Were you ever on trainings, which consisted of “slideshowing”? Well, we begin from a spectacular practice, understandable for everybody (in IT). A couple of minutes and you’ll see absolutely from nothing, how to locate a bug in a professional IP camera (in our lab). At the end – one simple link, which allows steering the camera, access to recordings or even the possibility of putting in a backdoor – all without authentication. Once more – everything takes a few minutes and is explained in a language for people, who don’t necessarily have experience with IT security.

Usually after this introduction session people ask – but how can we protect ourselves? Where can we search for information about bugs in other models? How can one check if our devices are exploitable? Can you paste that link-exploit in the chat? Of course, we answer these (and other) questions on an ongoing basis.

Another topic, that comes quite naturally after the introduction. Well – is there an easy way for finding network devices or other “forgotten” systems/applications which are facing the Internet in the company concerned? How to recognize public IP addresses of that company? How much (and what kind) of data records have been leaked for that domain? Can such a reconnaissance be performed fully passively (e.g., without touching in any way, the analyzed infrastructure)?

Answers to those questions once again appear in a practical way. Ready-made, proven tools, live analysis, or the ability for attendees to practice the topics shown live.

How can this type of reconnaissance performed by internal IT enhance the security of the entire company? How to protect yourself against hostile reconnaissance? Yes, we also cover these types of topics in the recon block.

After a technical dosage of information from the previous blocks, it’s time for a few aspects, which may be useful for people who are not strictly related to IT. Some example topics, which are discussed in this block:

• The history of two companies, which lost a large amount of money due to losing access to their e-mail accounts (how does that happen? What are the options? What to look out for?).
• How recording several seconds of your voice can enable a perfect vishing (i.e., voice phishing; adversaries can create almost any phrase “spoken” by you; there is a certain demo and a brief consideration of whether such attacks happen in reality).
• From a leak, through forfeited documents to getting a loan using the name of the victim (we will see in realistic scenarios all steps needed for this attack, two words also on how to protect yourself from being cheated).
• We can’t miss the frequently “played” topics by cybercriminals around smartphones. SIM swapping and cleaning out bank accounts for amounts going into hundreds of thousands of polish zlotys, or tricks that allow stealing our banking login credentials. Already to the point of boredom – there will also be protection methods here.
• Almost everybody heard about Microsoft Office macros. But did you see a malicious macro in real action? Does simply opening a document with a malicious macro be a threat? What to sensitize non-technical employees to when it comes to working with Microsoft Office? Is it possible to put in place some top-level protection, so that even the most stubborn non-technical staff won’t be able to infect our network?

Opening an infected attachment (that’s how we finished the previous module) – is one way for ransomware to enter companies. But is it the most frequent one? We’ll see a handful of current statistics. We take a bird's eye look at real-world ransomware attacks on companies (how did he get in? how quick did they discover him? How long was the incident handled?). You’ll also see an example coverage of ransomware in a Polish company (coverage provided by one of our readers, from the point of view of a typical employee). There will be also two words about the basics of so-called threat intelligence.

At the end there will be a lot of tips on anti-ransomware hygiene – from the point of view of IT and a typical employee. Attendees will receive a link to a several-page Sekuraks’ material, discussing the recommended way of handling a ransomware incident or preparing for one.

The whole thing is also interspersed with interesting anecdotes from ransomware incident or mishaps by cybercriminals themselves. By the way – the presenter received first place in attendee polls for his presentation on ransomware - at the industry conference Techrisk (2021).

Was there an incident? – well, now we have a budget for security! Was there no incident? Crisis – cutting budgets. Many companies struggle with that kind of approach. So how much is it really worth spending on security? We’ll answer this question with the topic: security management / risk analysis  (here you can see the speaker’s paper in Polish – about the topic of IT risk analysis).

In this block we will speak about: confidentiality, integrity, accessibility, accountability. What is that? Which of those attributes is the most important? Or perhaps it is a misplaced question? There will also be something about security policies, and as a conclusion, attendees will receive a sample security policy (docx format) for their use.

If someone is less interested in policies, there will be a possibility to download an example workstation security instruction or incident response procedure (both documents to use freely in your organization).

For a good summary of our first day, we have what many people believes that is the most interesting. I.e.:

• Firewalls are not only blocking a couple of ports.
• A few words about functions of modern firewalls, some about DMZ’ and frequent sins when separating these zones. We will also see how to check the tightness of the firewall, using the nmap tool for that.
• After 20 minutes, you’ll know: what nmap is used for, and what not. How to us it to not break anything in the network. How not to make some school mistakes when using it, and how to begin our adventure with a little more advanced option of that tool.
• One of many eavesdropping attacks, working in most LAN networks.
• Sounds intriguing? So, let's immediately hit "from the thick of it" by showing the eavesdropping of a VoIP call. There will be ready-made tools and a little later – explanation of how this attack works and recommended protection strategies.
• IDS systems – as one of the network security monitoring elements.
• Discovering intruders will be presented using Snort tool as an example. We will see how such a system is complementary to a firewall, consider if bypassing it is possible and where to place it in the network. We will also mention a bit about WAF systems – Web Application Firewall.
• HTTPS – what it protects against and what not? Here, within one of the live demos, we’ll see logging into a bank (there will be a grey lock in the browser), while extracting from the attacker’s side the login and password in plaintext.

Actually, this is a fragment of the previous block, but it’s worth highlighting as a practical summary of the first day. We won’t cheat – if during the training there are many questions, and they are answered regularly then the WiFi security block starts on day two.

Anyway, attendees have the opportunity to see something that is most memorable: live demos:

• Scanning local WiFi networks (everything legal) – including a short introduction to the subject of required equipment.
• Cracking WPA2 passwords using GPU (extracting the hash, preparing the hash, dictionary attack / bruteforce attack).

There will also be a short introduction to WPA2-Enterprise or some unusual WiFi attacks. Of course, all supplemented with practical advice – how to protect yourself.