VakarisZ
commented
4 years ago The "phishing" scenario has nothing to do with the actual phishing. Monkey doesn't send emails, links and does not communicate with employees in any way and phishing doesn't necessarily result in leaked username/password. What would be a phishing scenario is if user manually crafted emails, added renamed monkey binaries to them and sent it around the company. Then waited to see how many machines communicate back to island. The "phishing" scenario should be called "leaked credentials", and description should be something like "Adversaries might compromise user's credentials by phishing, dumpster diving, physical access or simply buying them from the original owner. Enter user's credentials to see the impact of leaked credentials on your network"
Is your feature request related to a problem? Please describe.
Users would like to configure the Monkey according to the BAS scenario that they'd like to simulate. We should provide a built-in option to do that, instead of only providing external documentation.
Describe the solution you'd like
This depends on #637 being done. When entering the config page the user should choose between "manual" config or "Scenario picker". If Scenario is chosen, the user should get a subset of config fields with content next to each field which explains what to configure in this field for this scenario to work.
Describe alternatives you've considered
Consolidating and Improving the existing documentation.
Some examples of scenarios
Network segmentation
Segmentation is a method of creating secure zones in data centers and cloud deployments that allows companies to isolate workloads from one another and secure them individually, typically using policies. A useful way to test the effectiveness of your segmentation is to ensure that your network segments are properly separated, e,g, your Development is separated from your Production, your applications are separated from one another etc. “to security test is to verify that your network segmentation is configured properly. This way you make sure that even if a certain attacker has breached your defenses, it can’t move laterally from point A to point B.
Segmentation is key to protecting your network, reducing the attack surface and minimizing the damage of a breach. The Monkey can help you test your segmentation settings with its cross-segment traffic testing feature.
Phishing
Almost everyone is prone to phishing attacks. Results of a successful phishing attempt can be extremely costly as demonstrated in our report IResponse to IEncrypt.
This scenario begins in a section of the network which is a potential phishing spot. Phishing attacks target human users – as such, these types of attacks try to penetrate the network via a service an employee is using, such as an email with an attached malware or social media message with a link redirecting to a malicious website. These are just two examples of where and how an attacker may choose to launch their campaign.
To simulate the damage from a successful phishing attack using the Infection Monkey, choose machines in your network from a potentially problematic group of machines, such as the laptop of one of your heavy email users or one of your strong IT users (think of people who are more likely to correspond with people outside of your organization).
After supplying the Monkey with the passwords and usernames, execute the Monkey from the simulated “victim” machines. To do this, click “2. Run Monkey” from the left sidebar menu and choose “Run on machine of your choice”.
Single App attack surface
VPN
Jumpboxes
Worm breach from external services
Whether it was the Hex-men campaign that hit your Internet-facing DB server, a cryptomining operation that attacked your WordPress site or any other malicious campaign – the attackers are now trying to go deeper into your network.
To simulate this breach scenario, execute the Infection Monkey on different machines that host internet-facing services such as your web servers (Apache, Tomcat, NGINX…)
After executing the Monkey, evaluate the results of this simulation using the information in the Report page. There you will find a summary of the most important things the simulation has discovered, a detailed report of all the Monkey’s findings and more. You can also use the Infection Map to analyze the Monkey’s progress through the network, and to see each Monkey’s detailed telemetry and logs..