Playbook Objectives
- Training and preparing the cybersecurity team to fend off Brute Force Attacks.
- Identifying the weakness of network systems and enhancing the security measures.
- Demonstrating the impact of such attacks on the company’s overall network security.
- Implementing prevention and mitigation strategies for Brute Force Attacks.
Difficulty Level
- Advanced
Scenario
- Acme Corp. is an international e-commerce company that facilitates online transactions between suppliers and buyers. The company is headquartered in Silicon Valley, California, employing over 3,000 employees worldwide. One day, the company’s IT division receives an anonymous email indicating that the company’s network will soon face a brute force attack.
- Knowing that a brute force attack could jeopardize the personal and financial information of millions of clients, Acme Corp. takes the threat pretty seriously. The company ventures to strengthen its cybersecurity measures by running a Cyber Range exercise.
- The goal is to simulate a realistic attack scenario to evaluate the effectiveness of their existing network security protocols against brute force attacks. This is crucial for Acme Corp. as it not only ensures client trust but also helps them remain compliant with international cybersecurity standards.
- Acme Corp.’s cybersecurity team is composed of talented individuals but need to test their readiness to such sophisticated cyber attacks. Through running this exercise, the team will gain the knowledge needed to fortify the firewall rules, secure remote access, and implement proper account lockout policies.
Category
- Network Security, Hacker Tools and Techniques
Exercise Attack Steps
- Use an automated software, such as Burp Suite Intruder or John the Ripper, to simulate the brute force attack. The software should attempt to gain access by trying different combinations of usernames and passwords.
- Monitor the rate of failed login attempts. The team should notice an unusual surge in failed attempts.
- The cybersecurity team must detect the attack by analyzing network traffic, server logs, and IDS/IPS alerts.
- Upon detection, the team should attempt to block the IP addresses associated with the attack.
- Next, the team would apply account lockout policies after a certain number of failed attempts. This would prevent the attacker’s software from successfully guessing the credentials.
- Cybersecurity team should redirect brute force traffic to a honeypot. This would keep the attacker occupied while the cyber team mitigates the attack.
- Finally, implement CAPTCHA for all login inputs to defy automation.
- Post-attack, the team would conduct a forensic analysis to understand the attack vectors and to further strengthen the system against such attacks.
