This episode sponsored by AttackIQ.This month’s Soap Box podcast is brought to you by AttackIQ, a company that makes attack simulation software.
This is a wholly sponsored podcast that won’t bore you to tears.
There are countless CISOs who listen to this podcast who’ve shovelled an awful lot of money at their organisation’s security controls. Whether that’s endpoint/AV or fancy network kit that’s supposed to detect exfil, the sad truth is most organisations have no way to know if their expensive kit is actually doing what it’s supposed to.
Until, of course, they get breached. Then there is much wailing and gnashing of teeth.
So the idea behind attack simulation is pretty simple. You load a lightweight agent on to your corporate systems, the agent then runs scriptable attack scenarios that can simulate attacker behaviour.
These attack scripts might get some endpoints to start nmapping internal systems. They might start changing some registry keys or stimulate a bunch of disk activity that looks like an encryption/ransomware process. They might start sending off a bunch of dummy data via a DNS exfil technique. Did your endpoint solution catch the funny registry stuff? Did your network controls catch the simulated exfil?
Now imagine you have 1,000 pre-coded attack simulations with all sorts of different combinations and permutations of attacker behaviours. How many of them do you actually need to run through before you can spot the weak points in your defences?
Attack simulation is a great way to test and validate your security controls, and you can do it continuously.
AttackIQ’s cofounder and CEO Stephan Chenette joined me to talk about attack simulation and what it’s good for.
