토요일, 10월 5, 2024
HomePersonal HealthBlack Hat USA 2024: SOC within the NOC

Black Hat USA 2024: SOC within the NOC


The Black Hat Community Operations Heart (NOC) gives a high-security, high-availability community in one of the vital demanding environments on the planet: the Black Hat occasion.

The NOC companions are chosen by Black Hat, with Arista, Cisco, Corelight, Lumen, NetWitness and Palo Alto Networks delivering from Las Vegas this 12 months. Cisco is the official Area Title Service, Malware Evaluation and Cell Gadget Administration supplier. The Meraki staff is writing a weblog in regards to the experiences in defending and managing the Black Hat cell gadgets.

The companions additionally present built-in safety, visibility and automation: a Safety Operations Heart (SOC) contained in the NOC, with Grifter ‘Niel Wyler’ and Bart Stump because the leaders.

Integration is essential to success within the SOC of the NOC. At every convention, now we have a hack-a-thon to create, show, take a look at, enhance and eventually put into manufacturing new or improved integrations. To be a NOC companion, you have to be keen to collaborate, share Automated Programming Interface (API) keys and documentation, and are available collectively (whilst market opponents) to safe the convention for the great of the attendees.

Promotional banner for the Black Hat Network Operations Center, showing a map of all of the Black Hat USA 2024 SOC Integrations

XDR integrations

Cisco joined the Black Hat NOC in 2016, when requested to offer automated malware evaluation with Risk Grid. The Cisco contributions to the community and safety operations advanced, with the wants of the client, to incorporate extra elements of the Cisco Safety Cloud:

The NOC leaders allowed Cisco (and the opposite NOC companions) to usher in further software program to make our inner work extra environment friendly and have larger visibility. Nonetheless, Cisco shouldn’t be the official supplier for Prolonged Detection & Response (XDR), Community Detection & Response or Collaboration.

  • Cisco XDR: Community Site visitors Visibility and Risk Detection/Risk Looking/Risk Intelligence Enrichment/Govt Dashboards/Automation
  • Cisco Webex: Incident notification and staff collaboration

The Cisco XDR command middle dashboard tiles made it straightforward to see the standing of every of the linked Cisco Safety applied sciences, the general menace panorama and the standing of community availability as monitored by ThousandEyes brokers.

Beneath are the Cisco XDR integrations for Black Hat USA, empowering analysts to research Indicators of Compromise (IOC) in a short time, with one search. We respect alphaMountain.ai, Pulsedive and Recorded Future donating full licenses to the Black Hat USA 2024 NOC. Additionally, try the weblog on XDR turning one 12 months outdated and the affect of Black Hat occasions.

One of many new integrations this 12 months was with a utility written by considered one of our SOC staff members. Each safety skilled — particularly SOC analysts and responders — have a sequence of “fast lookup” type instruments that they use to reply varied questions on artifacts in an investigation. Shodan is a good instance; “given an IP handle, what providers is that IP offering, and what software program are they utilizing to offer it?”. Paste the IP into Shodan, and you’ll seemingly get your reply. With the Shodan integration in XDR, you don’t even have to repeat and paste — simply click on the IP after which within the drop down menu, click on the Shodan hyperlink. However there are a whole lot of such instruments…

Screenshot of the integration server template

Ben took one of many integration server templates that Cisco Safety revealed on Github and modified it to our wants. He then hosted it on his cloud supplier of selection, added it to our XDR configuration and will add these easy pivots to XDR on the fly. A easy edit of a textual content file on the server and we may soar from any observable to any new related reference web site that anybody had recommended.

Cisco XDR is constructed on the beliefs of an open integration framework, with revealed information fashions, API specs and pattern code accessible to be modified or used as examples/tutorials (together with precise tutorials at DevNet). This dedication to extensibility permits for modifications such because the above with out requiring any motion from the XDR improvement or product groups, permitting prospects to tailor XDR to their distinctive wants.

For instance, an IP tried <AndroxGh0st> Scanning Site visitors towards the Registration Server, blocked by the Palo Alto Networks firewall.

Investigation of the IP confirmed: It was identified malicious.

Screenshot of the IP that was identified as malicious

Additionally, the geo location is in RU and identified affiliated domains. With this info, the NOC management authorised the shunning of the IP.

Screenshot of the Cisco Umbrella page showing the geolocation of the IP address to be originating from RU

XDR: Asset visibility

By: Ben Greenbaum

Screenshot of insights from the Meraki Systems Manager

Because the Black Hat community evolves, completely different distributors are given alternatives to carry their merchandise into the toolbox. Because of this ongoing biking, we didn’t have entry to the depth of intelligence beforehand offered by deployment of a Meraki wi-fi infrastructure. Nonetheless, because of the functionality constructed into XDR Asset Insights to add a customized CSV file of property, we had been in a position to simply operationalize identified community topography into investigative and response operations.

One of many distinctive challenges of the Black Hat setting is how completely different it’s from a “regular” buyer’s manufacturing community. Now we have just a few hundred gadgets whose safety is our major aim, however tens of 1000’s of unmanaged (and infrequently hostile) gadgets within the native community which we need to defend from one another and defend the skin world from. This distinctive association very a lot drives residence the worth that an EDR brings to an XDR resolution. With out good endpoint visibility, the problem is way larger. The good thing about an open XDR method that isn’t an evolution of an current EDR providing is that it may be considered one of a number of EDRs, however “one” is preferable to none.

Malware Analytics

By: Ben Greenbaum

Cisco Malware Analytics (previously Risk Grid) was once more used because the backend file evaluation and malware detection engine. We supported our companions from CoreLight and Netwitness, with evaluation of recordsdata pulled from clear textual content (convention attendee) and choose encrypted periods (essential infrastructure).

Screenshot of the Secure Malware Analytics dashboard

As typical, the recordsdata present in clear textual content communications had been indicator of what sorts of knowledge could be anticipated to be leaked by a crowd of safety professionals, and this 12 months the end result rated a strong “much less terrible.” Doubtlessly spicy content material included varied PII (names, employers, positions, e-mail addresses, and so on.) from Black Hat receipts and some company e-mail attachments. 

And whereas Umbrella did alert us to some wandering infections phoning residence, we will say that no less than no malware was transferred…within the clear.

By: Aditya Sankar

Cisco XDR features a built-in automation functionality referred to as XDR automation. You probably have heard of Safety Orchestration Automation Response (SOAR), Cisco XDR has the complete suite of SOAR options. That features the flexibility to drag-and-drop prebuilt code blocks in a specific sequence to create a customized workflow, executing arbitrary API calls to function one-click response actions and creating guidelines to set off workflows based mostly off a schedule or another standards.

Now we have been utilizing XDR Automate at Black Hat for 3 years to enhance the Cisco providers to our joint buyer, Black Hat, and have applied quite a lot of use circumstances. Nonetheless, this has sometimes required fairly a little bit of time to study APIs and create a very customized workflow. With the most recent XDR Automation Alternate, the Alternate web page is used to seek out, view, set up and uninstall pre-written workflows which were launched or authorised by Cisco engineers and content material suppliers. Workflows authored by the neighborhood have handed a primary high quality examine and are supported by the Cisco DevNet Neighborhood on a best-effort foundation. The Exchanges helps allow collaboration between workflow creators and moreover reduces the time it takes for a person to expertise worth from XDR automation.

Shout out to Ivan Berlinson, who wrote a workflow to tug menace logs from the Palo Alto Networks API and create Incidents in Cisco XDR. Since Ivan was type sufficient to publish the workflow to the Alternate, it was extraordinarily straightforward to import the workflow and get it operational. Putting in a workflow from the alternate is basically like strolling by way of a configuration wizard. It features a description of what the workflow does, the required targets and variables, in addition to a contact particular person for help. Here’s what the workflow seems like within the Alternate simply earlier than set up.

Screenshot of the Palo Alto Networks Firewall incident displayed in Cisco XDR.

This workflow requires Automation distant, on-premises digital machine deployed over ESXi to make sure correct connectivity to the Palo Alto Panorama equipment. Shoutout to Matt Vander Horst who helped with the vCenter required to deploy the Automation distant equipment. The Alternate prompts the person to offer values for the required variables and choose the suitable on-premises goal.

Screenshot of the workflow installation screen

Then the workflow is put in and scheduled to run each quarter-hour through an automation rule.

Screenshot of the Palo Alto Networks Firewall incident in Cisco XDR

This workflow makes use of the PAN-OS XML API to question for menace logs at this path <?sort=log&log-type=menace&nlogs=50>. This kicks off a search job. As soon as the search job is finished, the workflow retrieves the outcomes and begins parsing the menace logs. A Cisco Risk Intelligence Mannequin (CTIM) sighting is created for every particular person menace log and grouped collectively by inner host IP. Subsequent, a CTIM indicator with the outline of the menace log and a relationship to the corresponding sighting are each created. Lastly, an incident bundle is created with the sighting, relationship and indicator entities and posted to the XDR API. The workflow has logic inbuilt to examine for duplicate incidents and current indicators.

Screenshot of the Palo Alto Firewall search query

Here’s what one of many incidents that was created from this automation workflow seems like in Cisco XDR. This gave us as analysts within the SOC a terrific place to begin for an investigation.

Screenshot of the HTTP Director Traversal Vulnerability in Cisco XDR

These Palo Alto Community menace logs point out a listing traversal assault that goals to entry recordsdata and directories which might be saved exterior the online root folder. PAN Firewall alerts on listing traversal and accessing </and so on/passwd> from supply IP 192.168.130.86 on basic attendee Wi-Fi to vacation spot IP <104[.]198.XXX.2XX>, which resolves to < yXXXXis[.]get together>. This area is marked as suspicious by a number of menace intelligence sources and has a medium danger rating of 72 in Cisco Umbrella. The host then proceeded to obtain recordsdata from <file://var/run/secrets and techniques/> host with primary authentication within the HTTP POST header. This exercise was then correlated to comparable classroom exercise, however the host MAC handle was not seen in any school rooms.

Screenshot of the location data and host MAC address in Cisco Umbrella
Screenshot of the risk score

The vacation spot IP exhibits unknown with XDR menace intelligence, however the area it resolves to appears to be suspicious and it’s hosted within the Russian Federation, as seen within the Umbrella console. Listed here are further particulars offered by the Corelight staff in our energetic Risk Looking Slack chanel: HTTP POST exercise to the vacation spot in query exhibits a primary authentication token that decodes to <admin:p034BHUSA43op> which does appear to be it’s getting used for Black Hat coaching because it says BHUSA within the password. Nonetheless, this supply host’s MAC handle was not seen in any school rooms, solely on the overall Wi-Fi.

Screenshot of the MAC information
Screenshot of the results served

We did discover the host making comparable queries like <uri = /token$/ uri=/kubernetes/>, which had been seen within the Superior Infrastructure Hacking class, however it’s not sufficient to attribute this exercise to a category. Anyhow, this conduct sometimes shouldn’t be seen on the overall Wi-Fi. On this state of affairs, we didn’t take any motion of blocking the vacation spot IP or forcing a captive portal for host IP for the reason that Black Hat community goals to observe for assault and abuse, however not block malicious site visitors.

Ivan Berlison additionally offered one other workflow to supply an XDR Incident when a file is convicted in Cisco Safe Malware analytics. Corelight, in addition to NetWitness, carve recordsdata off the community and submit them to be detonated in Safe Malware Analytics. Here’s what the XDR incident seems like when a file with a menace rating above 90 is seen:

Screenshot of Secure Malware Analytics: Malicious Detection as displayed in Cisco XDR

We had a beautiful time innovating and investigating at Black Hat USA 2024! The XDR automation alternate was an enormous help in including extra automation capabilities with very minimal customized work. Take a look at AJ Shipley’s weblog on how utilizing Cisco XDR at Black Hat has accelerated our open ecosystem. We’ll be again once more subsequent 12 months, so lengthy Black Hat!

Splunk Assault Analyzer (SAA)

By: Ryan MacLennan

Splunk Assault Analyzer (SAA) is a brand new addition to our deployment. As you might know, Cisco acquired Splunk this 12 months. Due to this new acquisition we labored with our counterparts in Splunk to get their SAA product provisioned for our use at Black Hat. SAA is a file and URL evaluation platform much like Safe Malware Analytics. SAA makes use of a classy set of standards to find out which engine can be finest fitted to evaluation — like internet analyzer, static file evaluation, e-mail analyzer, signature engines and/or the sandbox. Whereas the product is able to dynamic and static evaluation, we selected to do solely static evaluation for our use at Black Hat.

What is really highly effective in regards to the evaluation of SAA is its assault chain following functionality: The power to intelligently decide how a human would click on on gadgets in a webpage. It’ll observe hyperlinks, obtain recordsdata and analyze further indicators from community connections, identified malicious recordsdata, an unknown malicious file that’s analyzed on the fly, phishing domains and extra. It’ll observe a logical stream like a human to find out the trail to compromise. This was attention-grabbing to see in the environment because it confirmed the trail from a file, the hyperlinks present in it, to completely different web sites, and every step of the trail had a screenshot for us to observe alongside.

For example, now we have a PDF that was submitted to SAA. It discovered hyperlinks within the file and adopted them to see if they’d result in one thing malicious. I’ve blocked out many of the URLs, however we will see the way it went by way of the PDF information and clicked on the hyperlinks to seek out out the place it will go.

Screenshot from the SAA Attack Analyzer

After SAA did its factor, we may take a look at the file in query and the screenshots that it took. We discovered that this file was the information utilized in a coaching room and every hyperlink was a reference to an article, a coaching useful resource (self-hosted and official), or different informational sources a scholar may have.

We had been ready so as to add this integration with the assistance of our companion Corelight. We talked to them on day one and so they had been excited to get a brand new integration developed with SAA. A couple of hours later, we had an integration with them. This was an incredible instance of how all of us come collectively to make the NOC higher at Black Hat yearly.

Umbrella DNS

By: Christian Clasen and Justin Murphy

You probably have learn the earlier Black Hat NOC/SOC studies, you realize that in 2023, we made a change to the DNS design. In prior conferences, we assigned inner forwarders to purchasers through DHCP, however didn’t pressure their use. Basically, attendees may use any DNS resolvers they selected, and we didn’t intrude. The change we applied was to start forcibly redirecting DNS site visitors to the on-premises DNS forwarders. You may see within the statistics above that this variation brought about a big soar in queries processed by Cisco Umbrella — from 54.4 million to 79.3 million.

The steep enhance in question depend was not surprising. What was surprising, nevertheless, was a lower in question depend between 2023 and 2024. Whereas we don’t know the exact explanation for this drop, we do have some theories and methods we will take a look at them going ahead.

One potential rationalization is the prevalence of encrypted DNS protocols. Lately, the trade has turned its consideration to the privateness, integrity and authenticity issues inherent within the plain-text DNS protocol. To resolve a few of these points, “last-mile” encryption has change into a favourite of OS and browser distributors. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) are solely a few the preferred methods to encrypt DNS between the consumer and the recursive resolver.

Detecting all encrypted DNS could be tough and counting the queries inconceivable. It’s because TCP is the chosen transport for DoH and DoT, and this permits the consumer to pipeline a number of queries over one long-lived TCP and TLS session. However what we will usually discover are the “bootstrap” plain-text DNS queries that allow to consumer to seek out the encrypted DNS server. By working a report in Umbrella for the class “DoH and DoT”, we will get a deal with on the preferred of those providers:

Screenshot of the most popular DoH and DoT services

The entry for <dns.google> is probably indicative of Android cell gadgets who use this DoT resolver by default. The depend of queries for that specific service is prone to be greater as a result of the periods on these gadgets are identified to be short-lived if queries are usually not frequent sufficient.

On this report, we additionally see “canary” domains comparable to <canary.masks.icloud.com> and <use-application-dns.internet>. The latter area is utilized by Firefox to detect when it ought to fall again to unencrypted DNS on the community. Extra particulars on how Umbrella interacts with these is written up within the Umbrella help article for internet browsers and DoH default.

Going ahead, we’ll monitor the statistics of those protocols on the convention networks and see what different info we will collect utilizing the complete packet seize capabilities of our companions and the menace looking capabilities of Cisco XDR. You may anticipate this matter to be expanded on within the subsequent convention report.

One of many major causes to no less than monitor DNS is to grasp tendencies and the way the community at Black Hat is getting used from a excessive stage. There are various insights that may be gained from forcing DNS by way of a centralized service with intelligence. DNS queries exist for locations that host every little thing from Malware, Crypto Mining and Phishing to content material classes like Social Media, Finance and Unlawful Actions. Moreover, these domains could be categorized into particular purposes as properly. With the App Discovery report in Umbrella, these domains are grouped by utility, figuring out the potential use of 1000’s of purposes. This might be internet apps or different desktop/cell apps.

As all the time, we proceed to see an increase in app utilization at Black Hat:

  • BHUSA 2019: ~3,600
  • BHUSA 2021: ~2,600
  • BHUSA 2022: ~6,300
  • BHUSA 2023: ~7,500
  • BHUSA 2024: ~9,300
Screenshot of a graph showing app category and risk at Black Hat USA
Total Most Widespread App Classes

This 12 months there was one stand out Software Class that has been rising in reputation: Generative AI. It’ll seemingly be no shock that there are extra attendees and their instruments utilizing Generative AI. Now we have gone from seeing it as a footnote in logs to reporting it at RSAC 2024, as we noticed 80 completely different Generative AI instruments getting used.

Evaluate this to Black Hat 2024, only a few months later, the place the entire quantity has jumped to 194.

Black Hat USA 2024

This doesn’t seem like only a distinction in conferences, however reasonably a rising development and acceptance of those instruments.

Community Assurance

By: Adam Kilgore, Shimei Cridlig, Shannon Wellington and Justin Murphy

The ThousandEyes deployment launched at Black Hat USA 2023 one 12 months in the past. At that convention, we spent many lengthy shifts growing the configurations, design, and procedures that shaped the idea for our convention protection. The deployment was additional improved and streamlined at Black Hat London and Black Hat Asia. At this 12 months’s Black Hat USA 2024, we had been able to increase our protection considerably whereas persevering with to refine our procedures.

New {hardware}

We added 20 Orange Pi gadgets at Black Hat 2024, along with the 8 Raspberry Pi gadgets we deployed in 2023. We’re nonetheless properly in need of the proverbial thousand eyes, however 28 is much more than 8. We deployed our new fleet of Orange Pi gadgets to observe the wi-fi community, whereas the outdated Raspberry Pi gadgets had been used for wired monitoring of Registration, the NOC and core community gadgets.

Orange Pi configuration

Man working at a table in a conference room; the table is completely covered in cords and power strips.
Our setup desk for preliminary deployment

Mike Spicer put in quite a lot of time to develop new configuration and deployment procedures for the Orange Pi gadgets earlier than the convention. We had been ready to make use of a script and a small native community to configure every Orange Pi with a particular SSID and PSK. As soon as the Pi gadgets had been configured and the goal entry factors had been deployed, every Pi was walked to its goal coaching room the place it will robotically connect with the entry level (AP) on bootup and start working its scheduled monitoring assessments.

Even with the scripting and automation, the configuration stage nonetheless resulted in a mass of wires (pictured above). Deploying the Pi gadgets resulted in additional strolling than the typical attendee would expertise in a convention (not pictured).

Expanded wi-fi protection

Screenshot of the dashboard showing monitored agents during briefings
A dashboard of monitored brokers throughout briefings

With the extra brokers, we had been in a position to deploy to extra Black Hat coaching rooms. The expanded visibility allowed us to catch extra issues earlier than the coaching rooms went reside, together with a misconfigured PSK, an SSID that wasn’t broadcasting and an SSID that broadcast however didn’t have web connectivity. We’d like to have an agent for every coaching room for full visibility and validation heading into the convention, however we’re pleased with what we caught and the extra confidence the brokers offered heading into the coaching days.

Because the convention shifted from trainings to the briefing days, we shifted our protection from the most important coaching periods to giant briefing rooms and heavy-traffic areas like the doorway and Enterprise Corridor. Whereas we nonetheless needed to make robust strategic selections about what to cowl and what to not cowl, we had been nonetheless in a position to unfold brokers throughout every ground for basic visibility.

Troubleshooting

Our experiences over the previous three conferences had produced well-established troubleshooting procedures and paperwork for the Raspberry Pi gadgets, however the Orange Pi devicess introduced contemporary challenges. We had round 25% of our deployed Orange Pi gadgets require troubleshooting throughout the first 24 hours after deployment, a regarding price. Log evaluation revealed the wi-fi NIC turning into disconnected and the USB coming into a disconnect loop (the wi-fi NIC is linked through USB on the Orange Pi gadgets). The issues with the wi-fi NIC and USB result in a recurring ThousandEyes agent core recordsdata — a tough set of issues.

Nonetheless, these points turned out to be remoted reasonably than widespread, and by the top of the convention we had a full wi-fi deployment that was staying up all day and in a single day as properly. For what turned out to be remoted wi-fi issues, we developed troubleshooting procedures and documentation.

Automated ticketing

A brand new ticketing system was rolled out at this convention that may create tickets in Slack based mostly on ThousandEyes information or reported points. Beneath is a ticket created based mostly on TE alerts for a particular convention room throughout the first morning of briefings.

Screenshot of a ticket generated from latency reporting
A ticket generated from ThousandEyes latency reporting

The dashboards in ThousandEyes allowed us to offer fast visible info that confirmed which convention rooms had been experiencing the worst latency, alongside a comparability of latency throughout reporting rooms.

Screenshot from the ticket showing high latency
A screenshot uploaded to the ticket, exhibiting latency within the reported room

The automated studies behind every dashboard entry offered extra granular info, together with site visitors path and the latency alongside every leg within the site visitors path.

Screenshot showing latency in the default gateway
A screenshot uploaded to the ticket that exhibits thelatency to the default gateway

The brand new ticketing system allowed screenshots like those above to be aggregated within the ticket for staff communication and file retaining.

Troubleshooting WorkflowOn 08/06/2024 at 15:00, we noticed excessive latency to our Inner Umbrella DNS take a look at from the South Seas D Hallway and Enterprise Corridor Brokers. Notice that the hyperlinks to the investigation views are offered as hyperlinks.

Screenshot of the ThousandEyes Latency Dashboard

To slim down the view, we used a dashboard filter to deal with the 2 Brokers.

Screenshot of the cloud and enterprise agents

This confirmed the excessive latency noticed by the 2 Brokers prolonged throughout a number of assessments.

Screenshot of the different agents suffering latency

From right here, we drilled down on every take a look at to examine the person take a look at outcomes.

Inside this view, we chosen a number of assessments working on each Brokers and in contrast the outcomes.

Screenshot of selecting multiple test running on both agents

We noticed that there was a latency spike reported by each Brokers.

Screenshot of the latency spikes reported by both agents

To know the reason for the excessive latency, we drilled right down to Path Visualization.

Screenshot of the path visualization

We seen the excessive hyperlink delay between the Agent to its gateway. This means a problem both between the consumer and AP or between the AP and the server room with the router.

Screenshot of the link delay between the agent and its gateway

To substantiate the reason for the latency, we visited South Seas D. We ran further assessments to substantiate that the connection expertise match with the outcomes reported by the Agent. Reviewing the room and topology diagrams additional, we discovered that the AP protecting South Seas D was positioned in an adjoining room, and was broadcasting two SSIDs — one for the room it was positioned in, and the opposite for South Seas D. The mix of the AP placement, the AP servicing two rooms, and the attendee quantity in South Seas D mixed to supply the latency noticed by the Agent. These findings had been shared with the wi-fi staff.

Cell gadget administration at Black Hat: The function of Meraki Techniques Supervisor

By: Dalton Ross

The Black Hat cybersecurity occasion in Las Vegas is famend for its cutting-edge know-how and seamless attendee expertise. A essential part of this success lies in efficient cell gadget administration (MDM). Since Black Hat USA 2021, we leveraged Cisco Meraki Techniques Supervisor (SM) to deal with quite a lot of duties essential to the occasion’s operations. Beneath is an in depth take a look at how the Meraki SM was deployed and the challenges confronted alongside the best way.

Important roles of cell gadgets at Black Hat

Cell gadgets had been pivotal in a number of key areas:

  1. Registration Kiosk iPad Gadgets (~50 Gadgets): Used at registration kiosks to streamline the attendee check-in course of, the place attendees scan a QR code for fast badge printing
  2. Session Scanning iPad Gadgets (~75 Gadgets): Deployed throughout Black Hat periods to scan registered attendees into every session
  3. Lead Retrieval Gadgets (~800 Gadgets): A considerable variety of gadgets had been utilized on the present ground cubicles to swiftly gather sales space customer contact information
Man working on a collection of iPhones at a table

Deliberate deployment for Meraki Techniques Supervisor

To make sure a easy deployment, our technique included a number of key steps:

  1. Pre-State with Apple Automated Gadget Enrollment (ADE): Earlier than cargo to the occasion location, all gadgets had been pre-staged utilizing ADE. This allowed gadgets to be configured with a identified SSID for sooner deployment on web site.
  2. Segregated Transport: Gadgets had been to be shipped in three distinct groupings, every comparable to one of many roles. This aimed to facilitate swift deployment upon arrival.
  3. Dashboard Script for Position Affiliation: A customized dashboard script was ready to leverage the Meraki Dashboard API and simply affiliate enrolled gadgets with their respective roles.
  4. Automated Configuration Obtain: As soon as powered up, gadgets had been anticipated to robotically obtain any crucial configurations or apps associated to their function, making them prepared for instant deployment.
  5. Well being Monitoring with Cisco ThousandEyes: ThousandEyes brokers had been to be deployed all through the venue to log SM well being at completely different occasion areas.
  6. Put up-Occasion Manufacturing facility Reset: After the occasion, all gadgets had been to be manufacturing unit erased earlier than being returned.
Screenshot of a group of people in a conference room configuring devices

Challenges and workarounds

As in life, challenges arose that required fast pondering and adaptation:

  • Software Checklist Modifications: A final-minute change to the appliance listing for session scanning gadgets was required. Though we initially deliberate to have all configurations prepared beforehand, this surprising change was effectively managed utilizing the Techniques Supervisor with only a few clicks.
  • ThousandEyes Agent Limitations: Since ThousandEyes brokers had been beta SM purchasers, they couldn’t precisely collect connectivity information. This was an anticipated conduct, nevertheless it posed a problem for efficient monitoring. To beat this, NOC members from Cisco ThousandEyes and Cisco Meraki collaborated to hack collectively a proof of idea. By means of arduous work and several other iterations, we configured the ThousandEyes brokers to simulate gadget check-in site visitors, mimicking legitimate SM purchasers.
Black Hat checkin stations

Deploying Meraki Techniques Supervisor at Black Hat was an intricate however rewarding endeavor. Regardless of dealing with challenges, our staff demonstrated agility and innovation, making certain the occasion’s operations ran easily. The expertise underscored the significance of flexibility and fast drawback fixing in managing large-scale occasions.

By leveraging superior MDM options like Meraki Techniques Supervisor, we had been in a position to present a seamless expertise for attendees and exhibitors alike, showcasing the ability of know-how in occasion administration.


We’re happy with the collaboration of the Cisco staff and the NOC companions. Black Hat Europe can be December 9-12, 2024 on the London eXcel Centre.

The Black Hat team poses together in the conference center lobby

Acknowledgements

Thanks to the Cisco NOC staff:

  • Cisco Safe: Christian Clasen, Matt Vander Horst, Aditya Sankar, Ben Greenbaum, Ryan Maclennan, Adam Kilgore, Shimei Cridlig, Shannon Wellington and Justin Murphy, with distant help by Jessica (Bair) Oppenheimer
  • Meraki Techniques Supervisor: Dalton Ross, with distant help by Paul Fidler and Connor Laughlin. Search for their report on The Meraki Weblog.

Additionally, to our NOC companions:

  • NetWitness (particularly Alessandro Zatti)
  • Palo Alto Networks (particularly Jason Reverri and James Holland)
  • Corelight (particularly Dustin Lee)
  • Arista (particularly Jonathan Smith)
  • Lumen and the complete Black Hat/Informa Tech employees (particularly Grifter ‘Neil Wyler,’ Bart Stump, Steve Fink, James Pope, Mike Spicer, Sandy Wenzel, Heather Williams, Jess Stafford and Steve Oldenbourg)

About Black Hat

Black Hat is the cybersecurity trade’s most established and in-depth safety occasion sequence. Based in 1997, these annual, multi-day occasions present attendees with the most recent in cybersecurity analysis, improvement, and tendencies. Pushed by the wants of the neighborhood, Black Hat occasions showcase content material straight from the neighborhood by way of Briefings displays, Trainings programs, Summits, and extra. Because the occasion sequence the place all profession ranges and tutorial disciplines convene to collaborate, community, and focus on the cybersecurity matters that matter most to them, attendees can discover Black Hat occasions in america, Canada, Europe, Center East and Africa and Asia.

Share:

RELATED ARTICLES
RELATED ARTICLES

Most Popular