Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11:30 AM
Ofer Israeli
Ofer Israeli
Connect Directly
E-Mail vvv

Tools & Training To ‘Hack Yourself’ Into Better Security

How to teach your blue team to think like the red team when your network is under attack and time is your most valuable asset.

Perhaps you’ve purchased the best cybersecurity technology available. Maybe you’ve brought in a red team (or have one in-house). You feel prepared in case of a cyber attack. However, there’s another step to attaining the proper level of preparation for today’s sophisticated cyber attacks: making sure your blue team knows how attackers operate.

If you can implement a “hack-yourself” program effectively, you can improve the effectiveness of your defense-in-depth strategies by having a blue team capable of carrying out red team exercises to gain a better awareness of how attackers might approach certain network vulnerabilities.

When your network is under attack, your most valuable asset is time. The faster you understand you’re being attacked and the quicker you understand what’s happening, the faster you can identify where the attackers are and what they’re doing. Responding to attacks quickly and efficiently requires an advanced level of preparation that many security teams haven’t yet achieved.

The first step in improving preparation is theoretical training in the latest tools, techniques and procedures. Cybersecurity conferences such as Black Hat, DefCon, BSides and the Chaos Communication Conference can provide the higher-level, theoretical learning to get your security team moving toward proper awareness and preparation. The next step is to introduce red team exercises.

Red team exercises with third-party consultants can help large enterprises spot critical vulnerabilities in their networks. However, many companies rely on these red team exercises to the point that they don’t maintain the proper level of internal cybersecurity awareness. External red team exercises offer a level of expertise that most organization don’t have internally. But there is also real value in implementing a “hack-yourself” program to build your security posture from the inside -- and arm your blue team with the necessary skills to think like the red team and improve your security posture.

More than simulations
Rather than having your security team practice hacking skills on third-party sites, internal red team exercises are carried out on your real network--they are not just simulations. But to get the most out of a “hack yourself” program and avoid causing damage to the network, your security team must have the proper training to identify vulnerabilities as it hunts for data, administrator credentials, or any other valuable assets on your servers.

One way to ensure your security team has the proper training to carry out an advanced “hack-yourself” program is to invest in the Cyber Guardians program from the SANS Institute. The Cyber Guardians program consists of four core courses and corresponding certificates.

The program is meant to provide security professionals with knowledge about all kinds of cyber attacks and how to respond to them accordingly. After your security team has achieved Cyber Guardian status, you’ll know that they are capable of understanding many techniques attackers might use to maneuver through your network.

Once your internal red team is trained to enact the “hack-yourself” program, you need to supply them with tools similar to those that attackers have at their disposal when launching threats. The following are two toolkits blue teams can use together for an effective “hack-yourself” program: Metasploit through Kali Linux and Cobalt Strike.

Metasploit, which has been labeled the Attacker’s Playbook by many in the cybersecurity community, offers a rich library of exploits you can run on a number of different servers. If your blue team can simulate the various steps of APT attacks, they will better be able to spot the attack paths and vulnerabilities that might have otherwise allowed major data breaches.

However, before your internal security team can start using Metasploit to its fullest potential, they’ll need specific training. Offensive Security offers a free training program for the toolkit called Metasploit Unleashed.

Cobalt Strike
Cobalt Strike is a tool used by red teams to emulate real network threats. You can use the tools within Cobalt Strike to conduct penetration testing. The toolkit’s website says the software includes functionality for:

  • Network reconnaissance
  • Attack packages for Java Applet, Microsoft Office, Microsoft Windows, website cloning and more
  • Spear phishing
  • Collaboration within the penetration team
  • Post exploitation (execute PowerShell scripts, log keystrokes, take screenshots, download files, and spawn other payloads)
  • Covert communications to evade security systems
  • Browser pivoting to avoid two-factor authentication
  • Reporting and logging to analyze the results of the exercise

While Metasploit offers a collection of exploits for blue teams to use, the tools and functionality in Cobalt Strike help blue teams gather information and move laterally without exploits. With the combination of an exploit toolkit and a set of tools reconnaissance and lateral movement, your trained security team can successfully carry out a “hack-yourself” program and uncover even the deepest layer of vulnerabilities.

Why "hack yourself?"
If you’ve never experienced a cyber attack, you will likely think the first time will happen exactly as how you’ve studied. Consequently, you will be caught off guard when an attack actually occurs; there will be so much more information that it’s hard to understand what’s important, what isn’t important, and what to investigate further. The more you practice internally, the better prepared you’ll be when the time comes that you’re actually under attack.

Related Content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Having pioneered deception-based cybersecurity, founder and CEO of Illusive Networks Ofer Israeli leads the company at the forefront of the next evolution of cyber defense. Prior to establishing illusive networks, Ofer managed development teams based around the globe at ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
9/10/2017 | 12:27:30 AM
Re: SANS Cyber Guardian isn't Free
Hereby i am sharing online resource for free cybersecurity and IT training courses that students can use at their own pace.
Registering for a free account is required. We are a IT security consulting enterprise whose mission is not only consult on cyber security but we are providing training on following area for very cheap price please visit our
website to register and also to browse free how to article on offensive and defensive security related topics at https://infosecaddicts.com/ visit us for more information.
Following are the courses we are offering
Exploit Development
Malware Analysis
Command-Line Log Analysis
Packet Analysis/Network Forensics
Reverse Engineering
Next-Level Metasploit
Windows For InfoSec Professionals
Linux For InfoSec Professionals & Comptia Linux+ Exam Prep
Network Pentesting Night School
Web App Pentesting Night School
Python For InfoSec Professionals
PowerShell For InfoSec Professionals – September 2017
CYBERWAR: Advanced Offensive Cyber Operations
seo rennes
seo rennes,
User Rank: Apprentice
7/24/2016 | 8:30:51 AM
Re: SANS Cyber Guardian isn't Free
Good point !
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
7/22/2016 | 2:37:08 PM
Re: SANS Cyber Guardian isn't Free
Good point, @tfdowns3. We will change the headline to reflect that! (Removed Free from the original version) 

User Rank: Apprentice
7/22/2016 | 8:23:14 AM
SANS Cyber Guardian isn't Free
This post is interesting as the title states that it will discuss free tools and training but goes on to discuss SANS training, which is some of the most expensive in the field.  After which, the author discusses two of the most commonly known tools  in the field.  This feels like little more than a blatant plug for SANS.  
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow on the size parameter of the tz_map_shared_mem function.
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel�s tz_handle_trusted_app_smc function where a lack of integer overflow checks on the req_off and param_ofs variables leads to memory corruption of critical kernel structures.
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks, which might lead to denial of service.
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability might allow an attacker to exploit the deserializer to impact code execution, causing information disclosure.
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in all TAs whose deserializer does not reject messages with multiple occurrences of the same parameter. The deserialization of untrusted data might allow an attacker to exploit the deserializer to impact code execution.