Sign Kentucky Banking Permission Slip Secure

Industry sign banking kentucky permission slip secure

hello got way too quiet yes you know I have to be quiet we're not saying anything important so it's okay this is getting the most out of your physical security assessment a clients guide so who are we burnt white and so we have a personal blog too and you see from our shirts we have people this is where we talk about our physical intrusion in social engineering tactics and techniques and experiences that we have also things like hotel hacking things like that so so if you ever want to see the slide deck this is very post-its and some of our other talks so the whole point of this talk is we do a lot of physical intrusion and assessments physical security assessments and we've seen common problems with different clients with a misunderstanding of what they need what the what they think they might need what they don't realize that they need and so we're just going to quickly go over there are three main types of physical assessments that we do and that looks kind of small to can anybody not read that at the bottom no it's kind of small all right so one of the first ones that we do is a covert assessment this is what we primarily do and what methodology that we're in charge of for our security team this is an emphasis on real-world attack vectors this includes social engineering oftentimes when you're doing a physical security assessment you're talking with the client the client is not aware the social engineering is part of that assessment this is primarily for the covert stuff we also do some overt physical security assessments this is where we go with the clients as we walk yes I appreciate the gift here for a moment but we will walk with the clients side by side it's a lot of Q&A asking about instant response asking about how their cameras are hooked up who's monitoring things like that the kind of devices and access controls that they have installed and so to kind of add on to that with these physical slice side assessments as we're going through we can really kind of dig deep into things like alarm sensor placements how easy is it to bypass these we can look at things like door configurations window configurations even start to look into documentation on how do you handle employees that have lost their badges how do you handle guests and so on so this picture is actually I took this on a physical assessment that I've done recently and yet to the clients defense it was decommissioned also before it was decommissioned it was a working camera that someone thought it was good to actually install it this way yeah so how do you the slack on that cable is what gets me is reaching up their brain can't reach it yeah sorry anyway so part of this - when we do these kinds of assessments the covert oftentimes we focus on getting from A to B a specific area either the data center or executive suite and office but this is something the client provides so this is two big differences between the covert and overt is that the over it is focused on things like that so if you see something like that then you're able to say hey look at that or hey look at this have you considered this or what are you doing why is that up there is it even functional these kinds of questions are great for those over types of assessments but the covert is more of again a criminal mindset getting from A to B and how we can get there as quickly as possible either tailgating or cloning a badge or something yeah so red teaming and red teaming it's where you take all these different types of attacks you take the covert part of the assessment you also include things like fishing fishing external penetration assessments all these different things where depending on the client and we'll get into this a little bit more but depending on the client your industry your location what things make sense to include in a red team or does it make more sense to you know focus on different things dear in a covert assessment and so that's mostly what we're sort of getting at here and we've mentioned this in some of our other talks to the red team is subjective often times in this industry you know purple team all that stuff is kind of dependent on whoever's performing the assessment that understanding yes what's that absolutely it does boil down to the scope and even when you're doing like pre-sales and you're talking with your client or whatever developing that statement of work getting a clear understanding of what a red team is because sometimes we'll have a client come in and be like hey we want a red team assessment okay cool and then we talk with them and all they want is a wireless security assessment and a web app or a web app assessment it's like this is this is more of a the whole thing right the whole gambit or different attack vectors that are combined and it's usually a longer engagement type it's not just one week or two weeks or something yeah yeah who in here does pin testing okay so I'm sure you you all have probably ran into scenarios where people like hey I heard this really cool buzzword at RSA called red team I want that they're like okay well here's all this stuff here's the budget for it and like oh no we just you know we have two Web Apps and we want you to look at you know our Amazon instance or something so for our red teaming to house this kind of ties into what we were talking about with physical security that's one of the attack vectors so will attempt to do you know things from external perspective gathering those since doing all that that recon and such before doing an on-site because will exhaust all those efforts see if we can get access that way and if not and we'll try to send somebody and to drop a Dropbox or connect an access point to remote in or even do it wirelessly from the parking lot yeah we could probably go on about red teaming oh yeah oh and something else to you probably shouldn't mention this seven minutes ago if anybody has questions or anything please ask us as we're going also if you feel like heckling us - that's cool so yeah question that's fine so the question how hard is it to sell a covert assessment as opposed to just a physical sight assessment with the walkthrough correct and that's kind of what we're we're going to dig into that a little bit hopefully not not as in-depth as we want because of the time restraint but there are there are different questions you that you can pose to them that in a quick response to that to is like doing hybrid type of security assessments where you go in covertly at first and then once you're done whether or not they catch you or whether you've obtained access then do a walk through that half so your level of effort may increase a little bit but it's still it's still you know they're kind of getting the best of those worlds with that approach yep yeah so have we ran into two issues with results from physical versus other parts of the company like cyber and so on oh yeah and that's one of the things where three of these assessments we say this is why it's important yeah you might have these things locked down but if anyone can walk in off the street and pull your server rack out and go out the front door with it that's a breach that's a problem so then also and I say this I think in every talk you look at any of our talks but security awareness training to doesn't blow it down to just that kind of annual thing that you do or quarterly training that you take online or whatever it has to be that that culture to and so one of the things that we'd like to test Fri merrily with our physical security assessments is security awareness training covertly assessments as a security awareness training whether or not they are escalating properly and we'll get into this a little bit in our next slides so yeah problems that we notice I don't know what I want clients often aren't aware of options that they need so again some of those options and just like he was saying sometimes a client just has one idea of what a physical security assessment is like oh okay well you're going to walk through and tell us where camera placement is or what kind of badge access we have or the incident response systems that we have utilized and it's it can be more than that and I think it's very important as we go into this next slide to assess these risk so for your question earlier candidate dig into that when you're talking to a client about a physical assessment you know what are their risks like I guess in a way that we like to ask it is what keeps you up at night and so by asking that question you can start to get some some you know legitimate answers from them about what they really worry about so depending on the industry is that our insider threats you know you're looking at intellectual property that you're protecting or outsider you know or terroristic and so on so it depends on what your what your main risks are and with that that'll also shape your guys so as a pen tester if you're doing offering these kinds of service offerings whether they're on site social engineering or physical security assessments is is understanding what kind of guys is more appropriate and understanding the industry and and testing that because if I'm wanting to get an idea of what an employee has access to or whatever then you know if I'm gonna pretend to be an employee rather than trying to be you know the cleaning crew or some contractor there to fix the printer or whatever and so something that Tim was talking about earlier before we came in here is that for example with retail you know they have a higher risk of insider threats with employees stealing property things like that so just you know again it depends on your industry yeah so as a client how many people in here are clients that hire pin testers there's like three that's good well know as a client I think even understanding that two before you go in be prepared to have those conversations with the pen tester to adequately request the services that you are looking for have an understanding even like researching when you're doing a request from a bid or whatever if you have multiple security companies that you're kind of looking see what service offerings they have ask to see their methodology hey can you guys send me a methodology overview con so I can kind of see what your approach is for these types of assessments so we can kind of look at what exactly we were looking for you know so if you're a federal facility to add on to that and let's say maybe you're a nuclear facility with you know high security you're going to want to look at a pen test company that in their methodology they include things like surveillance and that they're not just going to show up for half a day and see if they can just walk in the front door you know you want a company that has that maturity and the experience where they can assess and properly look at things for facilities like a nuclear facility and so on a key area of concerns as well we've had some financial Institute's that we do assessments for and they'll be in really high crime rate areas so keeping in mind that to where your facility is located are they downtown somewhere where there's a lot of crime a lot of break-ins a lot of car theft even so I think we did an assessment for a client a couple years ago where they had had a few car theft incidents so they just didn't even have camera coverage in their parking garage but in the the arm was broken so it was up all the time so yeah there's reasons for this but you know I think it's good to have these kind especially the covert stuff to say hey look we just pretended to be criminals criminals could have done this and we just saved you a potential compromise yeah and that was also the one there was a ATM vestibule right across the street and there had been a shooting there like a month before we had showed up so if you are doing pen tests like physical pen tests and you go to certain areas you also want to know what's the crime rate in that area so you're not you know walking around by yourself at midnight and go down the wrong alley or something something else just because a slide mentions it you know oftentimes the the power the generators on the outside there they are not protected they're just kind of sitting there these are things to consider too especially you know if your risk is some kind of terroristic threat or you know say you're a credit card debt collection company or whatever you know the if you're just leaving the generators there and that's powering your datacenter you don't have some kind of backup generator or those are your backup generators then they could be bad news yeah and you had a question earlier right no I thought you raising yeah yeah oh okay sorry there were an option you would have bought it so yeah you have a question absolutely actually we talked to a guy think it might've been a Def Con this guy does a lot of drone hacking and so one of the things is the design of the building and the metal plates on the ceiling having a you know tinted windows and stuff from the outside things like that because I mean those are real threats especially with the size of drones now Mavic has tons of tiny little drones that record like in very high definition and night-vision and all that stuff so these are actual actual things that you know I think a lot of people don't consider and it's kind of fairly new it's not too new but it's still new enough that clients oftentimes don't even consider that kind of thing now in again if it's a bank or somewhere that needs to be more secure you also want to make sure that you have the proper physical barriers in front to prevent a car from driving through the front door or trying to rip out an ATM also with cameras you want to make sure they're proper placement high enough resolution so that it can actually be used and as evidence if needed so yeah your incident response to like your incident your intrusion detection like what do you have in place for that a lot of times we'll do like group forcing on badge readers and most of the time too I'll go up and I'll still a badge or clone a badge get close enough and then Brent will clone that badge off of my clone off of my proxmark and then we're using the same badge to get into multiple facilities or using the same badge one right after the other to get access to a building because we've we've cloned a badge or duplicated a badge sometimes the security and the clients aren't monitoring that so they're not seeing hey man this same same dude John Doe is badge in here and he also badged into the data facility across town or in another state 30 seconds ago yeah so those kinds of things I think tweaking it a lot of those monitoring systems have had those kinds of options yeah and so with the security guards for more more info on that we have a talk called security guards LOL where and that sounds immature browser should rethought the title of that but basically it's where we point out the issues of large corporations their physical security relies largely on one or two security guards so there have been times where you were talked about you know we clone a badge and then we share the cloned badge and our batch cloners are hidden in like a coffee cup or a muffin bag or something and we don't take it out we just hold the cup or the bag up to the badge reader and it's like oh Bob Smith just badged in three times in the security guard through the window right next to us doesn't even notice because he's like watching basketball or something on his phone yeah oftentimes security guards are very distracted especially because if nothing happens you know or that's the the mentality they get into so they're sitting there on on these things watching Netflix or distracted or whatever and then also the opposite can happen too so that's something that we want to always prevent but we have actually we made these shirts as a joke because often times we'll be there and we'll get to from point A to B or we'll get to our destination or get access to an area and then after that we're like well what else we do well let's put these shirts on and walk around it says anything so you know I'm not supposed to be here and that's why we had these shirts man yeah people don't pay it did you people laugh most the time they don't even they just don't pay attenti n we have somebody actually recognizes one time to friend we won't deviate too much because we only got a few more minutes but we were doing an assessment he's like hey I saw girls talk on breaking into a building at hackers guy don't authorize access wait a minute are you guys here doing a physical security assessment and this was after we had just tailgated him into the data center area but it was this guy because there was a retina scanner and Tim was right behind the guy and so he put this badge up that was blank and it beeped anyway because it does whether it's I went through the motions and stuff and he put his eye down to the retina scanner and the guy was like oh you don't have to do that it's not plugged up yeah he was like wait a minute no but it was funny because the entire time we were in there too because we're he was like oh are you guys doing this that's more like actually yeah we're here meeting with the CSO he's supposed to be over here we just had lunch with him he's gonna meet us over here is there a place we can wait and he's like I'm gonna be watching you guys and he you know the whole time he just walks away and we're just sitting there we plug into the conference room it's into the conference room DHCP is enable we get an IP address and we start some scans just to grab some proof of concept because it was just a physical thing and then and then we left yeah it's like a whole time he was like watching you this is like yeah we see you there so and with what should I have tested so yeah understanding what you need and not being too scared of what a pen tester might find if you really pigeonhole and like lock it down you're only setting yourself back so the point of this is to see what vulnerabilities are there what ways could a malicious actor really leverage these vulnerabilities and and make you have a really bad day so yeah after hours testing you know tell is that something you want to look at this is something to consider even as pen testers this is something really to consider as we kind of go to this next one here I'll shoot you there are some security guards out there that are that have an itchy trigger finger bands especially if you're doing after-hours assessments so we no joke had a client once he was signing our letter of authorization or aka get-out-of-jail-free card he was signing it and he said don't get shot we're like what wait a minute what wait let me call my wife yeah he didn't tell us that they had armed security guards too so that changed a lot we were like we're not doing this after hours you know especially with a disclaimer don't get shot okay you should never be a concern as a pen tester yes that's one of them yeah yeah that's seriously one so after an assessment it was a evening assessment and we were doing the report readout and the statement was made by a security guard if I had seen you I would have fired at you and this was like it wasn't saying I would have challenged you seeing what you were doing if I would have seen you I would have fired at you and at that point it's like no After Hours assessments with armed guards you know I think that's probably safe but yet you know so we got a lot more minutes so we'll hold off on questions till the end as we kind of rush to these last remaining slides so a lot of times clients will ask us okay as you gain access or as you're interacting with employees we know you have like that the cameras and your ink pens and all that stuff can you can you use that and show it show us later and that's a really cool idea and it can be useful but you really really have to check with your local laws you know I'm not a lawyer I don't think Tim's a lawyer so we can't tell you yes or no but yeah not today but ask a lawyer to make sure that you're not breaking any state or federal laws with with these surveillance things like this so and as a client to make sure you're not just doing this just for the checkbox you know these kinds of assessments any pin test should not be checkbox compliant driven I mean yeah that may be a requirement that shouldn't be your driving factor but just a starting point yeah yeah so again things to consider what's your what's your biggest concern what's your biggest fear what keeps you up at night so depending on your industry again these are things that you should consider more and unfortunately I wish that we had more time to go more in depth on that yeah this is also why we you know go to week hack people calm and you can check out some of our other talks where we get a little bit more verbose a little more in-depth this is very hot level if you guys have any questions I think we have like two more minutes so I think Jim you had a you had a question back there if we encounter guard animals I never had well if you do surveillance and you do see that haven't had the issue come up with that yet but there are tactics around that where you can distract those depending on their training or the area but at all costs I would advise not having to enter again it's it's it's kind of one of those in predictable deterrence right that especially like guard dogs so I wouldn't risk any of my team to go and do that just because it's too great a risk so even as a client you know you're looking at your risk right but as a pen tester look at your risk as well yeah and somebody might say well throw the dog a stake but if there's some sort of dietary restriction or something where you that could harm the animal now you've got a lawsuit just just stay away if I can leave shrimp yeah yeah the property management so that's that's something that we actually run into especially with the red teaming and Marla's stuff we that's where partial disclosure kind of comes in so when you're talking with a client letting them as well as a client letting the pin tester know hey these are our rooms these are sweets this is our here's a list of our access points you know that way you're Europe what's that yes yeah they have to yeah and sometimes it will even use a property manager as a guys one of the times I always pretend to be a property manager I had a letter that I'd written out gave it to one of our team members he pretended to be there to replace the sprinkler heads on the property he brought a ladder carrying a louder ladder around got in there installed a wireless access point in the conference room and we were able to connect from the outside but from that you know that's another concern too when you're putting these rogue access points or evil access points and you have a shared facility not only is that trying to get people lined within the scope but it's also increasing that so you have to limit these things and tweak it but if it's a property management sometimes you can even get them to buy in for the whole facility and then in gain some more clients that way - yeah good question any more questions yep regular sedan just normal vehicle you don't want anything like bright colors or you know some fancy Camaro that you got from enterprise the most boring like mundane everyday vehicle to vehicles yeah get two of them as well if you run if you're gonna be doing surveillance for a longer extended period of time though you can switch out but yeah the most boring thing you can get yeah and also if you're looking at really high traffic areas and stuff like that so it's a little bit easier to blend in that way but you can even do some recon beforehand look at the vehicles in the parking lot some common vehicles or a rickshaw you know alright guys I think we've reached our time but we appreciate everybody if you have any questions for Brenner I thank mouse cuz we have some stickers - thank you [Applause]