Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2017-06-21T00:00:00+00:00 https://blog.itys.net/vol1/tags/threat-hunting/atom.xml 2017-06-21T00:00:00+00:00 2017-06-21T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/internet-of-everything-hands-on/ <h2 id="summary">Summary</h2> <p>The SANS @ Night Internet of Everything workshop on June 21, 2017, by Matthew J. Harmon frames the cybersecurity challenges posed by a rapidly expanding landscape of interconnected devices and emphasizes why smart often means exploitable.</p> <h2 id="legal-hurdles">Legal Hurdles</h2> <p>Harmon begins by unpacking the legal hurdles around IoT security research including reverse-engineering restrictions and patent ambiguities and uses an analogy to routine maintenance to stress the need for continuous device hygiene. He then quantifies the IoT explosion (8 billion connections in 2016 per Cisco, 460 million responsive IPs in the Carna botnet census) and surveys Shodans index of exposed smart endpoints. Drawing on the OWASP IoT Attack Surface model, he breaks down exploitable vectorsdefault credentials, unencrypted data flows, firmware backdoors, sensor privacy leaksi and poses probing questions (e.g., Is your dishwasher a web-server?) to underline the urgency of visibility and risk awareness.</p> <h2 id="hands-on">Hands-On</h2> <p>In the hands-on segment, participants build a known state monitoring stack: deploying Security Onion for network visibility; integrating Darkstat and ntopng for passive traffic analysis; and using Bro for protocol inspection, alongside OSSEC and Sysmon for host telemetry. Harmon extends the lab with DCIM/IPAM via NetBox and leverages MITREs Cyber Analytics Repository (CAR) and ATT&amp;CK frameworks to detect lateral movement and prune low-hanging IoT risks. Through systematic enumeration of devices, data stores, and normal traffic baselines, the workshop demonstrates how comprehensive visibility transforms an overwhelming IoT attack surface into manageable, proactive security controls.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/57925_2017-06-21_MJH_Internet_of_Everything-SANS.pdf">SANS @ Night: Internet of Everything Workshop</a></p>