臺灣博碩士論文加值系統

近幾年來資訊科技爆炸性成長，雲端與物聯網的結合，企業組織網路架構日趨複雜。每個組織都需要一個有效的主動式資安防禦策略，這個策略對上能與組織安全政策呼應，對下能與安全目標結合。
然而主動式防禦，經常被認為是，主動的對軟、硬體進行弱點更新(Patch/Up-To-Date)，或是通過滲透測試(PT, Penetration Test)，便已足夠，但對於社交工程、實體入侵結合的駭侵風險便被忽視，造成組織誤以為已經達到高安全性。但網路罪犯不會只做漏洞驗證，取而代之，他們是有計劃的對組織進行駭侵，造成大規模資料外洩，或隱匿的網路間諜活動。
在本研究中，我們提出要達到高安全性，必須加入紅隊(Red Team)。紅隊演練(Red Teaming)是滲透測試更進階的型態，透過模擬真實攻擊，以最貼近真實入侵狀態來檢驗防禦措施的有效性、偵測與應變能力。除了協助組織發現已知的未知(Known-Unknowns)的問題，更進一步找出未知的未知(Unkown-Unknowns)的攻擊，從演練過程中擬定策略以達到更高的安全性。我們提出一個紅隊測試和防禦面的框架，透過情境模擬以及與滲透測試比較來証明紅隊能帶來的效益。

Modern information technology is developing exponentially，the network of business organization become more and more complex. Each organization is desperate to have an effective and proactive defense strategy for Cyber Security. The defense strategy should be adopted by the security policy and the security objectives of the organization. In addition, usually the defense strategy is often interpreted wrongly in doing Patch Management or Penetration Test only. This could lead to an illusion that their systems already are in high security. However, for cyber criminals or state-sponsored hackers, they not only exploit the software vulnerabilities, but also they are organized, funded, skilled operators to do massive data breaches or cyber espionage. In this thesis, we propose a Red Team methodology and framework in order to enhance higher cyber security. Red Teaming is a simulated cyber-attack for measuring the abilities of detection and response of the organization and for discovering Unknown-Unknowns risks to enhance cyber security of an organization. The benefits of Red Teaming are shown by the simulation in the experiment.

誌謝 v
摘要 vi
目錄 viii
表目錄 x
圖目錄 xi
1. 緒論 1
1.1. 研究動機 1
1.2. 研究目的 4
2. 文獻探討 6
2.1. 滲透測試 6
2.2. 紅隊演練 12
3. 研究方法 18
3.1. 威脅模型 22
3.2. 防禦框架 23
3.3. 攻防策略框架 26
4. 實驗結果 30
4.1. 實驗設定 30
4.2. 情境模擬 31
4.3. 紅隊演練實體安全面 33
4.4. 紅隊演練人員安全面 42
4.5. 紅隊演練技術安全面 47
4.5.1. Analyze 47
4.5.2. Compromise 54
4.5.3. Persistence 58
4.5.4. Report 87
4.6. 測試比較 89
5. 結論與未來研究方向 91
5.1. 結論 91
5.2. 未來研究方向 93
參考文獻 94

[1]Wm. Arthur Conklin, "IT vs OT Security: A Time to Consider a Change in CIA to Include Resilience," 2016 49th Hawaii International Conference on System Sciences
[2]Anestis Bechtsoudis , Nicolas Sklavos “Aiming at Higher Network Security Through Extensive Penetration Tests,” IEEE LATIN AMERICA TRANSACTIONS, VOL. 10, NO. 3, APRIL 2012
[3]Norah Ahmed Almubairik, Gary Wills, "Automated penetration testing based on a threat model," The 11th International Conference for Internet Technology and Secured Transactions(ICITST-2016)
[4]Teddy Surya Gunawan, Muhammad Kasim Lim, Mira Kartiwi, Noreha Abdul Malik, Nanang Ismail "Penetration Testing using Kali Linux:SQL Injection, XSS, Wordpress, and WPA2 Attacks," Indonesian Journal of Electrical Engineering and Computer Science, 2018
[5]Blake E. Strom, Joseph A. Battaglia, Michael S.Kemmerer, William Kupersanin, Douglas P. Miller, Craig Wampler, Sean M. Whitley, Ross D. Wolf "Finding Cyber Threats with ATT&CK™-Based Analytics," https://www.mitre.org/sites/default/files/publications/16-3713-finding-cyber-threats%20with%20att%26ck-based-analytics.pdf
[6]Chung-Kuan Chen, Zhi-Kai Zhang, Shan-Hsin Lee, Shiuhpyng Shieh "Penetration Testing in the IoT Age," 2018 IEEE Computer Society
[7]Farkhod Alisherov A & Feruza Sattarova Y "Methodology for Penetration Test," International Journal of Grid and Distributed Computing Vol.2, No.2, June 2009
[8]Muhammad Zunnurain Hussain, Muhammad Zulkifl Hasan, Muhammad Taimoor Aamer Chughtai, "Penetration Testing in System Administration," INTERNATIONAL JOURNAL OF SCIENTIFIC & TECHNOLOGY RESEARCH VOLUME 6
[9]PCI DSS Quick Reference Guide Understanding the Payment Card Industry Data Security Standard version 3.2.1, https://www.pcisecuritystandards.org/documents/PCI_DSS-QRG-v3_2_1.pdf
[10]Fireeye, “Apt1 report,” https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf,(Accessed on 12/12/2017).
[11]Hamed Orojloo, Mohammad Abdollahi Azgomi, "A game-theoretic approach to model and quantify the security of cyber-physical systems," Computers in Indusstry 88(2017)44-57
[12]Michael Mylrea, Sri Nikhil Gupta Gourisetti, Member, IEEE, Andrew Nicholls, "An Introduction to Buildings Cybersecurity Framework," 2017 IEEE Symposium Series on Computational Intelligence (SSCI)
[13]Bruce Schneier, "Liars and Outliers: Enabling the Trust that Society Needs to Thrive," Published by John Wiley & Sons, Inc 2012
[14]NIST SP 800-115, "Technical Guide to Information Security Testing and Assessment"
[15]NIST Special Publication 800-53A "Assessing Security and Privacy Controls in Federal Information Systems and Organizations"
[16]FedRAMP PENETRATION TEST GUIDANCE Version 2.0 November 24 2017
[17]CUONG T. DO, NGUYEN H. TRAN, and CHOONGSEON HONG, CHARLES A. KAMHOUA, KEVIN A. KWIAT, and ERIK BLASCH "Game Theory for Cyber Security and Privacy"
[18]Micah Zenko, “紅隊測試：戰略級團隊與低容錯組織如何靠假想敵修正風險、改善假設？” 大寫出版
[19]Jai Narayan Goel, BM Mehtre, "Vulnerability Assessment & Penetration Testing as a Cyber Defense Technology," Procedia Computer Science 57 (2015)710-715
[20]https://en.wikipedia.org/wiki/There_are_known_knowns
[21]Red Teaming : the art of ethical hacking, https://www.sans.org/reading-room/whitepapers/auditing/red-teaming-art-ethical-hacking-1272
[22]紅皇后理論，https://www.britannica.com/biography/Leigh-Van-Valen
[23]Finn, P., & Jakobsson, M. (2007), “Designing ethical phishing experiments,” IEEE Technology and Society Magazine,
[24]Luciana Obregon, ” Secure Architecture for Industrial Control Systems,” SANS Institute
[25]RedTeam, https://www.redteamsecure.com/, https://www.youtube.com/watch?time_continue=1&v=pL9q2lOZ1Fw&feature=emb_logo
[26]The Economist Intelligence Unit, Organisational Resilience:Building an enduring enterprise, https://www.bsigroup.com/LocalFiles/zh-TW/organizational-resilience/Org-res-EIU-report.pdf
[27]Joseph V. DeMarco, “An approach to minimizing legal and reputational risk in Red Tam hacking exercises,” ScienceDirect journal published by Elservier
[28]Steve Mansfield-Devine, “The best form of defense – the benefits of red teaming,” Computer Fraud & Security
[29]Hak5 Lan Turtle, https://shop.hak5.org/products/lan-turtle
[30]Skeleton Key, Dell Secure Work Counter Threat Unit, https://www.secureworks.com/research/skeleton-key-malware-analysis
[31]Privileged Access Workstations, https://docs.microsoft.com/zh-tw/windows-server/identity/securing-privileged-access/privileged-access-workstations
[32]NIST-SP-800-53 CA-8 滲透測試, https://nvd.nist.gov/800-53/Rev4/control/CA-8