Cybersecurity content

All educational videos:

Leave a reaction on YouTube
Subscribe to Michał Sołtysik’s channel on YouTube

Deep Packet Inspection Analysis – Examining One Packet Killers:

Date: June 26, 2024

Security Operations Center (SOC) teams monitor network traffic using SIEM and IPS solutions, along with other security tools. However, these tools can sometimes fall short in their capability, particularly when faced with complex attacks that exploit legitimate network protocols, such as a single, crafted packet. To combat these threats, SOC teams must adopt advanced techniques such as Deep Packet Inspection (DPI). The webinar explores DPI analysis techniques to detect and mitigate “One Packet Killers”, using real-world examples from DHCP, H.225.0, Modbus over TCP, WTP, and BAT_GW protocols. Furthermore, it examines the intricacies of each protocol and highlights how specific message manipulations within these protocols can activate Denial-of-Service (DoS) attacks or disrupt communication flows. By mastering DPI techniques and addressing these protocol security weaknesses, SOC teams can enhance their ability to maintain a robust network security posture.

Leave a reaction on YouTube
Presentation PDF on github.com
Presentation PDF on files.fm

Deep packet inspection analyses – why the typical approach is not enough:

Date: November 24, 2023

There is an unquestionable need to perform regular deep packet inspection analyses, i.e. network edge profiling. Providing standard SOC type services that use tools, such as SIEM, SOAR, IPS, WAF, EDR and others leads to a partial waste of human resources due to the constant dealing with the so-called “false positives”. The cybersecurity industry is currently characterized by superficiality, insufficient competence and low cyber awareness. Cybercriminals are in possession of hundreds of mechanisms that they regularly take advantage of to break through firewalls. In this lecture, I will present an advanced view of the realities that teams such as SOC are unable to deal with, and explain why this is the case. I will use extensive knowledge of a variety of threats, based on analysis of 252 different network protocols from the areas of IT, OT and IoT.

Leave a reaction on YouTube
Presentation PDF on github.com
Presentation PDF on files.fm

Remcos RAT threat analysis on Windows including IEC 60870-5-104 traffic:

Date: November 23, 2023

Typically, malware uses popular protocols such as HTTP or TLS to exfiltrate data. However, Remcons uses IEC 60870 part 5, which provides a communication profile for sending basic telecontrol messages between two systems usually in electrical engineering and power system automation, for that very reason.

Leave a reaction on YouTube
Presentation PDF on github.com
Presentation PDF on files.fm