Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2018-06-27T00:00:00+00:00 https://blog.itys.net/vol1/tags/automation/atom.xml 2018-06-27T00:00:00+00:00 2018-06-27T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/cyber-ranges-sans-with-script/ <h2 id="summary">Summary</h2> <p>Matthew J. Harmons SANS @ Night presentation Emerging Cyber Ranges: Competition to Compliance, delivered on June 27, 2018, explores how purpose-built environments can accelerate offensive and defensive security practice, foster competitive e-sports, and underpin formal compliance and product validation efforts .</p> <h2 id="cyber-range">Cyber Range</h2> <p>First, Harmon defines a cyber range as any isolated, refreshable networkvirtual or physicalused to detonate malware, test exploits, or simulate advanced threats. He surveys existing platforms from SANS NetWars (both virtual challenges and the physical CyberCity model) to JYVSECTECs SCADA-focused ranges and the Michigan Cyber Range, and even the DARPA-led National Cyber Range. Each example illustrates how controlled environments enable realistic training, product proof-of-concepts, and large-scale team competitions without risking production assets .</p> <h2 id="principles-to-proof-of-concept">Principles to Proof of Concept</h2> <p>Second, the talk shifts to design principles and hands-on constructs. Harmon outlines key requirementscontainment, auto-scaling, encrypted peer tunnels, explicit authorization, rapid restoration, and portabilityand presents a Raspberry Pi-based proof-of-concept leveraging OPNsense, HardenedBSD routing, iPXE booting, and YubiKey-backed hardware security modules. He also covers adversary simulation using MITRE CALDERA, Uber Metta, and Netflixs Simian Army, and shows how cyber ranges can be woven into compliance lifecyclesfrom requirements gathering through vendor evaluation, baseline verification, and resilience testingtransforming these playgrounds into governance-grade testbeds .</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/58296_2018-06-27_Cyber_Ranges-SANS_with_Script.pdf">Cyber Ranges, Script</a></p> 2013-10-18T00:00:00+00:00 2013-10-18T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/ddos-survival-isc2tc/ <h2 id="summary">Summary</h2> <p>Matthew J. Harmon and Phil Reno present at the (ISC)2 Twin Cities Area Chapter on DDoS Survival, delivered on October 18, 2013, provides a comprehensive primer on Distributed Denial of Service (DDoS) attacks and how organizations can withstand and mitigate them. It begins by defining DDoS as resource exhaustion aimed at disrupting servicesand tracing its roots from IRC-driven pranks to sophisticated protest and extortion campaigns.</p> <h2 id="threats-and-attack-techniques">Threats and Attack Techniques</h2> <p>The first section surveys real-world threats and attack techniques. The presenters highlight notable incidents such as Anonymous/AntiSec campaigns and itsoknoproblembro browser-based botnets and reference data on rising attack volumes from sources like Arbor Networks. They categorize attack vectors across the OSI stack (TCP/SSL floods, HTTP-level assaults like Slowloris and chunked-header exploits, and ICMP/UDP floods) and assess attacker skill levels, from low-effort LOIC/XOIC scripts to more advanced injection-driven browser botnets.</p> <h2 id="defense-and-resilience">Defense and Resilience</h2> <p>The second section focuses on defense and resilience strategies. Harmon and Reno outline four architectural approaches: ISP-level scrubbing, Cloud SOC via proxy/DNS redirection, full-service cloud scrubbing with BGP rerouting, and in-house solutions. Detailing the pros and cons of each. They emphasize risk transference through CDNs and anti-DDoS services, null-routing tactics, and bigger pipes, supplemented by application-level tweaks. The presentation concludes with guidance on selecting providers (key questions on SLAs, mitigation capabilities, and cost structures), proactive load testing, and leveraging automation tools (Chef, Puppet, Ansible, SaltStack, Fabric) to scale and verify infrastructure readiness under attack.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56583_2013-10-18_DDoS_Survival-ISC2TC.pdf">DDoS Survival</a></p>