Playbook Objectives

• Evaluate the effectiveness of current data-centric zero trust policies in place
• Identify potential gaps or vulnerabilities that could be exploited in a real-world scenario
• Train the security team on recognizing and responding to advanced threats targeting data assets
• Enhance the company’s defensive strategies by implementing a zero trust architecture
• Develop an incident response plan tailored to data-centric attacks

Difficulty Level

• Advanced

Scenario

Background: GlobalTech Inc., a leader in the field of high-value intellectual property, has become increasingly aware of the potential for sophisticated cyber-attacks aimed at exfiltrating strategic data, including patent designs, financial records, and proprietary software. Their traditional network-boundary security measures have proved insufficient in the face of threats that leverage stolen credentials and insider threats.

Setting: The company’s Chief Information Security Officer (CISO), Dr. Lena Knox, has convened a special cyber response team to undertake a critical initiative: enforce data-centric zero trust policies within its corporate network. This initiative, spearheaded in the wake of a narrowly avoided infiltration attempt, aims to bolster their security posture and create an environment where trust is never assumed, and verification is mandatory.

Network & Systems: The company’s infrastructure includes cloud services, on-premises data centers, IoT devices, and remote access for a sizable remote workforce. Their data is compartmentalized across multiple environments, including customer databases, R&D, and internal communications.

People: The cyber response team includes network architect Alex, security analyst Maria, DevOps engineer Jamal, and incident responder Christine. They are equipped with the latest in security automation and forensic tools.

Purpose: GlobalTech Inc. needs this cyber range exercise to apply and validate their new zero trust policies in a controlled, realistic environment. The exercise must ascertain that their policies correctly identify and mitigate unauthorized access attempts to sensitive data, ensuring that only authenticated and authorized entities have access to the assets they need — and nothing more. By running this lab exercise, the company seeks to simulate a real intrusion, giving their response team the opportunity to fine-tune their reflexes and procedures.

Category

• Zero Trust Security Implementation & Data Protection

Exercise Attack Steps

Phase 1: Reconnaissance

• Enumerate network resources, identifying potential data stores and access patterns.
• Perform social engineering to gather employee information that could be used in later attack stages.

Phase 2: Initial Breach

• Launch a spear-phishing campaign aimed at lower-level employees to gather credentials.
• Exploit a known vulnerability in an external-facing server to gain foothold in the network.

Phase 3: Lateral Movement

• Attempt to escalate privileges using the obtained credentials.
• Move laterally across the network, probing for data stores while avoiding detection.

Phase 4: Exploitation of Trust Relationships

• Gain access to a trusted system which regularly accesses the target data stores.
• Modify security certificates to simulate a man-in-the-middle attack.

Phase 5: Data Exfiltration Attempt

• Locate the critical data stores and attempt to exfiltrate data to an external command and control server.
• Use encryption and fragmented data transmission to avoid data loss prevention mechanisms.

Phase 6: Incident Response

• Detect the breach and initiate lockdown procedures.
• Trace the attack vector, capture the indicators of compromise, and mitigating the threat.

Phase 7: Policy Enforcement Testing

• Monitor zero trust policy enforcement points for effectiveness in compartmentalizing and protecting data.
• Simulate access requests from various user levels to ensure policies are appropriately granting or denying access based on real-time verification.

Phase 8: Analysis and Reporting

• Analyze log files and traffic patterns to identify the attack’s impact.
• Draft an incident report detailing the exercise’s outcomes, effectively identifying strengths and areas for improvement.

Phase 9: Policy Improvement and Final Review

• Review the zero trust policies in place and make necessary improvements based on the exercise findings.
• Conduct a final review with all stakeholders to update the incident response plan and enforce any new procedures that arose from the lab results.