Ten years of hacking and defending

Imagine this. It is 2015. Most of the desktops run Windows 7, some of the servers are still on Windows XP, every user is a local administrator, and network segmentation exists as a diagram rather than as a control. Nothing is watching. You have a Word macro, a Raspberry Pi small enough to hide behind a printer, and a rubber ducky waiting for somebody to walk away from an unlocked laptop.

That is where Slavi Parpulev, our Technology Lead, opened his talk at SagaLabs Community Night earlier this month, in front of around 70 people. He called it Ten years of hacking and defending, and it is the decade he has spent in the field.

Then the tools start arriving, and each one moves the ground.

PowerShell becomes a post-exploitation platform that runs in memory and leaves nothing behind. BloodHound turns Active Directory escalation from a hunch into a graph query, and surfaces paths nobody in the organisation knew existed. Coercion and relay. TIBER-DK, which kick-starts red teaming at a scale most of the organisations he met were not ready for. Hybrid identity, where the account on the floor and the account in the cloud turn out to be the same problem. ADCS, which is everywhere. And then the shift to identity-first testing, against tenants with no domain controller in them at all.

Each of those closed a door and opened a corridor. Ten years on, the number of routes that end in privileged access has not stopped growing, and a defender has to hold all of them while an attacker only has to find one.

So Slavi finished on what holds. Tiering. Fine grained password policy. Conditional access and MFA everywhere. Detection rules written for your environment rather than whatever came out of the box. No direct internet access from servers. And fixing what your last penetration test already told you.

Thanks to SagaLabs for making the room, and to everyone who stayed afterwards to keep the conversation going.