Reverse Deception: Organized Cyber Threat Counter-Exploitation by Sean Bodmer

later be used when building an actionable response plan of possible countermeasures and strategies. It is important for any security program to incorporate a cyber assessment and/or counterintelligence framework that is easily repeatable for each event or threat. Although no two events are the same, there are always patterns in behavior, as the individuals or groups on the other end of the keyboard are human and have their own patterns and behaviors, which are generally passed over into their methodologies.
    This book is designed to inform you about tools, tactics, and procedures (TTP—another military acronym) that can add value to your current security program and improve your knowledge and awareness of threats and adversaries. You’ll learn about the ranges of threat severity and how to deal with each threat accordingly. Everyone—from home users to technicians, security enthusiasts, and executives—needs to better understand the adversaries and threats. Again, knowledge is your weapon and foe bound into one scope of information and actionable possibilities.
    The following are important questions to continually ask yourself while you read this book:
Who are my adversaries? Knowing and being able to identify an adversary is a critical task.
What do my adversaries know about me? What do I know about them?
Where are my exploitable vulnerabilities? These can be physical or technology based.
When are my most vulnerable periods (related to the time of day, schedule, or routines)? These can also be physical or technology based.
Does my adversary have the capabilities to exploit my vulnerabilities? Capabilities are either technically or physically based.
What do I know about my adversary’s capabilities and intentions?
Why would an adversary pick me out specifically? This can range from monetary reasons all the way up to a nation’s secrets. Personal agenda can also play a part, such as hacktivism.
How am I being manipulated by my adversaries? How can I manipulate my adversaries?
     
    Knowledge is stored in minds, on workstations and servers, and within all sorts of digital devices around the world. All of these minds, systems, and devices are interconnected in some way and have software programs (applications) that enable them to coexist in a symbiosis that also includes phases in evolution, such as new users, equipment, patches, upgrades, versions, releases, intercompatibility, and the knowledge of the user. All of these variables open up possible avenues for your adversaries to exploit, attack, compromise, identify, exfiltrate (export stolen information from your network to a remote destination), and leverage your money or information. On the other side, there is the security team who has the joy of detection, mitigation, remediation—rinse and repeat. The bad guys have all of the advantages, as they don’t need to abide by rules, regulations, or laws. Most individuals reading this book working in a legitimate field must abide by one or more sets of rules or regulations.
    If your hands are tied to an extent, continue reading, and you will gain knowledge from some of the best subject matter experts in various areas and facets of cyber counterintelligence, but all combined provide an in-depth look at how to identify and counter highly motivated and well-funded persistent threats (which are typically well-funded organized crime rings or state-sponsored cyber threats). The purposes behind each course of events will be different, but all will occur through observable patterns. Humans are creatures of habit, and our adversaries are also human and develop motivations and objectives based on other human emotions. Chapter 4 covers the behaviors of cyber criminals in depth.
    The advancement of threats and vulnerabilities developed by your adversary stems from motivations and objectives. You might ask yourself, “How do I know if I have any adversaries?” Well, anyone connected to the Internet is a desired target, either for