2020 Day 1

## Overview

Murray Goldschmidt, Executive Director for Cyber Capability Education and Training at Cyber CX, presents "Zero to Pone with No Zero Days," a case study in dynamic security testing for an ULCERAT 2020 online conference. The presentation emphasizes why organizations must move beyond static, desktop-based risk assessments to conduct actual security testing that validates control effectiveness.

## Key Topics

Goldschmidt argues that traditional risk assessments—often conducted through interviews and spreadsheets—frequently fail because they lack technical depth and context. He illustrates this with a published risk assessment claiming a website would resist denial-of-service attacks because a firewall was installed; in reality, firewalls provide minimal DoS defense. He uses the Equifax breach as a cautionary example: despite conducting risk assessments, the company failed to implement identified technical controls (identification, detection, segmentation, rate limiting) and suffered one of history's largest data breaches affecting nearly 147 million people.

The presentation covers APRA standards requiring organizations to understand their security controls and demonstrate testing effectiveness, and discusses emerging Australian government requirements for protecting critical infrastructure systems of national significance, which may soon encompass most organizations dealing with cloud services.

## Technical Details: Case Study

Goldschmidt conducted a red team assessment against an ISO 27001-compliant critical infrastructure operator with strong security postures: Office 365 with multi-factor authentication, 24/7 SOC monitoring, network access controls, VPN, multiple data centers, and physical security. The engagement involved five goals: gain network access, compromise Active Directory, exfiltrate primary data assets, access TLS private keys, and compromise an isolated critical system.

The attack progression exploited configuration and implementation failures rather than vulnerabilities:

1. **Initial Access**: Password spraying against exposed PowerShell administrative interfaces that lacked MFA; when MFA was encountered, the team enrolled an alternative phone number to intercept codes (a configuration weakness, not an MFA bypass).

2. **Physical Entry**: Social engineering by building relationships with smokers, then tailgating into the office; planting a "Land Turtle" device (USB with 3G remote access) in the IT room where network access control was whitelisted for technician work.

3. **Domain Compromise**: Booting alternative operating systems on unencrypted desktop computers (laptops had full disk encryption, but desktops did not); cracking domain administrator passwords offline; pulling entire user lists from Active Directory.

4. **Data Exfiltration**: Accessing file servers with no role-based access controls; finding encryption keys in an internal web-based password vault; decrypting sensitive data.

5. **TLS Key Theft**: Locating private keys on the file server protected only by a passphrase; finding the passphrase in logs from the SOC system that was not alerting on credential requests.

6. **NAC Persistence**: Using stolen TLS keys to whitelist their own IP addresses and MAC addresses in network access control systems.

7. **Critical System Access**: Obtaining network blueprints from the file server; traversing VPN using compromised Active Directory credentials; finding administrator credentials stored in Firefox password cache; gaining administrative access to the isolated critical system.

This was a "living off the land" attack using only native operating system tools and existing credentials, exploiting no vulnerabilities.

## Key Failures

- MFA misconfiguration: not enforced on all remote access interfaces - Privileged credentials used for non-privileged maintenance tasks - Organization-wide password reuse across systems - Inconsistent full disk encryption (only on laptops, not desktops) - Absence of role-based access controls on file servers - Sensitive system documentation stored without access restrictions - SOC generating alerts but not responding (manual intervention was too slow) - Credentials stored in browser password managers - Password reuse by system administrators

## Takeaways

Goldschmidt concludes with three primary lessons: (1) Risk assessments require context and must be dynamic, not static spreadsheet exercises; narrow scopes only protect against subset threats. (2) Organizations must actually test control effectiveness—having technology without proper configuration and implementation is ineffective; most security failures arise from configuration and people, not unpatched vulnerabilities. (3) Cyber security education is paramount, requiring "boardroom to basement" literacy across all organizational levels and functions to build a resilient, cybersecure workforce.