2020 CyberDefense Summit

My take away from the talks from today:

 ()

Carson Zimmerman 

Keynote: Taking Your Detection Program to the Next Level

Engineering is difficult - stop lying to yourself and others about what the SOC needs to engineer, and 

engineer those items.

()

Don Murdoch

Building the Better Playbook: Techniques to Improve Repeatability

Build your playbooks in a repeatable manner to drive maturity and consistency.

()

Rob van Os

Metrics on Steroids: Improving SOC Maturity using the SOC-CMM

SOC-CMM is an exhaustive model for (self-)assessment of SOC Maturity and Capability. 

()

Steve Turner, Ben Tyminski

XDR - The Hidden Pitfalls of Evaluation and Deployment

XDR deployments have distinct limitations and capabilities. Leverage standard best 

practices while covering new ground.

()

Dan Banker 

And Then There Were None (More False Positives): Writing Better EDR Detections

Dan shreds his guitar - he also has obviously spent many hours eliminating the noise from his signal.

==LUNCH===

()

Peter Luo

Resolve Security Alerts with Adaptive Intelligence and Guided Response

Augmented Intelligence is available for scenarios you frequently encounter.

()

Kristy Westphal

Analysis 101 for Incident Responders

Develop your team's analytical methodology, and be ready to deal with the reality of not always being right.

()

Yochana Henderson, Mark Morowczynski

Hiding in the clouds:How attackers can use applications for sustained persistence and how to find it

"****** [devil|god|good god] is in the details." Flaubert, Mies van der Rohe, proverb... 

Make sure you understand what that configuration (button) does!

()

Ransomware Defense and Response: Minimizing Risk of an Increasing Threat

Gabriel Currie, Will Oram 

The main reasons for ransomware increasing : big money (140M pounds+ in 6 years) and many more leak sites that have driven organizations to pay ransoms.

()

Apurv Singh Gautam

Automating Threat Hunting on the Dark Web and other nitty-gritty things

Deep web? Data you're not allowed to see. Dark web? That's where your adversaries are coordinating their attacks on you and selling their illicit goods.

()

Christopher Lopez

Asking Questions and Writing Effectively

Are you asking the correct questions and capturing the appropriate information? Don't constrain yourself with needless process.

()

Saurabh Wadhwa

Resource Smart Detection with YARA and osquery

Yara : (Chess) If you see a good move, look for a better one.

()

Mark Baggett 

New Tools for your Threat Hunting Toolbox

Do what Mark does - save yourself one command a day, eventually, you'll be bored and start to automate other stuff.

 

 

 

 https://sansgear.com/product-category/cyber-defense-forum/

 

MY SANS Mentor to Certified Experience

This is a blogpost, and not intended to be a resume / CV quality recollection. So, some of the dates are off by a bit or missing. I went through the GIAC certification page ( https://www.giac.org/certified-professionals/directory/search ) and looked at the dates of certifications there and reconstructed this timeline of SANS classes and certs. I know there are a few missing (like the retired GIAC GSFP Fundamentals of Security Policy) that I took with James Tarala in 2007 (I think).

Rough Draft attendance and GIAC certs

Throughout this time, I was a facilitator for SANS because my employers couldn’t or wouldn’t pay for the classes. I facilitated at many conferences and summits.

I taught several semesters of classes at Tulane University College prior to Hurricane Katrina (August, 2005). The classes were BASH shell programming and Apache web server administration. These were in 2003-2005. I saw SANS as an opportunity to further my education and my interest in teaching on the side.

The first in-person class I took was SEC503 with Mike Poor at Virginia Tech during Spring Break, 2005. The classroom was a large auditorium with a couple hundred people in attendance. There was a funny wifi problem. Randy Marchany went on stage a couple of times asking people to turn off DHCP server in case someone was running one. Finally he went on stage and said, “*Joe Smith* you are running a DHCP server on your laptop. We’ve tracked your MAC address registered via our wifi registration to the DHCP Server serving bad leases. Shut it off now, or we’re going to come find you.”

In 2006, I was all over the place dealing with the aftermath of the disaster recovery from Hurricane Katrina. I was working remotely for Tulane still, I moved from Houston, to Memphis, to Athens, Georgia. Then, permanently to Maryland in the suburbs of DC.

In early 2007, I tried to run a SEC503 local mentor. There was no enrollment. I tried to run it again, maybe one person enrolled: cancelled. I tried again, one person: cancelled. SANS advised me to switch to SEC504. I don’t think they said this expressly, but it was essentially, “it sells much better and people will sign up for it.” Switch. I said no. I’ll do SEC503 first, I assured them.

My first SEC503 mentor session had three students. I ran it at the black rock center for performing arts with their projector. It went great. The three people in the classroom really enjoyed it, and learned a lot. I learned a tremendous amount. On average, I studied the material for about 10 hours for each hour of class time I lead. I spent my spare time learning this content while I was working full time in the cyber security domain. I had left the work from home position and took a position with a government contractor.

I got a call one day from Zoher Anis. “Chris, SANS called me and asked me to pick up a SEC401 that had some problems. I don’t know all the details, but it has to restart next week. I don’t have time to teach all the classes because of some travel I had scheduled. Can you co-teach it with me? I told them I won’t do it unless you co-teach with me. They really want it to run.” Zoher and I had worked for the same company at one point and we knew one another through the SANS community and that company. We had a common interest in security. We started co-mentoring classes. SEC401, SEC560, and SEC504.

“Chris, can you go to Georgia in two weeks to teach SEC560?” Scott Weill was asking me.

“Let me check, Scott. I need to verify I can get the time off work.” I knew my managers supported the SANS work I was doing on the side. But, this was something last minute and out of the ordinary. I was managing a 24x7 monitoring and response team at the time. They approved it. I made arrangements for my backup to deal with the projects I was working on while I was gone.

The class went great. There were folks there from many different companies and agencies. I met Russel Eubanks, who had recently moved to Atlanta.

Talks I've written, download
from: https://mgt517.com/soc

When I returned to work, I had a tough conversation with my customer management. He told me that he liked what I was doing with helping people, but while I was gone, some things had gone poorly. He said, he knew that if I was there, I would have addressed it and there wouldn’t have been any impact. But, my backup wasn’t prepared to deal with the unexpected. He told me that if I was a manager of a team, I needed to assure that things went the same in my absence as when I was present, because I wouldn’t always be present.

When I left full time employment, I arranged with my contractor employer and the customer to stop being the manager, and become an analyst on the team that I had previously managed. Someone else on the team became the manager. 

Eric Conrad had approached me about a project he was working on that would involve travel and development work. SANS had asked me to start teaching SEC401 at the Learning Tree in five days. I asked them for at least ten of these runs in the first year. Ten scheduled, but only six filled. I had basically scheduled myself 150% of the time because I was afraid that my “pipeline” of work wouldn’t come through. I was correct in some ways, but still over subscribed.

(The talks pictured are extra presentations I've written and are publicly available for download from: https://mgt517.com/soc . It's the sort of extra work that needs to be done to continue to develop one's knowledge and community outreach in pursuit of being an independent contractor and SANS instructor.)

I became a Certified Instructor in 2012. “Jul 18, 2012 at 2:44 PM. subject: Promoted to Certified - Chris Crowley.” I was teaching a lot. I was travelling a lot.

I’ve been traveling a lot since 2011. I’ve been home since I returned from Tokyo, Japan on March, 9^th 2020. Today is May 9^th, 2020. (Update: August 18th, 2020 and I haven't left home for any work travel yet.) I think these two (now five) months are the longest contiguous time period that I’ve stayed at home without work travel in the last ten years. I’m really enjoying it. I’ll be happy to pick up when it’s safe to resume travel.

There’s a new chapter unfolding for me in 2020. I’m really excited to tell you about it, but I can’t yet. It’s going to be a really big surprise, and you won’t guess what it is. Some of you are going to hate it, and some of you are going to be really happy for me. I'm excited! (Update: this has been deferred until 2021, but it is still coming to fruition!)

2019 SOC Summit - Action Items

Slide decks for talks available here:
https://www.sans.org/cyber-security-summit/archives/cyber-defense

Youtube Video (duration: 8:35) of these items: https://www.youtube.com/watch?v=W-GGqx-q_Rg

=-=-=- Day 1 =-=-=-

Keynote: Lessons Learned Applying ATT&CK-Based SOC Assessments
Action Item: Plan for an ATT&CK based assessment to identify coverage, internal or third party.

Use Case Development Utilizing an ARECI Chart
Action Item: Identify Gaps in coverage using ARECI charts built from use cases.

Use Cases Development as a Driver for SOC Maturation
Action Item: Tune down the noise.

A SOC Technology/Tools Taxonomy – And Some Uses for It 
Action Item: Compare your deployed SOC infrastructure to the proposed taxonomy.

Mental Models for Effective Searching
Action Item: Minimize time spent at the blank search bar by developing effective capability.

Managing Security Operations in the Cloud
Action Item: Familiarize yourself with cloud defenses available and integrate into the DevOps cycle to leverage them.

Virtuous Cycles: Rethinking the SOC for Long-Term Success
Action Item: Autonomy, Mastery, Purpose. Skills, Empowerment, Creativity, Growth. Automation->Efficiency->Metrics

2019 SANS SOC Survey Preview: Live Simulcast
Action Item: Download and read the 2019 SOC Survey when it comes out.


=-=-=- Day 2 =-=-=-

How to Disrupt an Advanced Cyber Adversary
Action Item: Focus on Network Awareness, Cyber Hygiene, and proper Device Configuration.

Breach -> ATT&CK -> Osquery: Learning from Breach Reports to Improve Cross-platform Endpoint Monitoring
Action Item: Whatever you choose to instrument your endpoints with, learn the granular differentiation of the host that will made detection and hunting meaningful.

Shared Security Services: How to Adjust to an Ever-growing Landscape of Security Operations Center Responsibilities
Action Item: Tell a good story about your SOC, and your internal collaborators.

The Call Is Coming from Inside the House: How Does Your SOC Respond When Attackers Are On-Site?
Action Item: Make people disappear. Think about how the physical matters.

How to Literally Think Like an Attacker to Become a Better Defender
Action Item: Think

Arming SecOps with a Special Forces Targeting Process
Action Item: Advance your thinking using intelligence

The Case for Building Your Own SOC Automations
Action Item: Automate good capabilities, that you already have or want. SOAR tools not required.

Rapid Recognition and Response to Rogues
Action Item: Know thy network (as much as you can).

This Will Never Work: Tales from Disappointingly Successful Pen Tests
Action Item: Demonstrate weakness to drive improvement. Take time to laugh.

New Orleans Recommendations

( Updates in 2018-02: Add these to your list: Willa Jean, Mammoth Espresso, Doris Metropolitan, Lattitude 29, Spitfire Coffee, Paloma Cafe  )

Since we're in the CBD, my favorite nearby places Cochon (but I really like butcher, it's less formal), Peche, Compere Lapin, August ($$$), Willa Jean, Juan's Flying Burritto (CBD location), Carmo, Luke on St. Charles, (great happy hour)...

Nearby for coffee: Revelator Coffee

Nearby for wine: Keife & Co, W.I.N.O

Nearby bar for hangout: Lucy's Retired Surfer, Vic's Kangaroo 

Stuff I'm going to check out this trip in the area that has opened recently: Bakery Bar, Espiritu, 

Magazine Street - Starting from Calliope, and running uptown, Magazine is a funky shopping district with lots of interesting independent stores. Check out Juan's Flying Burrito for awesome creole Mexican food. Cheap, filling, and good quality. (And loud music.) Lilette is expensive fine dining near Louisiana Avenue.

If you're uptown, check out Oak Street. Zotz is a cool coffee shop. For dinner, you can try Jacquesimo. It's a little pricy, but decadent new orleans style food. If you want that same type of food for cheap, Crabby Jack's on Jefferson Highway is run by the same guy. My favorite there is     Blackened Gulf fish with crabmeat remoulade sauce. Their Duck & Andouille gumbo is pretty damn good, too. Freret Street between Jefferson and Napoleon has become a culinary wunderbar. Amazing because when I lived there it was dangerous and all boarded up. Breakfast at bearcat cafe is excellent. High hat is New Orleans style. Ancora Pizza is well regarded.

Museums: Ogden (regional folk and outsider art), Museum of Modern Art, Contemporary Arts Center. The     D-Day (WWII) museum is supposedly really good. There's also a civil war museum.

Ride the St. Charles Streetcar line uptown to Audubon park, or go on the Canal Streetcar line to Mid-City for City park and the botanical gardens. If you're in Mid-City go to Angelo Brocado's Italian bakery for cappuccino, gelato, and cookies. It's at Carrollton and Canal Street.

Vietnamese food in NOLA is some of the best you can find in the country.  My favorite is Nine Roses. It's on the west bank (of the Mississippi) and a little hard to find, but we have big family style meals with between 5 to 20 people. It's an amazing feast, and ends up being about $25 per person.

For nice quarter restaurants, I suggest Bayona, NOLA (Emeril's place), Pelican Club, Mr. B's, or Palace Cafe. They're all fairly expensive. Tujaque's is old school New Orleans. Have lunch at Napoleon house. Definitely go to K-Paul's (Paul Prudhomme's cajun restaurant).  Find Cochon Butcher (butcher is the cafe style, Cochon is fine dining style) in the CBD (other side of Canal) for lunch. Any of Donald Link's restaurants are great. My current favorite restaurant in New Orleans is Restaurant August.

In the Treme (on the edge of the french quarter) check out Lil Dizzies for great New Orleans fare.

Check out Frenchmen Street. You can go to Snug harbor for burgers and a Jazz show. But, most people go to port of call on Esplanade for burgers. There are several good clubs on frenchmen St.: Maison, DBA, Yuki, etc.

The Bywater has several excellent places. Maurepas Cafe (update: CLOSED), Bacchanal on Poland Ave. Satsuma's for breakfast or lunch, Cake Cafe for breakfast  /lunch.

You can get good coffee at Cafe du Monde, but also Envie at Barracks and Decatur. For excellent espresso drinks, I like Velvet across from Whole Foods on Magazine. There's now a HiVolt uptown also on Magazine by Whole Foods. 

There's the original Hi-Volt on Sophie Wright place(near Magazine in Garden District near that Juan's), Mammoth Espresso and Spitfire in the CBD & Quarter.  Hi-Volt also great breakfast / brunch and baked goods, but they're much better at Sophie Wright location.

Try chickory coffee.

Go to Jean Lafitte's blacksmith shop on lower bourbon St. (go away from Canal St. past all the big clubs like Pat O'Briens and Cat's Meow, and past the gay dance clubs. ) Speaking of Pat O'Brien's, lots of people go there. 

Also, be sure to get to Preservation hall Jazz club before you start drinking one night to enjoy old style New Orleans Jazz. Probably the only place where you'll hear authentic old style.

If you still have time and money, you can check out the bywater. Look at going to Vaughn's. Take a cab, and take a cab back to the quarter / CBD. I would walk or bike from the quarter, but you don't know the area and it is not always safe. The bywater is very funky. May or may not be your thing.

St. Roch Market is a great food stall and has excellent happy hour cocktails.

If you want good beer, go to DBA on Frenchmen Street. 

There's actual Absinthe at the place on Pirate's Alley between the cabildo and the cathedral off of Jackson Sq.

For a good breakfast, go to Cake Cafe in the Marigny (past elysian fields from canal). I think it is on Decatur, but I don't recall. There's also Elizabeth's out in the bywater.

Tipitina's is a famous music club.  

There are a few things in there that didn't involve eating or drinking to do during the day.  Some people still want to go on the disaster tourist stuff.  If you want to rent bikes, go to my friend Bicycle Michael's on Frenchmen St.  Tell him you know me.  He'll probably say something like, a lot of people know Chris.  ;-)

Tune in to WTUL, 91.5FM.  It is Tulane's college radio station.  They've got club and event listings hourly, and you can win tickets pretty easily from them for shows.  Also check out WWOZ, 90.7 IIRC.  They are NOLA cultural station.  They also have club and event listings.

How Do I Get Started in Pen Testing?

Intro

I teach several different classes at the SANS Institute. Sometimes students are just starting out, and they're looking at how to apply the tools and skills they just learned. I'm writing this blog to provide guidance on the next steps. I'm going to try to be agnostic across the SANS curriculum, since that separation doesn't exist in most people's workplaces.

Practice At Work

First, be careful about just doing things at work. Some of the tools and skills we teach in SANS classes might not be appropriate for your job role. Instrumenting a computer network with a sniffer and monitoring traffic is a valuable defensive technique and capability. But, it might also be considered a wiretap in the United States (and most other countries). This potential violation of federal and state laws could get you fired and charged with a crime if done without permission. Same goes for penetration testing or unauthorized collection and inspection of digital evidence.
Solution: Get written permission from someone with the authority to give that permission to install monitoring or do forensics, or penetration tests.

Practice Outside of Work

If you don't have a chance to apply the lessons at work, what's another path?  I advise you to do three things. First, find some additional practice opportunities. Second, find an organization who could use your assistance and volunteer for them. Third, start to moonlight as a contractor.

Additional Practice Opportunities
There are a number of websites out there that give you a chance to practice your skills. Here are a few lists of freely available challenges:
https://www.amanhardikar.com/mindmaps/PracticeUrls.html

https://holidayhackchallenge.com/past-challenges/

https://hack.me/c/CHALLENGE

https://apsdehal.in/awesome-ctf/

Volunteer Opportunities

After you're confident in your ability to do simulate work, then it is time to move on to a real world circumstance. Truth is, you're probably not experienced enough to go right into the contracting and delivery. So this next step is a middle ground. Find an organization that you care about. This might be your church, your school, or your child's school. It could be your friend's small business or your neighborhood association. Select an organization that you're willing to contribute your time for free. 

Offer this organization the service you intend with an actual proposal. This will be a written agreement, and you're treating it like it is a business engagement.

My suggestion for how to think about the scope is to review this fantastic resource:

http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html

It's a bit older, but is an exhaustive list of the potential attack surface for a pen test or vulnerability assessment. There are a couple of template documents available as well. The primary artifact you'll be producing from your work is a report. Here are a large number of example reports:

https://github.com/juliocesarfort/public-pentesting-reports

Deliver the report, provide advice on how to fix it, and check in six months down the road to see how they've progressed on the proposed changes. You'll probably see that they haven't made much progress at all. ;) It's ok. Look for ways to help solve those issues.

Keep working with that organization and apply a different scope for another engagement, or find another organization to help.

Start a Small Business

Once you've done a small number of engagements for free, you're probably ready to start to charge for your services. Don't quit your day job quite yet. :)

Register an LLC with your state.

https://www.sba.gov/business-guide/launch-your-business/register-your-business

Develop the appropriate sort of contracts, usually  Master Service Agreement (MSA) and Statement of Work (SOW). One example MSA:

https://train.fastercures.org/assets/Tools/T1D-Exchange-Templates.pdf

Buy liability insurance and potentially errors and omissions for your business, you may also need workers compensation for some organizations you contract with (even if you don't have any employees):
https://www.fundera.com/blog/small-business-insurance

Find customers, deliver value, and grow your business!

Conclusion

That's a quick opinion on how you might proceed to develop your skills. You could also just have fun doing capture the flags and Netwars challenges from SANS.  If you have additional resource links that you think people should review for any of the above areas I've linked to, please include them in the notes. I'll add really good links back into the text of the post.

Instrumenting OS for Per Process DNS Query Inspection

Background information

Last night at #SANS2019 I attended Jason Fosen’s talk on process hacker and it reminded me of something I forgot to finish several years ago. I’m finalizing and posting now (several years later). This work was originally done on a windows 8 system.

Years ago, really way too long ago, I wrote a post about how to use DNS query logs to create a daily delta report to identify anomalies and novel connections: https://pen-testing.sans.org/blog/2015/07/10/dns-anomaly-analysis-tips-did-you-put-a-new-cover-sheet-on-that-ddd-report/

What's Doing That?

One of the things that I saw during review of the data was a weird DNS request.

Weird unqualified DNS requests. The unqualified version would be followed by the same random string in the search domain of the computer. Usually one or two queries with qualification. Something like biuivlhobb, then biuivlhobb.montance, then biuivlhobb.montance.local, as an example.

I looked into it via some online searches, and it was pretty clearly Google Chrome doing the queries. But, that wasn’t confirmed. So I dug deeper. I started thinking about how I could see inside of a system that a specific process made a DNS query. The OS was handling the query on behalf of a process. So, how could I see which process asked the OS to make that query?

My inquiry lead me to discover that the windows method for making a DNS request is getaddrinfo. The application would use this system call to do the lookup. https://docs.microsoft.com/en-us/windows/desktop/api/ws2tcpip/nf-ws2tcpip-getaddrinfo

So, I lauched process monitor to attempt to review what was actually making the calls.

Process Monitor : https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

There were two potential files of interest:

               C:\Windows\System32\dnsrslvr.dll

               C:\Windows\System32\dnsapi.dll

              

But, Process Monitor didn't show the details of the actual calls, so looked into APIMonitor:

http://www.rohitab.com/apimonitor

I set the filter to just look at getaddrinfo and related requests in case I missed something.

Killed existing chrome, started again, was able to identify the getaddrinfo requests:

Cool! chrome.dll verified as the source!

Security Operations Class Status

Summary

SANS MGT517 was cancelled and will not return. I will release the material in several ways over the next year: as an online resource (https://soc.montance.com), as an online class, as in person training, and in a project plan book.

Brief Background

I wrote the course that became SANS Management 517 because the two-day course I was a course author of, MGT535 – Managing Incident Response, didn’t seem to fulfill many of the questions that people were asking about. Namely, “How do I interface my incident handling capability to the Security Operations Center?”

Secondarily, there were always questions about the related disciplines of what I eventually called “Self-Assessment Function” within the SOC. How do I use, create, or mature my vulnerability assessment program? How can I convince the IT department to help us by getting a good baseline in place?

Additionally, there was a gap that several people echoed. There were several documents that identified various aspects of Security Operations Centers (SOC), but there was no single reference that said exactly what a SOC was. Carson Zimmerman’s book, and David Nathan’s book were great, but no one had publicly defined capabilities, staffing, the technology involved, and the things that a SOC ingested and what its output was.

What became MGT517 was my attempt to define a reference model around security operations centers (SOC) for organizations to consider. About 500 students attended MGT517 when it was available through SANS. These students were from countries around the world, and from every sector: from manufacturers of goods you use in your home; the companies who make the computers you use; companies who operate the largest cloud infrastructures in the world; companies who build the software that runs most major businesses; security software firms; financial firms; healthcare entities; representatives of governments. Each time I taught the class, there was a chorus of “Thank you.” I can take this back to my organization and say here’s how we should do this. There was a common theme of there not being any other resource or class which covered this topic. There was usually also constructive criticism and valuable insight shared by attendees.

I am disappointed that SANS chose to cancel the class. But what SANS didn’t cancel is my commitment to continue to develop the material. The SOC, and security operations in general is a critical capability for organizations around the world.

I previously mentioned an Analysis of Competing Hypotheses (ACH) write up on why MGT517 was cancelled. It is still underway. It’s going very slowly, but will be published eventually. That matters less than what I’m going to do next, so what follows is that information.

Crowley Motivations

Material Access and Community Value

I want people to see the information I wrote. I think it provides tremendous value because it puts forward a reference model. You’re welcome to disagree with it. In fact, I would say that you must at least consider that the model may not be a good match for your organization.  I’ve tried to envision and account for every possibility. So, the tailoring to your organization is certainly present in such an abstracted and generalized model.

In addition to the security operations class, I am writing a book to provide a project plan for building a SOC. This should provide a very low-cost option for organizations to access the concepts expressed in these various forums and provide a project plan for the organization to build a SOC.

Business Development

I want to work on interesting SOC projects. I’m only a single person, and I won’t have a team of people working for me. Why not? Because I’m not interested in building a company at this time. That takes away from my ability to focus on the subject matter. But that means that I can’t delegate tasks to people and help lots of companies simultaneously.

It means my ability to get involved in projects is very limited if I want to keep my quality level high. My SANS teaching and course development has consumed a large amount of my time for the last three years. I’m taking the time I was exerting for MGT517 course development and shifting it to course development for an online version and an onsite version outside of SANS. I will have time for no more that 3 or 4 contract customers at any given time, if I continue to teach for SANS and try to run a class independently. There’s a risk in attempting to do all of this, as SANS may see this effort as competitive and choose not to ask me to instruct classes. Setting up courses live takes a lot of time and effort, and marketing the classes is a massive uphill battle. Enrollment, payment systems, and onsite logistics are expensive. Life’s a risk.

Actions Planned

Web Resource

I paid a developer to build a website for me to have a forum for SOC discussion by vetted individuals. I haven’t been able to get back to that effort due to so many different things going on. I’ve tried to find an intern to help me to populate content onto the site. If you’re interested in helping me with the initial deployment of material, please let me know. You wouldn’t be writing anything, just populating material into the website. This will be about a 3 month effort. Twitter is the best avenue to start this conversation: @CCrowMontance.

I have a lot of material buried in slide decks that aren’t accessible to people. My intention is to rescue that information from the powerpoints I’ve build and move it to a forum for people to review and for knowledgeable people to have meaningful discussions. My intention is to vet the people who can discuss, but have the discussions be public. I think this is the best way to produce high quality content. Even without community participation, it will be a place where I can share the research and analysis I have done.

Online Class

The easiest way to get access to the material will be an online version available through NetworkDefense.io. The price will be affordable and the material will be adjusted to an online format. Once done, this will run perpetually and will be available on your schedule.

Live Class

This will probably be a three day event, limited to 25 participants. I’ll go to locations that are good options for me and where I think people want the event to run. This will be very much of a DIY effort, and if you’re interested in helping me to run the class or want it as part of your conference, I’ll certainly consider it. Also, private onsite runs are available with a focus on your organization’s specific implementation.

Tentative Scheduled Events & Locations

This list is ambitious, and I suspect several of these classes will not run, but I’ll try to make them all happen.

·        Online: Expected date of initial availability : November 1, 2019

·        December 2-4, 2019 : Washington, DC Area : Security Operations Class – Public Enrollment

·        January 8-10, 2020 : New York City, NY : Security Operations Class – Public Enrollment

·        March, 2020 : Macau or Hong Kong : Security Operations Class – Public Enrollment

·        June, 2020: Europe or Middle East, TBD

·        August, 2020 : Las Vegas : Security Operations Class – Public Enrollment

·        November, 2020: Melbourne, Australia : Security Operations Class – Public Enrollment

I look forward to seeing you there.

Very Good: Not Good Enough

As a follow on to my previous post, I want to address the cancellation of SANS MGT517.

The short story is there will be no additional offering of this course via SANS, and that is a final decision. I will provide training in the Security Operations Center subject matter via some non-SANS vehicle, stay tuned for the exact details around this in 2019.

The class was cancelled because the scores (from the daily feedback forms) were not good enough for SANS. I'm not going to address the relative merit of that decision, but needless to say I'm disappointed. 

Nonetheless, I think the content I wrote for MGT517 is very valuable to the community, and most of the students who have taken the class have expressed their appreciation of the material, and how it has helped them.

That's all I have for now. Next update after the new year.

File under #Failure: MGT517 cancelled

Personal failure is always tough to acknowledge. MGT517 has been cancelled from any future runs. There are three remaining in 2018, and none scheduled in the future: https://www.sans.org/mgt517

Standby here for my analysis of this situation and what lead to it. I will also include some speculation on next steps. Expected time frame is mid-November.

2018 Security Operations SOC Summit wrap up

2018 SOC Summit is finished, the MGT517 following it is almost done. I'm enjoying co-teaching it with Carson Zimmerman. It's his first time out, and I've enjoyed hearing his perspectives on the material.

I'll hit the high points from the talks with my favorite take away from each. For the TL;DR, have a few memes from the talks.

You should download the talks from here:
https://cyber-defense.sans.org/resources/summit-archives

Carson:
. Measure not just the breadth of your log collection, but the depth
. Unit test your SIEM rules / use cases
. Track your SIEM use case analyst quality
. Analyst baseball card

Shelly & Brett
. Establish Trust and protect it
. Scribe to collect and report: but everyone is repsonsible for taking notes!

Alissa
. Insight into the state of your potential hires. Go read what they are saying about their prospects.
. Chaos is not for everyone
. Bad apples spread bacteria
. Let Alissa talk to your SOC analysts! Figure out the problems and address them.

SOC Survey
. Hard to collect data, and we don't have a defined data set, but here are the highlights for this year's survey.
. Tune in for the webcasts and download the paper.

CompariSIEM
. tools matter, but making the most of the tool is the path to success

FOOD, not FUD
. Framework of 5 items to provide Factual, Objective, Optimized Data

Sun or Stars
. Challenges are abundant, few organizations are thinking about striving for what's best for the long term

Hacking your SOEL:
. Move the activity to the front of the response activity

All about your Assets:
. Identify tools that contain the information you need, and figure out how to connect those tools together

The Healthy SOC: A Case Study:
. I'm going to ask you next year to come give a presentation about how you moved from where you are today to what you are next year. Will we be impressed? ;)


-=-=-=-=-=- ~Day 2~ -=-=-=-=-=-

What the CISO Really Wants
. Have an in person conversation once a month with no computers, no technology, where you listen to understand

Building the SecOps Use Case:
. Develop the program for building and assessing use cases, starting with business use

Back to Basics: System Integrity
. Integrity Monitoring is important for identifying change

TTP Zero:
. Normalize the data to constrained conecpts to effectively and consistenly deliver the message on security operations

Technical to Managerial positions:
. It's a different skillset, you probably can't be both

Threat Hunting Tour de Force
. Start with ad hoc techniques then migrate them into procedures

Burning Down the Haystack
. operational tasks should be operational, identify pain points and fix them

Most Dangerous Game:
. Assess if you have full coverage using ATT&CK

Metrics, metrics, everywhere and not a lot of thinking

Someone sent me a personal e-mail asking for guidance on metrics, so I thought I would replicate that here publicly.

Also, Carson Zimmerman will keynote at the SOC Summit in New Orleans in August, 2018 with a talk specifically on metrics. Hopefully you can make it to that event. If you can't make it, you can check out that talk afterward via video.

When starting out, I'd pick 3-5 reported metrics and a couple of service level objectives to start. Too many metrics results in diminished clarity on if you're meeting the objectives of the organization.

Metric

. Time to detection

. Method of Detection

. Time to initiate Response

.  Root cause analysis: Level 1,2,3. 

1 is a measure was available, but wasn't applied

2 is a measure was available, we chose through risk acceptance not to apply and it allowed issue to occur

3 is "zero day" - no measure was available

Service Level Objectives

. Initial notification within 1 hour to system owners of affected systems

. Eradication results in final closure, no need to reopen 100% of time

Online resource, look at Veris, which is the data schema behind the Verizon DBIR:

http://veriscommunity.net/incident-track.html

Look at Pescatore's "briefing the board" info:

https://www.sans.org/summit-archives/file/summit-archive-1496685631.pdf

https://www.sans.org/webcasts/influencing-effectively-communicating-ceos-boards-directors-103927

For a book to read on metrics, the standard reference is Joqaith's Security Metrics:

https://www.amazon.com/Security-Metrics-Replacing-Uncertainty-Doubt/dp/0321349989

Also look at the Hubbard / Siersen  "how to measure risk" book. Rich gave a talk last year at the SOC summit, but I don't see the talk posted. 

https://www.sans.org/summit-archives/cyber-defense

File under #failure

Equifax announced a massive breach of tax payer information.

TL;DR : Lock your credit accounts:

https://www.experian.com/freeze/center.html#content-01
https://www.innovis.com/securityFreeze/index
https://www.transunion.com/credit-freeze/place-credit-freeze2
https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp

Basic recommendation, freeze your credit report. This does two things. First, it protects you. Second, if most US taxpayers freeze their credit it will change the way these companies do business. They're collecting information about you and reselling it to third parties. They'll charge you a fee (credit monitoring) to protect that information. In my opinion it is perverse that they'll only protect your information for a fee. It will be interesting to see how the class action law suits which follow will shape the credit monitoring services.

I'm also interested in how the Internal Revenue Service (IRS) of the United States addresses this. They've been pretending for two decades too long that the social security number is somehow a shared secret. It is not. Time to re-key, IRS. You have suffered a data breach through an irresponsible vendor partner. You've allowed these vendors to leverage your information for far too long. Fix this broken system.

SANS SOC Summit 2017

A quick listing from each talk on TODO items that I extracted from the presentation.

The presentations are available here:
https://cyber-defense.sans.org/resources/summit-archives

Day 1

Keynote Good vs Evil: Winning the Age Old Battle
Doug Burks (@dougburks), CEO, Security Onion Solutions LLC
TODO: Practice Japanese. More work on motivating people to perform optimally.


Stuck in the Box: A SIEM's Tale
Justin Henderson (@SecurityMapper), Systems and Security Architect, GSE # 108, Cyber Guardian Red/Blue
TODO: Develop a list of "go to" Event IDs

How to Measure Anything in the SOC
Rich Seiersen, Former General Manager - Cyber Security & Privacy, GE Healthcare
TODO: Develop predictive analytical model for SOC (and read Rich's book)

Metrics for Justifying SOC Investment to the CEO and Board
John Pescatore, Director of Emerging Security Trends, SANS Institute
TODO: Decide on key performance indicators and develop report / dashboard to depict them.

Debunked: Traditional IR Calls
Gregory Braunton, National Director, Threat Management, Incident Response and Forensics, Catholic Health Initiatives
TODO: Visual collaboration tool. (Reminds me also to develop the ACH rubrics for common incident scenarios.)

Siri for SOC: How an Intelligent Assistant can Augment the SOC Team
Bobby Filar (@filar), Sr. Data Scientist, Endgame
Rich Seymour, Sr. Data Scientist, Endgame
TODO: Develop question based playbook for analysts.

The Need for Investigation Playbooks at the SOC
Matias Cuenca-Acuna, Principal Engineer, Intel Security

Ismael Valenzuela, SANS Certified Instructor, GSE #132; Global Director of Foundstone Consulting Services
TODO: Differentiate response playbook and investigative playbook, refine current playbook.


Day 2

Keynote: Survey Says: Actionable Insights from the SANS SOC Survey
Chris Crowley (@CCrowMontance), SANS Institute
TODO: Build a survey that captures a representative sample of SOCs globally.

SIEMple Simon Met a WMIman
Craig L. Bowser, Sr. Security Engineer, Dept. of Energy
TODO: Adapt this for SOC Analysts, and have a punch list of checks to be sure they're accomplishing these checks.

Inattentional Blindness (IB) & Security Monitoring
Ismail Cattaneo, Sr. Manager of Security Operations & Engineering, Verizon Enterprise Solutions
TODO: Pay attention, and keep working on a converged analytical methodology between "Organizational Dimensions, Analysis of Competing Hypotheses, Kill Chain, and Diamond Model"

Hunting Adversaries with "rastrea2r" and Machine Learning
Gabriel Infante-Lopez, Software Architect & Data Science, Intel Security
Ismael Valenzuela, SANS Certified Instructor, GSE #132; Global Director of Foundstone Consulting Services
TODO: Look at the open source project for collecting information between disparate tools.

Color My Logs: Understanding the Internet Storm Center
Johannes Ullrich, PhD, Dean of Research, SANS Technology Institute
TODO: Look for ways to enrich information in SOC data with restful information from within SANS ISC. Install a Raspberry Pi.

SOCs for the Rest of Us
Dave Herrald (@daveherrald), GSE #79, Senior Security Architect, Splunk
Ryan Kovar (@meansec), Staff Security Strategist, Splunk
TODO: Take the questions Dave and Ryan used and turn it into an assessment capability.

Building the Cybersecurity Workforce We Need: Creating Pipelines and Pathways Without Poaching
Arlin Halstead, Strategic HR Business Partner, NTT Security
Maxwell Shuftan (@SANSCyberTalent), Director of CyberTalent Solutions, SANS Institute
TODO: Refine hiring standard questions and look at retention methodology.

DDoS Attacks in Action
Ben Herzberg, Security Research Group Manager, Imperva Incapsula
TODO: Practice Python. Inventory DDoS vulnerability assessment and remediation tools.

Threat Hunting Summit 2017 and MGT517.2017.2

I had the opportunity to see many great talks, but missed just as many due to obligations and getting other work done. If you didn't get to attend the THIR summit, the high quality videos should be online soon here:

https://www.sans.org/event/threat-hunting-and-incident-response-summit-2017/summit-videos/

If you are interested in my talk, you can see the powerpoint here:

https://bit.ly/crow-th

More elaboration on the security operations functional areas here:

http://www.montance.com/mgt517

Thank you to the people who took the time to chat with me about their opinions or experience on the topics I covered. It's tough to present a complete system in 30 minutes. I hope your organization has a strategic vision for what your security operations is going to be. If you don't, steal my diagram from the bit.ly link above and start to plan for how your functions can work together to optimize your scarce resources.

Also, much appreciation to the folks who attended MGT517. I was impressed by the discussions we had. I feel like I learn a massive amount each time I teach. Some of it is validation of the opinions I hold, some of it is a challenge to my approach. Criticism and permutations help to refine the system. I'm excited about a few things that I'm going to incorporate. First is the notion of a more data-centric depiction of the metrics I advocate for the SOC. Another enhancement planned for the next revision is a deeper dive into threat hunting scenarios. Finally, ACH brainstorm templates for incident types to encourage analysts to employ ACH, Kill Chain, and Diamond Model as analytical tools.

Positive feedback

...never has a SANS track been more relevant, timely, thorough, and pragmatic as I found the MGT517 course to be. In my opinion, Chis (and I am quite sure an entire team of reviewers) has thought of, considered, and addressed every issue that I have encountered in my journey to standing up an internal SOC at my company.

Positive thoughts. There are many things I'd like to refine within the class, but I appreciate the acknowledgement.

MGT517 Hot Wash - Orlando - 2017-04-14

MGT517 Hot Wash - Orlando - 2017-04-14

The first official run of MGT517 just wrapped up in Orlando, FL.

Primary take away messages from the attendees.
1. There are a number of companies trying to build a SOC, but they're not exactly sure what a SOC is.
2. Political issues are more difficult to overcome than technical problems.
3. I'm roughly 12-18 months late on this class. A common comment from people, "I wish I had taken this class 12 months ago when I started building the SOC for ____ company."

Some improvements I plan to make:
1. In the Design discussion, depict the ways we're going to cover the material in the build, operate, and mature sections. (TODO - near term)
2. Set up a website with resources for reference (TODO - near term).
3. Adjust the metrics to present the balanced scorecard approach, and include some of the examples that John Pescatore gave in his lunch time talk to the class. (TODO - near term)
4. Enhance the swimlane diagram depicts the functional area process relationships with updated inputs, people, artifacts, and technology. (TODO - ongoing)

I was pleased by the excellent attendees. Lots of great discussion and insight shared by people. A benefit of the class is making the connections with the small number of other professionals in the space.

Finally, I'm thrilled at the overwhelming response of people to attend the course. I know that it is full for the next couple of runs. Anyone who is unable to get into the class, please be patient, we're running the course many times this year. Take a look at the events later this year. If the demand is persistent, I'll work with SANS to add additional runs this year.
 

Three Characters (Caricatures) of Incident Response

I've been using this set of three types of IR characters to describe my opinion on the capabilities. I thought I would share it. I'll try to "polish the turd" at some time in the future.

We need all of these capabilities in IR/SecOps. Having each in the right measure is the trick. A few Eagles and no Janitors isn't going to work.

Janitor

Not glorious or proactive, the Janitor is tasked with clean up. This occurs after the incident has transpired. This is a necessary capability, is usually the first capability to be developed, and should be operational to the degree that the janitorial services is low cost, effective, and capable of dealing with the sorts of messes the organization produces.

The janitor sometimes finds things left behind that are interesting, and should know to bring this to the attention of the appropriate component of security operations. Janitorial services are frequently outsourced, should be relatively low cost, measurable, and repeatable. These tasks can be level 4 (measured) or 5 (optimized) on the CMMI scale.

Janitors infrequently have the agency within the organization to affect change. Albert Einstein famously discussed his most difficult problems with the janitor. Maybe it was because the janitor was the only one around at his odd work hours. Maybe the conversation proceeded because the janitor could see all the details of tings left undone by people that made his job unnecessarily difficult.

Firefighter

A proactive capability, with the opportunity to minimize damage. Firefighters are trained to address the most critical aspects first: save the people and the animal’s lives first. In information security terms, this includes tasks of preventing exfiltration or more generally actions on objectives, to use the Cyber Kill Chain® terminology.

The next order of business for firefighters is to simultaneously prevent the spread of the current blaze to nearby fire sources. This might be buildings, or it might be portions of the landscape when dealing with wildfires. When conditions are optimal, stopping the spread of the fire is relatively easy. If the nearby buildings are made of concrete with metal roofs, the required temperature to catch on fire is likely too high. But, if there are high winds, the nearby pine forest is parched due to drought, and the current fire is burning hot enough to send embers flying, the likelihood of the fire spreading out of control of the current fire-fighting team increases.

Firefighters are often volunteer teams that have funding from the community to protect any resource that might encounter a problem. Resource rich areas with high rise buildings, dense populations, and greater environmental risk often have more restrictive controls in place. Specialized equipment like ladder trucks for tall buildings are deployed as needed. Community requirements like smoke detectors, fire suppression systems, automatically closing and fire rated doors are common in public spaces.

The information security analogy is obvious. Preventive and detective measures built in to systems is the result of diligent, persistent community awareness around risks of information systems. The systems with the most information density typically have formal requirements associated with risk management. The less important, resource constrained areas are often left to cobble together the response capability for the response team. The skillset of a volunteer, self-trained force is often less than a professional response capability. However, the ownership and agency that volunteers might have frequently creates circumstances where they outperform their fully funded counterparts on a dollar-wise comparison basis. That sense of ownership and heroism usually cannot be sustained perpetually. Ad hoc response teams try to demonstrate the need for additional funding by citing current successes and the substantial and growing demand for the service.

Eagle

Most eagle species are apex predators. With impressive optic acuity, they catch prey unaware. The eagle can strike and kill prey substantially larger than itself, sometimes killing prey 6 times its own weight.

The threat hunting responder who knows the narrow passes in the network, and can use the likely places an attacker must traverse to perform actions on objectives is an IR eagle. The eagle can scan massive areas, locate minutiae that everyone else would miss, and take out an intruder with speed and precision.

Once the IR eagle chooses to focus in on one specific prey, it loses sight of the other, potentially more important attackers. It’s expensive to maintain a lot of top performers within an IR group, and like the actual eagle, these hunters are often solitary and territorial.

FOR578 and Cyber Threat Intel Summit 2017

I attended FOR578 – Cyber Threat Intelligence ( https://www.sans.org/course/cyber-threat-intelligence ) at the Cyber Threat Intel Summit this past week. Two of the course authors, Robert M Lee (@RobertMLee) and Rebekah Brown (@PDXBek) co-taught the class. The third course author is Jake Williams (@MalwareJake).

My background is network and security operations, incident response, and pen testing. I haven’t ever functioned as an intel analyst specifically. But, I’ve been both a consumer of Intel and a producer of Intel in past roles. There were three primary items that I want to share from this class.

1. The importance of clear articulation of the use of consumption of Intel versus production of Intel in the mission objectives of the team.
2. The potential for enrichment of raw data with Intel
3. An effective expression of the kill chain via the concept of race to the finish.

Before I go into the details of these items, I want to express why they are important to me, so you understand the reason why these are primary take away lessons. The course that I wrote (MGT517 – Managing Security Operations: Detection, Response, and Intelligence) discusses integration of intel into security operations. I wanted to glean as much as possible from Rob, Rebekah, and Jake’s experience working in the Intel community to assure that the system I’m presenting is aligned with their experience, and what Intel Analysts attending SANS training will be bringing back to their organizations.

I determined that most of the other students were there to sharpen (or to establish) the intelligence function within their organizations. In speaking with the other attendees, and in listening to their questions, there were many tactical (how to do the intel actions) questions. There were also some strategic (what should we be doing) questions but most were on the tactical side.

The importance of clear articulation of the use of consumption of Intel versus production of Intel in the mission objectives of the team.

There are two major things to do with threat intelligence: produce it or consume it. A funded and mature team of threat intelligence analysts will likely do both. For less mature or less funded functions, the consumption of intelligence is a more realistic goal. This consumption only strategy (summarized) means the purchase of threat intelligence feeds and the aggregation of open source intelligence information. This information is culled for the data relevant to the organization the threat intel analysts work for. At some point in time, these analysts may determine that they have collected data internal to their organization which is worthwhile to share with other parties outside of the organization. This is the production of intelligence.

The potential for tight integration of enrichment of raw data with Intel.

Let’s discuss the objective of consumption of intelligence. The term applied during FOR578 was enrichment. There was discussion of what this looks like and how to do it. I’m going to skip those details because it is more granular than the space I intend to devote to this post. But the key take away is the process of combining external intelligence with internal data is enrichment. Let’s use the pyramid of pain ( https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html ) to describe the ingestion of threat intelligence. This is remaining abstract, so we’ll refer to the categories of intelligence: hashes; IP addresses; Domain Names; Host artifacts; Tools; and Tactics, Techniques, and Procedures (TTPs).

Enrichment of your internal data with the lower levels (hashes, IP addresses, Domain Names, and Host Artifacts) takes some work, but is relatively straight forward. Use of this data includes analysis of the data elements to validate they are applicable, and correlation to your stored data to assess the presence of these data elements. An example might be the addition of the updated file hash values to sysmon (https://technet.microsoft.com/en-us/sysinternals/sysmon) tracking. It might include researching your DNS query logs for requests to DNS entries identified via the threat intelligence. 

Most important to this effort is using that initial item of identification to start the effort of collection of additional intelligence about what adversaries are doing within your environment. This can be neatly encapsulated in Bejtlich’s Intruder’s Dilemna: the defender needs only one initial indicator to begin response. (https://taosecurity.blogspot.com/2009/05/defenders-dilemma-and-intruders-dilemma.html).

An effective expression of the kill chain via the concept of race to the finish.

I discuss the cyber threat kill chain in MGT517 (as well as ACH, Diamond Model, and Hofstede’s Cultural and Organizational dimensions) to address a terrible shortage of encouraging objective analysis within security operations.

Rob had a specific item of guidance regarding practical application of the Cyber Kill Chain®. Among other practical guidance was included the notion of “race to the finish.” That is, where ever you find a data element in the kill chain, go down the chain until the finish rather than back up the chain to the beginning. The rationale is that is where the important information is that allows you to understand, then express the impact to the business regarding the intrusion you’re investigating.

I gathered many other nuggets of wisdom from Rob and Rebekah. These three items warrant repeating: start with consumption of intelligence and with maturing move into production of intelligence; enrich your internal data with intelligence you consume; start by racing to the finish in the kill chain, or whatever framework you use to understand adversary actions.

Risk of a lost mobile device

Losing a mobile device will one day be your reality. Sorry, but it is a fact.

I just dealt with this personally. Wasn't my phone, but I needed to address the lost phone.

Fortunately, the fact that it was missing was noticed very quickly.

It's an Android phone, so I assisted the person to log into the google account controlling the phone.

We looked at the location history, which is enabled on this particular phone. You can see if your location history is present by logging into your google account here:

https://www.google.com/maps/timeline

I want to briefly address the creeptastic aspect of this information. I've personally used this location history for an extended period of time on my phones. I can see where my phones are to a high degree of accuracy. My every movement is traced by these phones. There's risk to this as well. While that's not what this blog post is about, think about it. As a future experiment, I'm going to completely disconnect for a period of time. A digital detox of sorts. But for now, I get the benefit and privacy invasion of this configuration.

I suspect most people have enabled Google (Android) location history without realizing the abundance of information present.

The location history for this phone was enabled, the location was quickly identified, and the phone was recovered.

Fortunate, in this case.

Even if the location history isn't enabled, all is not lost. There's also the Android device manager:

https://www.google.com/android/devicemanager

Log in, lock the phone, ring the device ringer, and optionally display a contact telephone number or message. I hope you read this before you lose your phone and are able to make an informed decision around location history use.

If you are considering this for a small business management of devices, you can restrict who can see your location to a small number of other accounts. This is like the functionality of commercial MDMs, available for free within Android's built in capability.

Apolitical (reds and blues)

Being overseas during the election was a fascinating experience.

This blog post isn't about the relative merits of either candidate or associated political parties. It is not about the information warfare techniques used during the election. It is not about the electoral college. 

This blog post is about the inherent stability of the United States of America's governance structure, and why that structure has caused discontent in the American populace, and concerns for global stability in people worldwide.

In the interest of pithy expression, I'm going to raise 5 points, and ask one question.

1. USA's government is designed to be inefficient

2. USA's government has always been a blending of competing interests

3. Concerns of the people in the USA 

4. USA strives for global stabilization

5. People are afraid of the unknown and this is nothing new

1. USA's government is designed to be inefficient

The founding fathers constructed the government to resist the capability of any one individual or organization to exert excessive and persistent control of the government.

2. USA's government has always been a blending of competing interests

To operate, then, the government must cooperate within itself and convince the people (of the USA) to vote for the representatives. To accomplish this, there's a short cycle of immediate interests to demonstrate "value" to the people the representative needs to vote for him or her. Simultaneously, this representative must attempt to coerce the opposing party to give some concession. Usually this concession is in exchange for a mutual concession.

As such, no one is really pleased with the government. The government is a raucous contention for control.

3. Concerns of the people in the USAThere's an interesting statistic I have seen from this election. I have two sources I found from wikipedia, but I'm not certain of the true, authoritative source for this number. But, the statistic is that roughly 60% of the eligible voters in the USA voted in this election.

links:

http://www.presidency.ucsb.edu/data/turnout.php

http://www.electproject.org/2016g

 The electproject.org site has links to the source of their data, most of which are to the state's website.

I'll offer two hypotheses which explain this, you're welcome to add competing hypotheses in the comments. If enough people are interested, we can construct an ACH graph representing this.

Hypothesis 1: Eligible voters in the USA who didn't vote are opposed to either of the viable (Democrat or Republican) candidates for President and thus didn't vote.

Hypothesis 2: Eligible voters in the USA who didn't vote think that the system will prevent either viable candidate from substantially affecting change.

4. USA strives for global stabilization

I'm a citizen of the United States of America. In case that's not readily apparent form this post thus far. My biased opinion is that the USA's global military presence is in fact intended to maintain a peaceful balance of power and contain opposition without conquering it. As opposed to a military with the intention of creating fealty among all adversaries.

5. People are afraid of the unknown and this is nothing new

I'm of the opinion (derived largely from psychological, biological, and philosophical studies plus my personal observation) that individual human actions are primarily motivated by: avoidance of pain, avoidance of death, and the search for pleasure. I think the individual expresses these in varying order of priority. 

The unknown impact to this election was a topic of substantial inquiry last week while I was in Australia. Every non-American I spoke with asked me about the election results. My canned immediate response was intended to diffuse immediately, "What election?" With a gigantic smile. But, of course, I elaborated. I shared my thoughts on each candidate if asked. I shared my thoughts on what I think is a system capable of withstanding any megalomaniac who gets elected, intending to assert massive change.

I rarely talk about politics, even when asked. Which is why strangers typically talk only about the weather. https://www.youtube.com/watch?v=wTG4746_Fgc

My question to you is, not that we can do anything, what will we do? 

This question is quoted from Bruce Mau's project "Massive Change." I chuckle to myself to think that this is a marketing company. Some other blog post I'll discuss why I don't like marketing, and that I've chosen to specifically forgo a tremendous volume of content to avoid it.

He was not the first to ask this question, he won't be the last. People worldwide are called upon daily to answer it. The project of responding to this question is the expression of your legacy. I sincerely hope that the designers of the government of the United States of America's legacy is that the government they set in motion is capable of maintaining its dignity and global position in spite of ugly politics and substantial discontent of the people.

That's the best I can do for being pithy and apolitical. ;)