Anatomy of a Cyber Attack - Insights into Attack Methods
Explore the anatomy of cyber attacks including attacker characteristics, steps in gaining access, and actions on objectives. Understand the evolving trends in cyber threats and the importance of defense strategies. Stay informed to enhance your organization's security posture.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Information Security & Policy Office Anatomy of a Cyber Attack Tech Forum June 5, 2023
Characteristics Attacker groups & economies Ransomware, credential stealers, etc. Hacking groups & social media Diversity of objectives Financial Gain Nation-State Activity Hacktivism Just For Fun Act Observe Decide Orient Non-linear activities OODA Loops! Information Security & Policy Office
Steps Attacker attempts to gain & maintain initial access to the target environment Initial Foothold Attacker attempts to move inside the environment towards targeted systems or data Network Propagation Attacker performs the necessary actions within the environment to accomplish their objectives Action on Objectives Paul Pols, Unified Kill Chain Information Security & Policy Office
Initial Foothold Reconnaissance Exploitation Social Engineering Vulnerability System Access Persistence Evasion Command & Control Information Security & Policy Office
Network Propagation Pivoting Discovery Privilege Escalation Initial Foothold Other Systems Execution Credential Access Lateral Movement Information Security & Policy Office
Action on Objectives Collection Exfiltration Action Impact Sensitive data is exfiltrated (extortion, collection) A system is configured to disrupt services Information Security & Policy Office
Observations Growing preference to live off the land It looks pretty normal; less-likely to trigger alerting Requires greater monitoring of common privileged actions (whoami) Social engineering is cost-effective We get phished for the same reason we still get spam email It becomes less-effective if the credential isn t as useful Zero-Day exploitation exists Defense in Depth Information Security & Policy Office
Information Security & Policy Office it-security@uiowa.edu 319-335-6332 QUESTIONS?
