Playbook Objectives

• To evaluate and enhance the defensive measures against a simulated attack on the company’s server infrastructure.
• To establish and reinforce a security baseline adhering to best practices for server hardening.
• To test the response capabilities of the IT and security teams.
• To identify potential security gaps in current server configurations.
• To provide a training platform for security personnel to practice incident response and server hardening techniques.

Difficulty Level

• Advanced: This exercise requires a deep understanding of network and server architecture, threats, vulnerabilities, and hands-on skills in system administration and security.

Scenario

• Cyber Range exercises are conducted by a fictitious company, Vandelay Industries, a globally recognized players in the import/export sector with significant online data storage needs for their digital marketplaces and client information archives. Vandelay’s IT infrastructure hosts several critical databases on its servers, including trade secrets, financial records, and personal data of millions of users.
• Recently, Vandelay Industries faced an attempted breach that was thwarted by their up-to-date incident response plan. However, this highlighted the need for a proactive approach to server security. To reinforce their defenses, the CISO, Elaine Benes, decides to conduct a Cyber Range exercise focusing on server hardening and ensuring adherence to a robust security baseline.
• The Cyber Range lab is set to simulate Vandelay Industries’ network environment, which includes an array of both Windows and Linux servers supporting various business processes like web services, data processing, and customer relations management systems. Elaine assembles a red team (attackers), led by Newman, and a blue team (defenders), led by George Costanza.
• The exercise’s plot unfolds with the red team planning a series of sophisticated attacks targeting vulnerable server configurations, outdated services, and common misconfigurations. The blue team’s challenge is to detect these attacks, respond effectively, and harden the servers to prevent similar future incidents.
• The goal of Vandelay Industries is not only to resist the simulated attacks but also to perfect their security posture by implementing industry-standard server hardening techniques and eliminating any deviations from their security baseline.

Category

• Server Hardening
• Incident Response
• System Administration
• Security Operations

Exercise Attack Steps

• Identification: The red team starts by conducting reconnaissance to gather intelligence about the target servers within Vandelay’s network.
  • Network scanning for identifying server IP addresses, open ports, and services.
  • Using social engineering to trick Vandelay employees into revealing sensitive information.
• Exploitation: The red team exploits various known vulnerabilities and misconfigurations.
  • Attempting to exploit known software vulnerabilities of outdated server applications.
  • Brute-forcing weak credentials to gain unauthorized access.
  • Injecting malicious scripts through unprotected web forms to establish backdoors.
• Privilege Escalation: Post initial exploitation, the red team tries to escalate privileges to gain administrative control.
  • Exploring the file system and misconfigurations to escalate privileges.
  • Dumping credentials and using pass-the-hash techniques.
• Lateral Movement: The red team attempts to move laterally within the network to compromise additional systems.
  • Using compromised credentials to access other servers.
  • Installing network sniffers to capture traffic and obtain further access.
• Persistence: The focus shifts to maintaining access within the compromised systems.
  • Setting up command and control channels.
  • Creating cron jobs or registry keys for persistence.
• Exfiltration: The red team tries to extract sensitive data from the servers, simulating the final goal of a real-world attacker.
  • Compressing and encrypting data files for exfiltration.
  • Using covert channels to bypass network security controls.
• Defensive and Hardening Steps: The blue team, alerted to the red team’s activities, engages in active defense and remediation.
  • Monitoring network traffic for anomalies.
  • Reviewing server logs for unauthorized access attempts.
  • Applying patches and updates to vulnerable applications.
  • Enforcing strong password policies and two-factor authentication.
  • Disabling unnecessary services and ports.
  • Implementing file integrity monitoring.
• Post-Exercise Analysis: Both teams come together to analyze the exercise.
  • Reviewing logs and attack steps to determine how defenses held up.
  • Discussing and addressing the weaknesses discovered.
  • Updating Vandelay’s security baseline to incorporate new hardening measures.
  • Planning for continuous security monitoring and regular Cyber Range exercises.