Matthew Rosenquist walks through an interactive cybersecurity visualization tool that maps ransomware attacks from initial entry through lateral movement to high-value targets like finance and IT. The platform shows attacker motivations, vulnerable entry points, and recommended defenses for each stage.
Chapters
I'm Matthew Rosenquist from Cybersecurity Insights, and I've been using a new tool to explain the behavioral, technical, and process aspects of cyberattacks. Let's take a look and do a quick walkthrough of the basic functionality of this interactive cybersecurity graphic that VisiTech and I have developed. I'm using ransomware attacks as an example. Which I feature in my full video, and I'm going to put the link of the video in the notes section. In that video, I provide a lot more detail about ransomware, so treat this as a complementary material that highlights the platform which you can easily access. Okay, now we're looking at one of three types. We've got multiple types here at the top, so we can switch through them. And you can see here, we've got an office with different departments in the middle, suppliers of two types on the left, web and cloud and other goods and services, and partners and customers on the right. The navigation bar up here can be clicked forward and back or drop down to advance or, or, you know, review it. But today we're gonna use the arrows. Now, starting from the normal state, we see with the first click, the cyber criminal, a subclass of the ransomware attacker, right? Here's a cyber criminal. It also shows their intention. And in this case, their motivation is personal financial gain, which is very typical of cyber criminals. Now, the next click shows the targets within the organization. This is where the attacker wants to get to, to fulfill their motivations. And you can see some of these targets: operations, finance, IT administration, things like that. The next click shows the path. This is how the attacker is typically going to get initial ingress to get to those targets. And you can see that we've highlighted workers, including remote workers. And when we see the initial attack, well, this is where they're going after both of those workers and remote workers to compromise those environments. Now, once penetrated, we can see that the attacker then performs lateral movements from the initial ingress to those areas that they're seeking. And this is really where the big problems come in, because once they get there, they've hit their objective. The cybercriminal is able to gain control, corrupt systems, or get data to hold for ransom over the organization. Now, as you can see here, we've actually put in some hotkeys so you can take a look at the impacts and the best practices for these different areas and see what kind of controls can I put in place, what should I be doing and what's gonna happen if the attacker actually gets into this area. So that's it. Please check out the full ransomware video and let me know your thoughts.
