guardicore / guardicore/monkey

Add a "Configure Scenarios" wizard to the configuration 🧙‍♂️

Open
#673 3 comments 0 reactions 1 assignee Claimed by @ShayNehmad View on GitHub
Complexity: High Feature Impact: High UI
Dominant language
Python
Stars
7.1k
Forks
830
PR merge metrics
No merged PRs in 30d

Description

## Is your feature request related to a problem? Please describe.
Users would like to configure the Monkey according to the BAS scenario that they'd like to simulate. We should provide a built-in option to do that, instead of only [providing external documentation](https://www.guardicore.com/infectionmonkey/breach-and-attack-scenarios.html).

## Describe the solution you'd like
_This depends on #637 being done_.
When entering the config page the user should choose between "manual" config or "Scenario picker". If Scenario is chosen, the user should get a subset of config fields with content next to each field which explains what to configure in this field for this scenario to work.

## Describe alternatives you've considered
Consolidating and Improving the existing documentation.

## Some examples of scenarios

### Network segmentation

Segmentation is a method of creating secure zones in data centers and cloud deployments that allows companies to isolate workloads from one another and secure them individually, typically using policies. A useful way to test the effectiveness of your segmentation is to ensure that your network segments are properly separated, e,g, your Development is separated from your Production, your applications are separated from one another etc. “to security test is to verify that your network segmentation is configured properly. This way you make sure that even if a certain attacker has breached your defenses, it can’t move laterally from point A to point B.

Segmentation is key to protecting your network, reducing the attack surface and minimizing the damage of a breach. The Monkey can help you test your segmentation settings with its cross-segment traffic testing feature.

| Config Field | Extra text |
|-|-|
| Network Segments | In here, you should list all of your network segments. |
| Scan IP list | Put all the servers you'd like to test here. This should be a super-set of the Network Segments. |
| Scan Local Network | If you want to only check the IP list, uncheck this. However, for a full network segmentation test with maximum visibility, you should leave this on. |

### Phishing

Almost everyone is prone to phishing attacks. Results of a successful phishing attempt can be extremely costly as demonstrated in our report IResponse to IEncrypt.

This scenario begins in a section of the network which is a potential phishing spot. Phishing attacks target human users – as such, these types of attacks try to penetrate the network via a service an employee is using, such as an email with an attached malware or social media message with a link redirecting to a malicious website. These are just two examples of where and how an attacker may choose to launch their campaign.

To simulate the damage from a successful phishing attack using the Infection Monkey, choose machines in your network from a potentially problematic group of machines, such as the laptop of one of your heavy email users or one of your strong IT users (think of people who are more likely to correspond with people outside of your organization).

After supplying the Monkey with the passwords and usernames, execute the Monkey from the simulated “victim” machines. To do this, click “2. Run Monkey” from the left sidebar menu and choose “Run on machine of your choice”.

| Config Field | Extra text |
|-|-|
| Usernames | Put the credentials of "phished" users here. |
| Passwords | Put the passwords of "phished" users here. |

### Single App attack surface

| Config Field | Extra text | Default Value |
|-|-|-|
| Scan IP list | Put all the IPs of the app here. | |
| Scan Local Network | Make sure to **un**check this. | off |

### VPN

- [ ] todo @ShayNehmad take from https://www.guardicore.com/infectionmonkey/wfh.html

### Jumpboxes

- [ ] todo @ShayNehmad take from https://www.guardicore.com/infectionmonkey/wfh.html

### Worm breach from external services

Whether it was the Hex-men campaign that hit your Internet-facing DB server, a cryptomining operation that attacked your WordPress site or any other malicious campaign – the attackers are now trying to go deeper into your network.

To simulate this breach scenario, execute the Infection Monkey on different machines that host internet-facing services such as your web servers (Apache, Tomcat, NGINX…)

After executing the Monkey, evaluate the results of this simulation using the information in the Report page. There you will find a summary of the most important things the simulation has discovered, a detailed report of all the Monkey’s findings and more. You can also use the Infection Map to analyze the Monkey’s progress through the network, and to see each Monkey’s detailed telemetry and logs..

| Config Field | Extra text | Default Value |
|-|-|-|
| Depth | Try to estimate how deep your network is. If your network is completely flat, this should be 1. Add 1 for each sub-segment that you think is separated from the external network. | 3 |

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.