🔴 لموظفي امن المعلومات ؛
الثريد هذا راح اتكلم عن مراحل
Cyber kill chain ، و كيف يتم الهجوم وطريقة الدفاع أيضاً .
ضروري تفهم الموديل هذا حتى تعرف وش ناقص منشأتك من برامج و طرق حماية
#أمن_المعلومات
الثريد هذا راح اتكلم عن مراحل
Cyber kill chain ، و كيف يتم الهجوم وطريقة الدفاع أيضاً .
ضروري تفهم الموديل هذا حتى تعرف وش ناقص منشأتك من برامج و طرق حماية
#أمن_المعلومات
⚫️ Reconnaissance
🔺Attack : whois, Google, shodan, port scan , nmap, Banner Grabber , Vuln scan.
🔺Defence: limit public info, Disable unused ports / services , Honeypots , IPS, FW.
🔺Attack : whois, Google, shodan, port scan , nmap, Banner Grabber , Vuln scan.
🔺Defence: limit public info, Disable unused ports / services , Honeypots , IPS, FW.
⚫️Weaponization
🔺Attack : Social engineering, Metaspliot, Exploit-DB, Burpsuit,Sqlmap, cain and abel
🔺Defense: patch management, Disable office macro& javascript& browser plugins, AV, IPS , email security, Audit log
🔺Attack : Social engineering, Metaspliot, Exploit-DB, Burpsuit,Sqlmap, cain and abel
🔺Defense: patch management, Disable office macro& javascript& browser plugins, AV, IPS , email security, Audit log
⚫️Delivery
🔺Attack: mail , USB , Website , Social media
🔺Defence : phishing campaign, IPS, User awareness, DKIM&SPF , Device control, web & DNS filtering
🔺Attack: mail , USB , Website , Social media
🔺Defence : phishing campaign, IPS, User awareness, DKIM&SPF , Device control, web & DNS filtering
⚫️Exploitation
🔺Attack : Buffer overflow, SQLi , Malware
🔺Defence : DEP, Anti-exploit, Sandbox
🔺Attack : Buffer overflow, SQLi , Malware
🔺Defence : DEP, Anti-exploit, Sandbox
⚫️installation
🔺Attack : DLL hijack , Meterpreter, RAT, Registry change, powershell commands
🔺Defence: CHROOT, disable powershell, UBA, EDR, conduct Incident response plan , must
Call @NCA_KSA
🔺Attack : DLL hijack , Meterpreter, RAT, Registry change, powershell commands
🔺Defence: CHROOT, disable powershell, UBA, EDR, conduct Incident response plan , must
Call @NCA_KSA
⚫️ C&C
🔺Attack : you’re compromised
🔺Defence : Network segmentation , NGFW :C&C blocking, DNS redirect, Block telnet & RDP & SSH, netcat, powershell , Traffic deep inspection
🔺Attack : you’re compromised
🔺Defence : Network segmentation , NGFW :C&C blocking, DNS redirect, Block telnet & RDP & SSH, netcat, powershell , Traffic deep inspection
⚫️ Action on objective
🔺Attack : you’re compromised
🔺Defence: DLP, UBA, Network segmentation
🔺Attack : you’re compromised
🔺Defence: DLP, UBA, Network segmentation
جاري تحميل الاقتراحات...