CyberOps with Joe Abraham

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Joe all about Cyber Ops and other security related topics based on his numerous pluralsight courses. If you don't know, Joe is a cybersecurity consultant working in the public sector space assistant customers to develop and implement functional and secure network architecture. He's also a mentor to IT professionals and a blogger who spends his time either with his wife and his three children, exercising, researching and geeking out on all things technology, especially learning new technologies. Also, he has a lot of experience, as I mentioned, around cybersecurity. He has a bunch of different certifications and really excited to dive into some of his courses on pluralsight today. You don't want to miss this episode. If you want to learn anything About Cybersecurity and CyberOps, listen up.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise, as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Joe, welcome to the Guild.

Thanks for having me Joe. Appreciate it.

Awesome to have you. So Joe, before I get into it, is there anything I missed in your bio that you want the Guild to know more about?

No, I think you covered it quite well.

Thanks.

Cool. So I guess my first question, as I said in the pre show, I'm a newbie to security. Even though I've been doing this podcast for a year, I assume a lot of my people listening audience members are probably newbies as well or just getting into it. So first question may be dumb cyberops, Is Cyber Ops unique to Cisco? Or is that kind of like DevSecOps or you know, AIOps? What is it? Is it a thing?

So CyberOps, I mean it's just.

It's just short for Cyber operations, right? For the most part it just means cyber operations in general. Everything that has to do with cyber security and how we Manage the threats and deal with it on a daily basis.

Very cool. So a lot of your courses, why, the reason why I bring it up is it starts with Cisco Cyber Ops and then it has security topics. But it seems like it's more, it's not just for Cisco security. Those courses you can learn any type of. You can learn security. Well, necessarily being a Cisco customer, I assume.

No, that's correct. Yeah. So majority of the technologies that we use in the courses are open source and free to download and use. So, you know, you don't have to have any sort of knowledge on cybersecurity to get started with it. And that's what I love about teaching these.

Awesome. So how do you describe what is cybersecurity? How do you, what's your definition of what is cybersecurity?

Oh wow, that's a tough one. So I feel like the term cybersecurity has been evolving for years and it encompasses so much right now.

It has anything to do with network security, to host security, to security management and processes and policies. So it encompasses that entire picture. And.

I think I saw a chart somewhere on LinkedIn once where it had all the different cybersecurity domains and there had to have been at least like 15 or 20 different domains within cybersecurity because it has to do with pen testing as well. And, you know, so both offensive and defensive security at the same time. So.

So how rare is it then to find someone that knows all types of security? So I guess when you're hiring for a security professional, you may just hire a pen tester, a blue team expert, that type of red team expert. Like how does that work?

Yeah, so typically the job requisitions would be for a specific role. Right. So there are pen tester roles, like you mentioned, we have network security engineer roles, we have cybersecurity analyst roles or stock analyst roles, information security managers. So it just, it's the broad spectrum of security type jobs.

Is there a common thread between all of them that people should have if they're looking to get into security?

Yeah, a love for security, a love for technology, trying to, you know, protect your, your network or your endpoints. And you know what I've noticed is that a lot of cybersecurity professionals really love to dig into the weeds and figure out the why not really the what.

Right.

So.

Absolutely. So the first course I actually watched of yours is the Cisco Cyberops Exploring Security Concepts as I mentioned. I think this will help a lot of people listening because I like to go over some of these high level concepts kind of get people more familiar with some terminology. First thing I noticed was some cool tooling and one of them was Security Onion. So can you talk a little bit about Security Onion?

Oh yeah. Security Onion is.

It'S a virtual machine that you can download and install and it has, you know, an IDS built in and it has a SIM built in. So you can, you can use it, you can set it up and use it to monitor your network passively and you can use it to send syslog or other types of machine data into it. It comes built with the ELK stack, so elasticsearch and Kibana. And so you can, you know, see your syslogs right in Kibana, in the GUI right there. So.

Nice. So I know if this is similar, like for software development, they have something called Xant which will install the AMP stack. So you have an install php, the database, the web service. So it sounds almost like this is the security version of that.

Yeah, pretty much. I guess you could say that. I don't want to say it's an all in one package, but it gives you so many security capabilities, including like Snore or Suricata, now with the newest version of Security Onion. And it just gives you a lot of capabilities to play with. And it's free, it's relatively lightweight to download and install and use, so you can get up and running relatively quickly with it.

Nice. So after you go over some higher level things like getting started, you talk about threat intelligence. So I thought maybe you could go over the three stages that you went over really quickly and then people can dive in more by listening to your course. But what is threat intelligence? What are the pieces that make it up?

Threat intelligence is really broken down into a couple different parts. It's, you know, both generic intelligence, which is not, maybe not threat related, but it's helpful in a context. Right. But then threat intelligence itself is we're downloading intelligence. We might be downloading indicators of compromise and stuff like that, where we're looking at what the attacker might be doing. And when we figure out how an attack works, we can then use threat intelligence to automatically download that or manually download it into our security tools to look for those specific events. So, you know, it gives us the signatures, I guess you could say, so to speak, in order to figure out if the attacks are happening.

Nice. So in that same conversation, I think you mentioned something about the threat intelligence platform you said was a new kind of term. So I guess what is a threat intelligence platform then for people that probably first time they're hearing it as well.

Sure, yeah.

Yeah.

So, I mean, a good example of that would be something like Cisco's threat grid or another cloud service.

Right.

Where we have all of our threat intelligence uploaded into a threat intelligence platform or somewhere in the cloud. And, you know, our devices connect to that. And as the attacks are happening on one device, what's really cool is our security technologies upload the information about those attacks to the cloud. That way everybody else that's connected to it can download that data and almost in real time, detect the same threats.

Right.

So a threat intelligence platform is what hosts all of that information.

So you talk a lot about information, all this information that's being generated by all the logs and all the things. So it sounds like you use things like Splunk and elasticsearch to help, kind of like, how do you bubble up really important things and ignore things that aren't unimportant with all this data that's being collected all the time?

That is the secret to success. So we have so much data in our environments, we want to collect a lot of data, but we have to pick and choose what we want because we don't want. And it'll be like searching for a needle in a haystack.

Right.

So we don't want to overload ourselves with too many. And so what we try to do is create specific searches. Or maybe we have apps that help us automate the correlation searches, where we gather all of these different.

And instead of just trying to, you know, sift through logs manually. Right. We have these automated mechanisms to search for patterns based on these indicators. They could be called searches. I know that's what they're called in Splunk, Enterprise security. And so what they do is they help us automatically search. Paste that needle that for.

Nice. So how much of, like, a data analysis type of skill does someone need to be in security.

If any?

Well, you have to understand, you know, where your data is coming from and how you're getting it.

Right.

And also what it means. So I would say, you know, less. So from a security engineering perspective, you might not be concerned about viewing the data and analyzing it, but if we're soc analysts or, you know, if we're cyber operations professionals, we're going to be digging into the data and trying to figure out exactly which events caused an attack or which events did not. So you have to love data analysis or at least enjoy it a little bit. I'm a big fan of enjoying what you do for work. So if you don't enjoy it. You're going to be just staring at the same logs over and over and over again, feeling miserable for yourself.

So how does data come into play in the day to day life? Do you walk into work and then you get alerts or do you look at a dashboard and then you're looking for patterns or it's a combination of you getting paged still or text. How does the whole day of life kind of work with the, with the alerting and trying to find issues proactively rather than after a hack has occurred?

That's one thing I love about my job is I get to, you know, go into many different environments as a consultant and kind of see how their operations are. So I've seen it, you know, several different ways. For the most part though, there's typically one main tool or two main tools that they use for alerting and that's what they kind of use to triage their events. And then after triage they, you know, they'll typically prioritize them and then assign them to some sort of analyst to be able to dive deeper and really investigate it to see if an attack is happening or not.

So I guess along those lines then would you call this as the term cyber threat hunting? And if so, like, what is that? What's that like?

Yeah, you can consider that cyber threat hunting.

Cyber.

So, you know, if we're threat hunting, we're doing it when we're not, I guess you could say, racing to do it. Right. Threat hunting is when we're proactively looking for attacks or threats that might have missed our, you know, our security devices. Whereas, you know, the typical day to day operations of an analyst would typically be responding to alerts and investigating, you know, very specific incidents. So.

So you said you could focus on a lot of different things. So you kind of have to narrow down what your focus is in on. You also talked about a common vulnerability scoring system. Does that help? You know, like, oh, this is to prioritize. We better look at this because this has a higher score than this other thing.

Yes, it does. So what's cool is a lot of the tools now are starting to get a lot of integrations with the CVSS scores and the mitre, ATT and CK matrix and you know, all of these other frameworks that help us prioritize and help us, you know, kind of see how bad an incident may or may not be.

Right.

And you know, when it comes to the CBSS scores, you know, those are vulnerability scores. So those help us prioritize you know, more along the lines of patching our systems and trying to close the holes in the systems. So that's where that comes into play.

Nice. So.

You talked a lot about integration also in this course with the data for security experts and you talk about dashboarding. You know, I'm thinking as a software developer and a software developer tester, they usually use CICD pipelines and hopefully people are starting to incorporate security checks as people checking code.

In general. Is it easy to integrate security into your pipelines for developers as well to get them more involved?

I'd say if you start off with the security mindset, then yes, but if you're trying to do it after the fact, that's where it starts to get more difficult. And I have mentioned APIs several times in my courses and right now, you know, APIs are being used all over the place to integrate different tools and like I said, the frameworks and everything like that. So the whole DevSecOps concept, you know, is extremely important moving forward for us to, you know, start from scratch with a security mindset.

But you did mention you are our consultant, so you get to see a lot of different companies and organizations. Is DevSecOps kind of just a buzzword or are people actually starting to embrace it? Do you see an uptick or is it just a, you know, people shrug their shoulders and go on as they always have?

No, honestly, I'd say people are starting to embrace it. You know, with so many attacks and cybersecurity incidents that have been happening over the years, I feel like we're finally starting to cruise from that perspective. We're finally starting to.

Have a security first mindset instead of just trying to get products out and out into the wild.

And you think the reason why for that is more hacks or is it because when developers start using more open source code that their application becomes more insecure or is there a reason why it seems like people are moving in this direction?

I'd like to say it's a result of all of the above, but I can't honestly speak for that. But my thoughts are that we've been pushing security, security, security for years and years and years now. And I feel like that might be the reason why we're finally starting to see some headway in that.

Nice. Now, I know from on the outside looking in, it almost seems like security seems like a skill that, like a specialty skill and that a lot of people like, oh, that's the security team's job. So I don't know, is that like also a culture that needs to be changed as well to say, hey, well, maybe you can start doing other things that make it more easy to get security built in earlier as you're developing your code.

Well, so, yeah, the DevSecOps thing that I mentioned is definitely important. User education is extremely important for ensuring that the entire company or the entire organization or team has that security mindset.

Yeah, I think that's pretty much it from that perspective.

So are there any models of frameworks you find helpful? I think you mentioned something about the CIA triad. I don't know, does that help? How does that help with the security and security in your teams?

Well, so the CIA triad helps us kind of identify how different security controls may affect the data or the users.

Right.

So, you know, certain technologies help us with confidentiality, certain ones help us, you know, validate the integrity of data and stuff like that. But from a framework perspective, if you're learning about cybersecurity, I would definitely look at the MIT framework, maybe the diamond intrusion model. The course that I'm currently working on is going to cover all of those quite in depth.

Awesome. So in the course you also have a section, I think, challenges in cybersecurity. I thought maybe you can go over a few of those to get people a little more familiar. What are some of the challenges you see within cybersecurity?

Yeah, so there's a lot of challenges with data visibility. I mean, if you think about it, while we're trying to.

Get more visibility and get more logs and be able to see more of the network, we're also trying to secure it too. And by securing it, we're also trying, or we're trying to hide that data. So there has to be some sort of balance. A good example of that is things like encryption and VPNs.

If users are using VPNs, then, you know, we can't see inside of those packets to see what exactly is going on.

Right.

So malicious activity could be happening without our knowledge. And so, you know, there are visibility problems when it comes to the networks. And this is both on the host and the network and then even in.

The cloud as well.

And, you know, you mentioned the 5 tuple approach to isolating a compromised host. The 5 tuple is kind of what we use to determine different conversations between hosts. And like I said, VPN and other obfuscation types or obfuscation methods really hinder the ability to see that kind of stuff.

So are there any overlooked areas you think people, when they get into security, kind of ignore that probably would be better served if they pay attention to, I would think, outside, again, looking in. Pen testing would be kind of like the sexy area, and maybe that's where companies focus in on first. I don't know. It's just my gut. Any thoughts on that?

Well, so the pen testing area is definitely sexy. Right. And I truthfully am not very good at that. I can fumble my way through a little bit of offensive security, but that's about it. But, yeah, it's really tough because there's so many facets to cybersecurity, and sometimes you have to specialize in only a few different areas of it. So, yeah, I don't know. The focus that organizations have varies based on their maturity of their security infrastructure. So we wouldn't want to start out just pen testing a network. We want to be able to decide what we have to protect. We want to identify the assets and all that kind of stuff and then put our controls in place and then hire pen testers to come in and tell us what else we missed. So, you know, their job is to help us identify the holes in our network.

Nice. So this might be off the wall, but I've been hearing more and more about ransomware, and I think Garmin was like, they pay people, like, millions and millions of dollars to. To stop the attacker, unlock certain data. Is there a reason why this? It seems like there's a rise in ransomware. I don't know if it's just because I'm seeing articles, and that's a bias of mine, but can you talk a little bit about, like, what is ransomware? Maybe how people can not try to avoid it, or is it like a common step that people are missing that would help them, so it wouldn't happen as often?

Sure, yeah. So ransomware is when somebody overtakes a computer or a network and just is able to control it and lock you out of your own systems.

Right.

And they typically use some sort of encryption mechanism, and they're the only ones with the key, obviously. And once you pay the ransom, then they'll unlock your systems for you. And the reason why it's become so popular, I think, is because it's lucrative. You know, people are paying them. So I'd attribute that as one of the main factors to the rise in.

Ransomware from a security perspective, trying to mitigate that kind of attack. There's not really any one size fits all option, but I would definitely say if you have a robust security policy and your controls are in place and you have good backups, you'll be able to help mitigate any loss if you refuse to pay it or possibly prevent the attack from happening.

Awesome. So I would think all companies have backups, but it sounds like maybe that's not the case.

Yeah, I mean, you'd be surprised. You know, I'm an advocate for backing up as much as you can, so especially when it comes to critical systems, you know, hospitals and things like that, you know, if you ensure that you have the backups, then you might not be as worried about paying the ransom because you can just, you know, restore your systems to the, you know, to the backup.

Absolutely. And so as I mentioned, you have, I think, four courses. Maybe I missed one or two, but the one I watched was Exploring Security Concepts, which was really good. But you have three other ones, it says. It sounds like you're working out on a few other ones. The other courses are security monitoring, I believe. Analyzing host and analyzing the network.

That's correct.

I'm thinking, is there a certain order people should go through if out of these four, I mean, I would think they'd start with the security concepts, but after that is it just whatever resonates with someone or whatever they're working on to see should I be analyzing the data or working on the host or monitoring?

Yeah, so I would definitely say, you know, if you could start with the Exploring Security Concepts course first. And the way I'm building the courses, it's going to be a five course path. And the way I'm building them is to, you know, just kind of follow each other right in the order that you mentioned the next security concepts and then security monitoring, then host and network. And the one I'm working on is managing policies and procedures. So it's a lot of the bigger conversations about the frameworks and policies. But if you're not interested in exploring the entire series, just pick and choose what you like, what interests you and see if it resonates like you said.

So I was thinking maybe we could pull out one big concept for each that you could talk a little bit about to whet people's appetite or get them more interested in actually consuming the whole course. So I'm thinking, you know, analyzing the network, like, what's one big takeaway from that you think people would get if they watch that course?

Oh yeah. I mean, with the network we're talking about packet analysis and we're talking about, you know, analyzing NetFlow, you know, looking at the actual data that's coming across the network to try and help us identify, you know, potential Events that are happening. Right. And then the host based analysis course, it's almost the same thing as the network one, but all about the host. So we're looking into antivirus and how those will detect threats for us. And everything's tied into security information Event manager.

Right.

From the security monitoring perspective, that one's just general monitoring capabilities. We're talking about where we're getting our data from, how to ingest it, how to analyze it. That's a really good one. If you want to be able to look at machine data analysis or just log analysis in general. And then like you saw with the Security Concepts course, it's an overview of a little bit of everything.

So yeah, it's a great way to get up to speed. If someone's studying for a certificate or certification, would this help them with any specific certification? They went through all five?

Yes, I think so. So it'll help with the Cisco CyberOps Associate certification. It'll help with any of the other certifications as well. Security, maybe cissp, I mean that's more of an advanced one, but any of the basic security certifications. You know, this is really good general knowledge to have and you know, it covers, you know, the gamut of cyber operations and security in general. So.

Nice. So I am a big geek about tools. It's probably a bad thing, but I like tools, any type of automation tool to help me with some sort of testing. So are there any go to tools you use? Most people I talk to bring up pen testing, but it doesn't seem like that's the area that you necessarily focus in on. So I'm just curious to know what tooling is, what you go to for your type of security work.

So I love working in sims.

I love, you know, the data analysis portion of it. I really love working with netflow. I think it's a great protocol and it gives us, it's really lightweight and gives us a lot of metadata about the information that's going across our network. And I say the data analysis portion is where I really enjoy it.

So just open up a memory pocket. You talked, I think about telemetry and telemetry is something I've been hearing more about in conjunction with observability. So like what is telemetry?

So that's a good question. I don't want to say it's relatively new, but it's really the collection of measurements and statistics about your network.

Right.

And that's something that's been really big lately as networks have become more software defined and more robust. So to speak. So telemetry gives us a lot more data than just logs and machine data. So that really helps us drive security processes and helps us identify threats quicker.

And it's able to identify threats quicker because it has more data. Is that stupid? But it gives you more data. You can analyze and say, okay, now I know this is issue rather than, oh, it's something on my server, it's a little more granular, I guess.

So I guess it's more targeted data. Right. So it may be more data, but it's more targeted. And at the same time, it's also more data that's useful. So some examples of that could be we have the integrations that we spoke about earlier between many security technologies, and we might get telemetry from each of those, and they might be normalized in a way where they all complement each other.

Cool. And I know about open telemetry. I assume this is the same thing. It's just a collection of tools, APIs and things that people can consume to help them with their data. Sounds like in general, high level.

Yes, exactly.

Cool. Yeah, I think it's an area people should definitely focus more in on because I'm hearing more and more about it. So. Awesome.

Oh, yeah, it's becoming big.

So, you know, we're starting the new year 2021. Any trends you see going on in the security space that you think people need to jump in on now before maybe they're left behind or maybe if they want to get in on early on the ground on some sort of technique or area you think would be beneficial for the career.

Oh, wow, that's a loaded question. Because cybersecurity is so broad, I'd say the buzzwords, so to speak, that I'm hearing in the community are definitely the remote access solutions, you know, using the cloud and then zero trust. Zero trust, the big buzzword. And so, you know, everybody's trying to either have some sort of zero trust policy implemented or, you know, get some more tools to help with that, you know, process.

Cool. All right. Okay, Joe, before we go, is there one piece of actual advice you can give to someone to help them with the security efforts and what's the best way to find or contact you?

Sure.

So the best way to help your security efforts is to not stop learning. I can't emphasize that enough, and I think anybody in the security industry would second that as well. Don't stop learning. Always be hungry to learn more about what you're doing or about other facets of security to help compliment your actual role and then yeah, you can find me on social media. My twitter tag is oabra J O E A B R A H. Then I also am hosting defendthenet.com that's my blog that I'm trying to get up and running this year. So I've had a couple setbacks, but it's launched. There's just not a lot of content on it yet. But I do hope in the next couple weeks that we'll start adding a lot more.

Thanks again for your security testing awesomeness. The links to everything of value we covered in this episode. Head on over to testguild.com S46 and while you're there, make sure to click on the Try Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. And if the show has helped you in any way, why not rate and review it in itunes? Reviews really do matter in the rankings of the show and I read each and every one of them. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.