Twerking Santa – PSW #631
This week, we kick things off with the Blue Team Roundtable, to discuss defensive techniques that actually work, and ones that don't! In the second segment, we'll switch teams and transition to The State of Penetration Testing Roundtable, where we'll discuss the evolution of Penetration Testing, and how to get the most value from the different types of assessments! In our final segment, we welcome back long-time friend of the show Ed Skoudis, to discuss this year's Counterhack Holiday Hack Challenge, a holiday tradition here at Security Weekly, and one of the community's favorite hacking challenges!
Visit https://www.securityweekly.com/psw for all the latest episodes!
Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly
Full Audio
Segments
1. Blue Team Tactics and Techniques – PSW #631
It's often said that attackers need only to get it right once, where defenders have to be right all of the time. Those of us who have worked in a security role as a defender know we don't always get it right, in fact, there are often many exposures in our defenses. This segment will aim to help defenders learn tactics and techniques that are effective and try to answer some of the following questions:
- How do you prioritize your defensive efforts?
- How do you best detect attacks?
- How do you best protect against attacks?
- We always say "patch your stuff" but how often should you patch? Which systems should you patch?
- What techniques work best to defend against email phishing?
- How do you provide a "good enough" level of security for your Active Directory?
- What are the fundamentals of defense? How do they differ per environment and organization?
- How do you get management to buy-in to your security plans and spending?
Guests

An industry leader in cyber defense strategy, with over 18 years of experience in both technical and executive cyber security roles. Bill has devoted my career to building and protecting critical infrastructure and Fortune 100 companies from advanced threats. Bill has direct experience from ‘hands on keyboard’ from being on the front lines, and in-depth understanding of the challenges security teams are faced with.
Recognized as an influential figure in the industry, I have established a prominent public profile through my strong public speaking abilities. As a keynote presenter at prestigious events such as BlackHat and DEF CON, I have effectively communicated complex cybersecurity concepts to large audiences, showcasing my expertise and thought leadership.
Bill is a big believer in “be nice” even when things get tough and “the harder you work, the luckier you get.” If you really want to get on my good side, show me something you made. 🙂

Chris CEO of HypaSec. Previously, Chris headed the Information Protection Group, NOC, SOC and joint-international intelligence team for the Aramco family. Helping to recover Aramco from a nation-state attack, implementing digital security and reconnecting international business operations. Responsible for all digital IT and ICS assets throughout the EMEA region (minus KSA) and Latin America. Subsequently, establishing and assisting global digital security teams, standards, security-driven legal contracts for secure software development with third parties, the Aramco EU/UK Privacy group with internal and external counsel and computer emergency response teams. Chris has practical and strategic hands-on experience in several cyber warfare incidents. USAF Space Command, detecting and helping to halt the July 2009 Second Wave attacks from the DPKR against South Korea and helping to recover and re-establish international business operations after the world’s most devastating cyber warfare attack, Shamoon in 2012. Expert advisor and panelist for several governments and parliaments.

Jason has been in the IT industry since the late ’90s and has worked in manufacturing, government, retail, and finance verticals in every IT-related job role imaginable. He is passionate about defending organizations and greatly enjoys creative, unique solutions to complex problems. His favorite past time is trolling the red team and driving them to profanity.

Currently a Senior Security Engineer at AppRiver, LLC., a Zix company, his team is responsible for global network deployments and manages the SecureSurf global DNS infrastructure and SecureTide global spam and virus filtering infrastructure as well as all internal applications. Jim works directly with the CISO helping to bring the Zix compliance standards to AppRiver’s services. He holds the CISSP and CISM certifications in addition to a Bachelor of Science degree with a major in biology from Ursinus College and a Master of Science degree with a major in microbiology from the University of Alabama.

Michael is a Malware Archaeologist, Blue Team defender, Incident Responder and logoholic. Michael developed several Windows logging cheat sheets to help the security industry understand Windows logging, where to start and what to look for. Michael is a primary contributor to the Open Source project ARTHIR. Michael is also co-developer of LOG-MD, a free tool that audits the settings, harvests and reports on malicious Windows log data and malicious system artifacts. Michael also is co-host of the “Brakeing Down Incident Response” BDIR Podcast to education on Incident Response daily tasks. Michael also ran BSides Texas for five years for the Austin, San Antonio, Dallas and Houston cons.

Since 2017, GTA has invested in dozens of cyber start-ups and funds and supported multiple cyber nonprofits and projects. Ron has served on the Board of Directors for a number of GTA’s portfolio companies and has been a steadfast mentor and advisor to many founders. Ron has also supported a variety of cyber nonprofits and think tanks, with both his substantive expertise and through philanthropic funding.
From 2002 to 2016, Ron was the co-founder and CEO of Tenable Network Security. Under Ron’s leadership, Tenable grew to 20,000 customers, raised $300m in venture capital, and grew revenues to $100 million annually; this positioned the company for a successful IPO in 2018, where it was valued at $3 billion.
Prior to founding Tenable, Ron was a cyber industry pioneer. Ron developed Dragon, one of the first commercial network intrusion detection systems, and he also ran risk mitigation for one of the first cloud companies. While serving as a US Air Force officer, Ron deployed network honeypots in the mid 90s for the US Defense Department (DOD) and served as a penetration tester at the National Security Agency (NSA), participating in some of the nation’s first cyber exercises.
For these efforts, Ron received in 2020 both the Northern Virginia Technology Council Cyber Investor of the Year award and the Baltimore Business Journal Power 10 CEO award.

Trent is a seasoned security professional with a distinguished career defending a Tier 1 Network from skillful adversaries. His versatile background in both offense and defense has helped him architect visionary security solutions that are deployed within numerous Fortune 500 Companies. He is an established Security Researcher who has reported vulnerabilities in organizations like Microsoft, Google and Southwest Airlines. He is also the creator of ‘OvRfLoW’ (Microsoft Flow Attack Framework). Trent is a key contributor to Government Cyber Exercises like Cyber Shield and Cyber Storm. He has also built relationships on Threat Intelligence Sharing by speaking at the Network Security Information Exchanges (NSIE,) National Defense Information Sharing and Analysis Center (ND-ISAC) and Multilateral Network Security Information Exchanges (MNSIE.) Trent has worked with industry partners and government agencies to dismantle botnets like “3ve” and “themoon”.
Hosts




2. The State of Penetration Testing – PSW #631
Penetration testing has evolved quite a bit in the past year. As defenses shift, and in some cases get much better, attack techniques and landscapes have changed as well.
- What has changed in the past year with regards to penetration testing?
- What is adversary simulation? What are the benefits? Is the offering and consumption of this service an indication that organizations are getting better at building effective security programs?
- How has the increased popularity of breach and attack simulation tools impacted penetration testing?
- Has the MITRE attack framework impacted penetration testing? If so, how?
- Many advanced penetration testers seem to be keeping their tools private as to avoid detection by endpoint security products. Is this happening, and if so what is the impact? Should we share more? Less?
- With so many tools available today for penetration testing, what can blue teams and internal red teams do to prep for an external penetration test?
Guests

Chris possesses more than 17 years of experience as a practitioner and researcher in the security field. The author of three (soon-to-be four) best-selling books, he also teaches three distinct international courses. Chris has trained various branches of the government, including the United States Special Operations Command and the Federal Bureau of Investigation. Additionally, Chris has debriefed dozens of general officers and government officials inside the Pentagon on social engineering and its effect on the United States.

David Kennedy is founder of Binary Defense and TrustedSec. Both organizations focus on the betterment of the security industry. David also served as a board of director for the ISC2 organization. David was the former CSO for a Diebold Incorporated where he ran the entire INFOSEC program. David is a co-author of the book “Metasploit: The Penetration Testers Guide”, the creator of the Social-Engineer Toolkit (SET), Artillery, Unicorn, PenTesters Framework, and several popular open source tools. David has been interviewed by several news organizations including CNN, Fox News, MSNBC, CNBC, Katie Couric, and BBC World News. David is the co-host of the social-engineer podcast and on several additional podcasts. David has testified in front of Congress on two occasions on the security around government websites. David is one of the founding authors of the Penetration Testing Execution Standard (PTES); a framework designed to fix the penetration testing industry. David was the co-founder of DerbyCon, a large-scale conference started in Louisville, Kentucky. Prior to the private sector, David worked for the United States Marine Corps and deployed to Iraq twice for intelligence related missions.

Ed Skoudis has taught cyber incident response and advanced penetration testing techniques to more than 12,000 cybersecurity professionals. He is a SANS Faculty Fellow and the lead for the SANS Penetration Testing Curriculum. His courses distill the essence of real-world, front-line case studies he accumulates because he is consistently one of the first experts brought in to provide after-attack analysis on major breaches where credit card and other sensitive financial data is lost.

Joe Gray, a veteran of the U.S. Navy Submarine Force, is the inaugural winner of the DerbyCon Social Engineering Capture the Flag (SECTF) and was awarded a DerbyCon Black Badge. By day, Joe is a Senior Investigator at SpyCloud in addition to being the Founder and Principal Instructor at The OSINTion.
As a member of the Password Inspection Agency, Joe has consistently performed well in Capture the Flag events, specifically those involving OSINT. Examples include 2nd Place in the HackFest Quebec Missing Persons CTF and Winning the TraceLabs OSINT Search Party during DEFCON 28 and DEFCON 29. Independently, Joe placed 4th in the DerbyCon OSINT CTF and 3rd in the National Child Protection Task Force Missing Persons CTF.
Joe has contributed material for a variety of platforms such as Forbes and Dark Reading in addition to his platforms. Joe has authored the OSINT tools DECEPTICON Bot and WikiLeaker in addition to the forthcoming book, Practical Social Engineering, due in late 2021 via NoStarch Press.

Tom Liston is a Lead Cybersecurity Instructor at Dark Matter, a security consulting firm in the UAE. He is also a Handler for the SANS Institute’s Internet Storm Center and co-author of the book Counter Hack Reloaded. In the past, he worked as the Principal Information Security Architect for Warner Brothers and spent 10 years as a Senior Security Consultant with InGuardians, Inc. – performing high-end penetration tests against Fortune 500 companies.
Hosts






3. Holiday Hack Challenge – PSW #631
Each year the team at Counterhack Challenges makes available the Holiday Hack Challenge. Led by Ed Skoudis, and created by some of the most talented security professionals in the industry, it is not to be missed. Tune in to hear the details, or at least some information, about this year's Holiday Hack Challenge!
Guest

Ed Skoudis has taught cyber incident response and advanced penetration testing techniques to more than 12,000 cybersecurity professionals. He is a SANS Faculty Fellow and the lead for the SANS Penetration Testing Curriculum. His courses distill the essence of real-world, front-line case studies he accumulates because he is consistently one of the first experts brought in to provide after-attack analysis on major breaches where credit card and other sensitive financial data is lost.
Hosts



