Description of Assignment
Objectives
During this internship assignment you will investigate a number of specific cyberattacks and analyse how organizations can protect themselves against them. You will set up a test environment in which you first carry out the selected attacks and then counter them with appropriate security measures. Afterwards, you will evaluate how these security measures affect the course and effectiveness of the attacks.
Within the scope of this assignment, you will get to study two cyberattacks: Pass-the-Hash and Cryptolockers.
Pass-the-Hash is an attack technique in which an attacker abuses stolen password hashes to gain unauthorised access to systems without knowing the original password. Here, you will examine how effective a Privileged Access Management (PAM) solution is at preventing or limiting such attacks. You will also evaluate how different configurations of the PAM solution affect the level of protection.
Cryptolockers, also known as ransomware, aim to encrypt the files on a system. Once the files have been made inaccessible, cybercriminals demand a ransom in exchange for restoring access to the data. In this assignment, you will compare the behaviour and impact of Cryptolockers between an unprotected and a protected environment, using an Endpoint Security Solution to protect the environment.
For both security scenarios, you will use the cloud-based Palo Alto Idira solution to secure the test environment and to evaluate how effective the different defence mechanisms are against the cyberattacks under study.
Objectives
The following deliverables are required during this internship:
- Setting up a test environment to be attacked and defended.
- Successfully executing a cyberattack using a cryptolocker within a test environment.
- Successfully executing a Pass-the-Hash cyberattack within a test environment.
- Securing the test environment using CyberArk’s Endpoint Security Solution.
- Demonstrating that the cryptolocker and Pass-the-Hash attacks are no longer possible, without any day-to-day impact on users.
Possible extensions:
- Securing the environment against credential theft and being able to demonstrate that the protection works.
- Configuring JIT (Just-in-Time) elevation of applications for users.
- Evaluating how implementing CyberArk’s Endpoint Security Solution affects system performance. Measuring and comparing the delays and system load across both environments.
Technologies & concepts involved
Palo Alto Idira
Cloud
Privileged Access Management
Hyper-V
Endpoint Management
Pash-The-Hash Attack
Windows
Cryptolocker Attack
Project Methodology
For its projects, Acen uses agile project methodologies such as XP and SCRUM. The project described above follows the same approach. These methodologies focus on safeguarding the quality of software solutions. We try achieving this by breaking the project down into shorter iterations and through intensive communication both within and outside the project team. The emphasis on intensive communication is an intrinsic characteristic of agile, resulting in thorough supervision throughout the internship period.
Profile
The ideal intern is first and foremost motivated to improve their skills and learn about a new field of technology.
There also exists a basic understanding of information security principles in networked environments, works well in teams and demonstrates great communication skills.
