PEOPLE PROCESS TECHNOLOGY

Kegiatan Bimtek
Kesiapsiagaan Teknis Insiden Keamanan Siber
Pada CSIRT Organisasi Pemerintah Daerah Tahun 2023
Surabaya, 22 Mei - 25 Mei 2023

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Daftar Isi

1.Ketahanan Siber ( Cyber Resiliance )

2.Insiden Siber (Cyber Incident)
3.Tantangan Masa Depan
4.Referensi Global
5.Solusi dan Tindakan Pencegahan
6.Alur Penanganan Insiden
7.Skenario

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
KETAHANAN SIBER (CYBER RESILIANCE)
Ketahanan Siber ( Cyber Resilience )

Provides the following definition of

Cyber Resilience
( SP 800-160 Vol. 2 Rev.1
Page-75 C.1 Defining Cyber Resilency )
Published December 2021

”The ability to anticipate,

withstand, recover from, and
adapt to adverse conditions,
stresses, attacks, or compromises
on systems that use or are
enabled by cyber resources.”

Source :
https://csrc.nist.gov/publications/detail/sp/800-160/vol-2-rev-1/final

KEMAMPUAN

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Ketahanan Siber ( Cyber Resilience )
GLOBAL CYBERSECURITY INDEX 2020
Published in Geneva, Switerland 2022

Source : https://www.itu.int/epublications/publication/D-STR-GCI.01-2021-HTM-E

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Ketahanan Siber ( Cyber Resilience )

Major

Attack
Types
you need to know
at least
Source : https://www.enisa.europa.eu/publications/enisa-threat-landscape-2021

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Ketahanan Siber ( Cyber Resilience )

Top cybersecurity threats facing the world in 2022

1. Social Engineering
Any network is hackable if an employee
can be duped into sharing access
3. Configuration
2. Third Party Exposure
Mistakes
Vendors, client, and app integrations with Even the most cutting-edge security
poor security can provide access to an software only works if it’s installed
otherwise well-protected network correctly
4. Poor Cyber Hygiene
Employee training is essential to ensure
those with network access maintain safe
cyber practices.

5. Cloud Vulnerability
Online data storage and transfer provides
increased opportunities for a potential
hack
7. Mobile Device
6. Ransomware
Vulnerability
Hackers can capture sensitive data or Devices that connect to multiple
take down networks and demand networks are exposed to more potential
payment for restored access. security threats.
8. Internet of Things
Smart technology users may not realize
that any IoT device can be hacked to
obtain network access.

9. Poor Data 10. Inadequate Post-

Management Attack Procedures
When massive amounts of unnecessary Security patches must be as strong as the
data are kept, it’s easier to lose and rest of your cybersecurity protections.
expose essential information.

Source : https://www.embroker.com/blog/top-10-cybersecurity-threats-2022/

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
INSIDEN SIBER (CYBER INCIDENT)
Insiden Siber - Internasional

Source :
https://www.businessinsider.in/cryptocurrency/news/solana-hack-that-drained-8-million-is-
linked-to-the-slope-mobile-wallet/articleshow/93363977.cms

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Insiden Siber - Nasional

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
TANTANGAN MASA DEPAN
Image source: https://ichef.bbci.co.uk/news/976/cpsprodpb/167DB/producti on/_104532129_tv050864711.jpg.webp
Tantangan Masa Depan

Sumber : https://indonesiabaik.id/infografis/seberapa-digital-masyarakat-imd-indonesia Sumber : https://www.bi.go.id/id/rupiah/digital-rupiah/Documents/White_Paper_CBDC-2022.pdf

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
REFERENSI GLOBAL
MITRE ATT&CK
MITRE ATT&CK threat models and methodologies

1 Reconnaissance 2 Weaponize 3 Deliver 4 Exploit 5 Control 6 Execute 7 Maintain

PRE-ATT&CK ATT&CK for Enterprise

• Priority Definition Initial Access Execution Persistence Privilege Escalation
- Panning Direction 1 2 3 4
• Target Selection
• Information Gathering Discovery Credential Access Defense Evasion
- Technical, People, Organizational
• Weakness Identification 7 6 5
- Technical, People, Organizational
• Adversary OpSec Lateral Movement Collection Exfiltration
• Establish Maintain Infrastructure
8 9 10
• Persona Development
• Build Capabilities
• Test Capabilities Impact Command & Control
• Stage Capabilities
12 11

Reference - https://attack.mitre.org/
Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
OWASP TOP 10

Latest Web Application risk based on OWASP Top 10 2021

Reference:
- https://owasp.org/

- https://owasp.org/www-project-top-ten/

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Vulnerability Database & Standards

Web Application Middlewares

• SQL injection lead information • Apache struts/Coldfusion/Weblogic

leakage

Content Management
Operating System
System ( CMS )

• Remote code execution (RCE) • WordPress Drupal Joomla!

• Windows, Linux, Mac, iOS, Android etc Vulnerability
Database Hardware
Application
Vulnerabilities Vulnerabilities
• Buffer overflow • BIOS, CPU etc
• MS-Office, Adobe, Java etc
Vulnerabilities in Protocol Level
Servers Vulnerabilities
• RCE • NTP, DNS, TCP etc
• Database, Web, Mail, DNS, remote login etc

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Vulnerability Database & Standards

Major Vulnerability Database and Standards

National Vulnerability Common Vulnerability Common Weakness Common Vulnerability

Database : NVD
The NVD is the U.S.
government repository of
standards based vulnerability
management data
https://nvd.nist.gov/
Exposure :CVE
CVE is a list of entries—each
containing an identification
number, a description, and at
least one public reference—for
publicly known cybersecurity
vulnerabilities.
Enumeration: CWE Scoring System: CVSS
The Common Vulnerability Scoring
CWE is a community- System (CVSS) provides a way to
developed list of common capture the principal characteristics
of a vulnerability and produce a
software and hardware
numerical score reflecting its
security weaknesses. severity.

https://cve.mitre.org/ https://cwe.mitre.org/ https://www.first.org/cvss/

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
SOLUSI DAN TINDAK PENCEGAHAN
Solusi Dan Tindakan Preventif

Build Computer Security Incident Response Team (CSIRT) is a must

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Solusi Dan Tindakan Preventif
Why is Cyber Hygiene
Important?
Every employee needs to
understand basic cyber hygiene
practices and their role in
protecting and maintaining your
IT systems and devices. This will
enable better incident
response and provide immediate
and effective defenses against
cyber attacks.
Reference :
https://www.upguard.com/blog/cyber-hygiene
Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah
What are Common Cyber Hygiene Problems?
Loss of Data
Hard drives, online cloud storage and
SaaS apps that store sensitive data
that isn't backed up or maintained
can be vulnerable to hacking,
corruption, data leaks, and data
breaches.
Outdated software
Software applications must have
security patches applied regularly to
prevent known vulnerabilities. The
success of the WannaCry
ransomware computer worm is a
great example of why patching
operating systems is an important
part of good cyber hygiene
Misplaced data
Poor cyber hygiene could mean
losing data in other ways, while it
may not be corrupted or gone for
good, it's increasingly common to
misplace data due to the myriad of
places it can be stored. This is
why robust data classification is
important.
Old security software
Antivirus software and other security
software must be kept up to date to
keep pace with the ever-changing
threat landscape
Security breaches
Data breaches are becoming
increasingly common, and
costly. Spear phishing, whaling
attacks, lack of configuration
management, and poor network
security can all lead to exposure of
trade secrets, PII, and PHI. This can
result in customer identity
theft, industrial espionage, and a loss
of market position.
Poor or lack of vendor
risk management
Number of your third-party
vendors and service providers have
access to your Wi-Fi networks or
process sensitive data on your behalf
Surabaya 22 Mei - 25 Mei 2023
ALUR PENANGANAN INSIDEN
Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
SKENARIO
Skenario
5. Berhasil melakukan
1. Attacker Access 6. Attacker membuat post
3. Attacker mencoba melakukan 4. Attacker mencoba bruteforce, Attack mencoba
Website melalui baru, dengan initial dirinya
bruteforce melakukan bruteforce login menggunakan akun
browser sebagai anonymous
hasil bruteforce

2. Attacker melakukan scanning Impact-1

menggunakan seperti NMAP, Web Defacement Hacked By 7. Post baru berhasil dibuat
Pada tahap ini attacker sadar tidak memiliki full access, sehingga Anonymous
WPSCAN, NIKTO, OWASP ZAP
memerlukan Tindakan lebih lanjut

8. Attacker mencoba 12. Metasploit attacker

9. Hasil scanning menunjukan 10. Attacker mencoba exploit
scanning Vulnerability 11. Metasploit mencoba berhasil masuk ke shell
Target vulnerable WP-File- yang direkomendasikan oleh
menggunakan exploit dan upload payload terminal target sebagai user
Manager RCE Metasploit
Metasploit www-data

Impact-2 13. Attacker upload file

13.1 Upload File Slot 888
Web Defacement Slot 888 pendukung sebagai
Judi Online
Judi Online persistence dan weapon

16. Attacker berhasil login 13.2 Attacker Melihat

15. Attacker berhasil 14. Attacker melakukan
Impact-3 ssh menggunakan akun bahwa terdapat user root
melakukan mendapatkan bruteforce ssh terhadap
Server Take Over yang memiliki akses dan Latihan yang memiliki
akses ssh menggunakan dictionary
privileges sudo akses privileges root

Kesiapsiagaan Teknis Insiden Keamanan Siber Pemerintah Daerah Surabaya 22 Mei - 25 Mei 2023
 “Dreams without goals are just dreams and
ultimately they fuel disappointment
On the road, to achieving your dreams you
must apply discipline but more importantly
concistency,
because without commitment you never start,
without concistency you never finish“

- Denzel Washington -

Terima Kasih
TERIMA KASIH