomKohanaPHPBug Bounty Programs: Enterprise Implementationhttps://www.sans.org/reading-room/whitepapers/application/bug-bounty-programs-enterprise-implementation-38250Bug bounty programs are incentivized, results-focused programs that encourage security researchers to report security issues to the sponsoring organization. These programs create a cooperative relationship between security researchers and organizations that allow the researchers to receive rewards for identifying application vulnerabilities. Bug bounty programs have gone from obscurity to being embraced as a best practice in just a few years: application security maturity models have added bug bounty programs and there are standards for vulnerability disclosure best practices. Through leveraging a global community of researchers available 24 hours a day, 7 days a week, information security teams can continuously deliver application security assessments keeping pace with agile development and continuous integration deployments complementing existing controls such as penetration testing and source code reviews. Wed, 17 Jan 2018 00:00:00 +0000Container Intrusions: Assessing the Efficacy of Intrusion Detection and Analysis Methods for Linux Container Environmentshttps://www.sans.org/reading-room/whitepapers/detection/container-intrusions-assessing-efficacy-intrusion-detection-analysis-methods-linux-container-environments-38245The unique and intrinsic methods by which Linux application containers are created, deployed, networked, and operated do not lend themselves well to the conventional application of methods for conducting intrusion detection and analysis in traditional physical and virtual machine networks. While similarities exist in some of the methods used to perform intrusion detection and analysis in conventional networks as compared to container networks, the effectiveness between the two has not been thoroughly measured and assessed: this presents a gap in application container security knowledge. By researching the efficacy of these methods as implemented in container networks compared to traditional networks, this research will provide empirical evidence to identify the gap, and provide data useful for identifying and developing new and more effective methods to secure application container networks Sat, 13 Jan 2018 00:00:00 +0000Looking Under the Rock: Deployment Strategies for TLS Decryptionhttps://www.sans.org/reading-room/whitepapers/dlp/rock-deployment-strategies-tls-decryption-38240Attackers can freely exfiltrate confidential information all while under the guise of ordinary web traffic. A remedy for businesses concerned about these risks is to decrypt the communication to inspect the traffic, then block it if it presents a risk to the organization. However, these solutions can be challenging to implement. Existing infrastructure, privacy and legal concerns, latency, and differing monitoring tool requirements are a few of the obstacles facing organizations wishing to monitor encrypted traffic. TLS decryption projects can be successful with proper scope definition, an understanding of the architectural challenges presented by decryption, and the options available for overcoming those obstacles. Sat, 13 Jan 2018 00:00:00 +0000Digital Forensic Analysis of Amazon Linux EC2 Instanceshttps://www.sans.org/reading-room/whitepapers/cloud/digital-forensic-analysis-amazon-linux-ec2-instances-38235Companies continue to shift business-critical workloads to cloud services such as Amazon Web Services Elastic Cloud Computing (EC2). With demand for skilled security engineers at an all-time high, many organizations do not have the capability to do an adequate forensic analysis to determine the root cause of an intrusion or to identify indicators of compromise. To help organizations improve their incident response capability, this paper presents specific tactics for the forensic analysis of Amazon Linux that align with the SANS Finding Malware Step by Step process for Microsoft Windows. Sat, 13 Jan 2018 00:00:00 +0000BYOD Security Implementation for Small Organizationshttps://www.sans.org/reading-room/whitepapers/mobile/byod-security-implementation-small-organizations-38230The exponential improvement of the mobile industry has caused a shift in the way organizations work across all industry sectors. Bring your own device (BYOD) is a current industry trend that allows employees to use their personal devices such as laptops, tablets, mobile phones and other devices, to connect to the internal network. The number of external devices that can now connect to a company that implements a BYOD policy has allowed for a proliferation of security risks. The National Institute of Standards and Technology lists these high-level threats and vulnerabilities of mobile devices: lack of physical security controls, use of untrusted mobile devices, use of untrusted networks, use of untrusted applications, interaction with other systems, use of untrusted content, and use of location services. A well implemented Mobile Device Management (MDM) tool combined with network access controls can be used to mitigate the risks associated with a BYOD policy. Fri, 15 Dec 2017 00:00:00 +0000SOC Automation-Deliverance or Disasterhttps://www.sans.org/reading-room/whitepapers/threats/soc-automation-deliverance-disaster-38225Learn how to strike a balance between security alerts that can be automated with minimal impact and the higher-risk alerts that need to be handled by analysts. Mon, 11 Dec 2017 00:00:00 +0000The Effectiveness of Tools in Detecting the 'Maleficent Seven' Privileges in the Windows Environmenthttps://www.sans.org/reading-room/whitepapers/sysadmin/effectiveness-tools-detecting-maleficent-seven-privileges-windows-environment-38220Windows privileges add to the complexity of Windows user permissions. Each additional user added to a group could lead to a domain compromise if not evaluated. Privileges can override permission causing a gap of perceived effective permission. Currently, system administrators rely on tools such as Security Explorer, Permissions Analyzer for Active Directory, or Gold Finger help with this problem. An analysis of these three tools that are supposed to help with permissions is needed to provide administrators a window into these complex effective permissions. The results of this research discovered a gap in identifying users with privileges with the current tools available. This gap was filled by the author by using powershell. Tue, 05 Dec 2017 00:00:00 +0000 Minerva Labs: Using Anti-Evasion to Block the Stealth Attacks Other Defenses Misshttps://www.sans.org/reading-room/whitepapers/analyst/minerva-labs-anti-evasion-block-stealth-attacks-defenses-38215Attackers routinely use evasion to evade baseline anti-malware tools and ultimately compromise endpoints. How can enterprises prevent such intrusions without relying on after-the-fact detection? This paper explores a unique approach to preventing evasive malware from infecting endpoints, using Minerva's Anti-Evasion Platform to automatically block threats without ever scanning files or processes. SANS Reviewer Eric Cole, PhD, shares his findings regarding the ability of Minerva's Anti-Evasion Platform to block such evasive threats.Mon, 04 Dec 2017 00:00:00 +0000Security and Operations - An Overlooked But Necessary Partnershiphttps://www.sans.org/reading-room/whitepapers/bestprac/security-operations-overlooked-partnership-38210This paper explores ways to foster cooperation between Security and Operations groups for better visibility into threats and threat pathways, while improving overall protection and network hygiene. Mon, 04 Dec 2017 00:00:00 +0000Who's in the Zone? A Qualitative Proof-of-Concept for Improving Remote Access Least-Privilege in ICS-SCADA Environmentshttps://www.sans.org/reading-room/whitepapers/scada/zone-qualitative-proof-of-concept-improving-remote-access-least-privilege-ics-scada-environments-38205Remote access control in many ICS-SCADA environments is of limited effectiveness leading to excessive privilege for staff who have responsibilities bounded by region, site, or device. Inability to implement more restrictive least-privilege access controls may result in unacceptable residual risk from internal and external threats. Security vendors and ICS cybersecurity practitioners have recognized this issue and provide options to address these concerns, such as inline security appliances, network authentication, and user-network based access control. Each of these solutions reduces privileges but has tradeoffs. This paper evaluates network-based access control combined with security zones and its benefits for existing ICS-SCADA environments. A Proof-of-Concept (PoC) evaluates a promising option that is not widely known or deployed in ICS-SCADA. Mon, 04 Dec 2017 00:00:00 +0000Updated: Out with the Old, In with the New: Replacing Traditional Antivirushttps://www.sans.org/reading-room/whitepapers/leadership/updated-old-new-replacing-traditional-antivirus-38200This updated version of the 2016 paper that included the SANS guide to evaluating next-generation antivirus provides the background information organizations need to assist them in their efforts to procure next-generation antivirus. Review this document to establish your overall road map and help resolve any questions you may have on the procurement process after reading the companion piece: "SANS Step-by-Step Guide for Procuring Next-Generation Antivirus".Fri, 01 Dec 2017 00:00:00 +0000NGAV RFP Evaluation Master Templatehttps://www.sans.org/reading-room/whitepapers/firewalls/ngav-rfp-evaluation-master-template-38195Click on the link in this file to access the Excel spreadsheet designed to help you compare the vendors from whom you have collected RFP information.Thu, 30 Nov 2017 00:00:00 +0000NGAV RFPhttps://www.sans.org/reading-room/whitepapers/leadership/ngav-rfp-38190This document is a standalone RFP for selecting a next-generation antivirus (NGAV) solution. For more information on how to procure NGAV, be sure to access the Step by Step Guide for Procuring Next-Generation Antivirus. Thu, 30 Nov 2017 00:00:00 +0000Step by Step Guide for Procuring Next-Generation Antivirushttps://www.sans.org/reading-room/whitepapers/analyst/step-step-guide-procuring-next-generation-antivirus-38185This document outlines a procurement process you can use and customize when upgrading to NGAV. The key steps to successful procurement do not change and should apply to any NGAV procurement project. Thu, 30 Nov 2017 00:00:00 +0000Hacking Humans: The Evolving Paradigm with Virtual Realityhttps://www.sans.org/reading-room/whitepapers/testing/hacking-humans-evolving-paradigm-virtual-reality-38180Virtual reality (VR) systems are evolving from high-end gaming and military applications to being used in day-to-day business operations and daily life. Cyber security professionals must begin now to prepare proactive threat analysis and incident handling plans that cover information systems and users. Previous compromises illustrate the devastating effects malware can have on the confidentiality, integrity, and availability of information systems. These disastrous consequences may be transferred directly to the user given his or her perception of events. Even in the early stages, VR represents a new paradigm within the information age. Today, users view information systems through a monitor that acts as a window into a virtual environment. Within VR, a user may become completely immersed while absorbing information from all five senses. VR represents a dichotomy that adds a potential human component to an information system compromise. This research project examines offensive tactics, techniques, and procedures, then exploits and extrapolates them to a compromised VR system and the user to illustrate the hazards associated with VR. Wed, 22 Nov 2017 00:00:00 +0000Data Mining in the Dark: Darknet Intelligence Automationhttps://www.sans.org/reading-room/whitepapers/threatintelligence/data-mining-dark-darknet-intelligence-automation-38175Open-source intelligence offers value in information security decision making through knowledge of threats and malicious activities that potentially impact business. Open-source intelligence using the internet is common, however, using the darknet is less common for the typical cybersecurity analyst. The challenges to using the darknet for open-source intelligence includes using specialized collection, processing, and analysis tools. While researchers share techniques, there are few publicly shared tools; therefore, this paper explores an open-source intelligence automation toolset that scans across the darknet - connecting, collecting, processing, and analyzing. It describes and shares the tools and processes to build a secure darknet connection, and then how to collect, process, store, and analyze data. Providing tools and processes serves as an on-ramp for cybersecurity intelligence analysts to search for threats. Future studies may refine, expand, and deepen this paper's toolset framework. Fri, 17 Nov 2017 00:00:00 +0000Leverage Risk Focused Teams to Strengthen Resilience against Cyber Riskshttps://www.sans.org/reading-room/whitepapers/recovery/leverage-risk-focused-teams-strengthen-resilience-cyber-risks-38170Information security, risk management, audit and business continuity teams must continue to evolve and mature to combat the growing cyber risks impacting business operations. Each team has standards and frameworks, but they often dont speak the same language or understand how each group intersects in protecting the organization. This research identifies opportunities to reduce resource duplication and integrate information security and risk-focused teams to strengthen the organizations resilience against cyber risks. Fri, 17 Nov 2017 00:00:00 +0000The State of Honeypots: Understanding the Use of Honey Technologies Todayhttps://www.sans.org/reading-room/whitepapers/detection/state-honeypots-understanding-honey-technologies-today-38165The aim of this study is to fill in the gaps in data on the real-world use of honey technologies. The goal has also been to better understand information security professionals views and attitudes towards them. While there is a wealth of academic research in cutting-edge honey technologies, there is a dearth of data related to the practical use of these technologies outside of research laboratories. The data for this research was collected via a survey which was distributed to information security professionals. This research paper includes details on the design of the survey, its distribution, analysis of the results, insights, lessons learned and two appendices: the survey in its entirety and a summary of the data collected. Fri, 17 Nov 2017 00:00:00 +0000Cyber Defense Challenges from the Small and Medium-Sized Business Perspectivehttps://www.sans.org/reading-room/whitepapers/hsoffice/cyber-defense-challenges-small-medium-sized-business-perspective-38160With 5.7 million SMBs in the United States, it is essential that the risks involving cybersecurity events are identified. Small and medium-sized businesses (SMBs) face different challenges than large enterprises in regard to cybersecurity. The goal of this project was to survey SMBs and reveal organizational barriers that impact the cybersecurity posture of SMBs. An online survey was administered with a final sample size of 22 SMBs. Significant results showed that the top challenges were finances to pay talent, regulatory compliance and professionally available talent. As a result of inadequate information technology (IT) and cybersecurity staffing, 64% of respondents were unaware if a successful cyber-attack had taken place. The significant challenge SMBs face is their security posture and knowing if they have been or are being targeted against a cyber-attack. The main objective of this project was to show the security profile of the typical SMB. Educational, software and hardware tools should be promoted to increase the security posture of SMBs. Further research might focus more on the staffing and dedicated hours of IT and cybersecurity employees.Fri, 17 Nov 2017 00:00:00 +0000Exploring the Effectiveness of Approaches to Discovering and Acquiring Virtualized Servers on ESXihttps://www.sans.org/reading-room/whitepapers/bestprac/exploring-effectiveness-approaches-discovering-acquiring-virtualized-servers-esxi-38155As businesses continue to move to virtualized environments, investigators need updated techniques to acquire virtualized servers. These virtualized servers contain a plethora of relevant data and may hold proprietary software and databases that are relatively impossible to recreate. Before an acquisition, investigators sometimes rely on the host administrators to provide them with network topologies and server information. This paper will demonstrate tools and techniques to conduct server and network discovery in a virtualized environment and how to leverage the software used by administrators to acquire virtual machines hosted on vSphere and ESXi. Fri, 17 Nov 2017 00:00:00 +0000Cyber Threat Intelligence Support to Incident Handlinghttps://www.sans.org/reading-room/whitepapers/threatintelligence/cyber-threat-intelligence-support-incident-handling-38150Recent research has shown increased awareness of Cyber Threat Intelligence (CTI) capabilities. However, CTI teams continue to be underutilized and have had difficulty demonstrating the value they can add to digital forensics incident response (DFIR) teams. Meta-analysis of multiple surveys will identify where the gaps in knowledge exist. The paper will suggest how CTI can support DFIR at each level of intelligence and operations tactical, operational, and strategic and during each phase of the incident response lifecycle preparation; detection and analysis, containment, eradication, and recovery; and lessons learned. CTI teams should have priority intelligence requirements (PIRs) and a collection plan that supports answering those PIRs. In return, DFIR needs to share investigations and incident reports with the CTI team to reduce risk to the organization, decrease the time to detect an incident and decrease the time to remediate an incident. This paper builds on previous work by the author to develop CTI processes to support CTI planning. Fri, 17 Nov 2017 00:00:00 +0000Tackling the Unique Digital Forensic Challenges for Law Enforcement in the Jurisdiction of the Ninth U.S. Circuit Courthttps://www.sans.org/reading-room/whitepapers/legal/tackling-unique-digital-forensic-challenges-law-enforcement-jurisdiction-ninth-us-circuit-court-38145The creation of a restrictive digital evidence search protocol by the U.S. Ninth Circuit Court of Appeals - the most stringent in the United States - triggered intense legal debate and caused significant turmoil regarding digital forensics procedures and practices in law enforcement operations. Understanding the Court's legal reasoning and the U.S. Department of Justice's counter-arguments regarding this protocol is critical in appreciating how the tension between privacy concerns and the challenges to law enforcement stand at the center of this unique Information Age issue. By focusing on the Court's core assumption that the seizure and search of electronically stored information are inherently overly intrusive, digital forensics practitioners have a worthy target to focus their efforts in the advancement of digital forensics processes, procedures, techniques, and tool-sets. This paper provides an overview of various proposals, developments, and possible approaches to help address the privacy concerns central to the Court's decision, while potentially improving the overall effectiveness and efficiency of digital forensic operations in law enforcement. Fri, 17 Nov 2017 00:00:00 +0000Supplementing Windows Audit, Alerting, and Remediation with PowerShellhttps://www.sans.org/reading-room/whitepapers/assurance/supplementing-windows-audit-alerting-remediation-powershell-38140This paper outlines the use of PowerShell to supplement audit, alerting, and remediation platform for Windows environments. This answers the question of why use PowerShell for these purposes. Several examples of using PowerShell are included to start the thought process on why PowerShell should be the security multi-tool of first resort. Coverage includes how to implement these checks in a secure, automatable way. To demonstrate the concepts discussed, small code segments are included. The intent of the included code segments is to inspire the reader's creativity and create a desire to use PowerShell to address challenges in their environment. Finally, a short section includes resources for code examples and learning tools. While some knowledge of PowerShell will aid the reader, the intended audience of this paper is the PowerShell novice. Thu, 16 Nov 2017 00:00:00 +0000Threat Rigidity in Cybersecurityhttps://www.sans.org/reading-room/whitepapers/critical/threat-rigidity-cybersecurity-38135Fear Uncertainty and Doubt (FUD) works as an influence strategy by amateur cybersecurity professionals over an organization, and as a result, FUD Fatigue develops causing a negative impact on their credibility (Anderson 2014). Is there a better way to effect change while maintaining credibility? A social science theory called Threat Rigidity (Staw et al.,1980) addresses organizational responses to threats by describing a constriction in control and a restriction in information processing. The theory of Threat Rigidity theory and its concepts describes FUD Fatigue in that FUD is utilized to spur the threat-rigidity response and will cause a decrement in performance when the level of response is inappropriate for the threat. Threat Rigidity leveraged by a competent cybersecurity professional allows for not only the management of a threat but also the ability to implement critical controls to safeguard the organization from future attacks and move the organization back into an innovative state. Fri, 03 Nov 2017 00:00:00 +0000Creating a Logging Infrastructurehttps://www.sans.org/reading-room/whitepapers/logging/creating-logging-infrastructure-38130Logs are an essential aspect of understanding what is occurring in a company's network infrastructure and a company's applications. Log events help analysts to understand the health of the network and give insight into many types of issues. This paper explains how to set up a logging infrastructure by covering log formats and data sources. Then the discussion includes different ways to collect logs and transmit them. This paper then goes over how to pick relevant log sources and events to enable for collection. A company-wide architecture describes the process of collecting logs from offices across the world. Once the company-wide architecture is set up, the paper goes over some correlations using data from a real production network. The paper finishes by reviewing tools that are used to process, index, and correlate all the events that are received. Fri, 03 Nov 2017 00:00:00 +0000