﻿CW 278 Transcript In today's Cyber Work hack,
Paul Giorgi of XM Cyber, a man who told me that his favorite way to learn new skills is
to break things and then put them back together, walked me through the basics of setting up your
own cybersecurity practice lab at home for not too much money. But watch out because he said,
“Once you start, your excitement about hands-on practice and buying old servers
on eBay can get overwhelming.” If that's not a Cyber Work hack, I don't know what is.
Hello, and welcome to Cyber Work hacks, a new series of short videos from InfoSec.
The purpose is to give you quick, clear, and actionable answers to the questions that you
have about learning cybersecurity. So today's guest is Paul Giorgi of XM Cyber. We recently
had him on our main Cyber Work feed and had a very good conversation about some of the
more unusual attack vectors of 2022, and we got to talking about setting up a home
lab so that you can practice cybersecurity concepts in your own time and so forth.
So I thought I'd keep Paul on for a few more minutes here, and we can sort of walk through some
of the particulars of this because he was just so passionate and excited about it. So welcome back,
Paul. Thanks for joining us here. Yeah. No problem, Chris.
So Paul, what are some of the main tasks that you can do to practice with sort of cybersecurity lab
at home? Like how does that help you sort of move beyond reading the books or just watching YouTube
videos? Like what are the sort of like nuts and bolts things that you can do with a home lab?
Yeah. I feel, especially in the sales engineering world,
there is a change in your voice when I could tell somebody's talking authoritatively on a subject.
So if I read a book or I watch a YouTube video about somebody else doing something,
there's one way I'm going to talk about it. I'll say they, and I'll say like you can. But when I
have done it, I speak differently, and I could say more confidently like this is what you will see,
and this is how it's done. More than I would say if I didn't do that.
I think, fundamentally, if you are trying to solve a problem of which you have not seen
yourself or even understand like the fundamental components of, you're going to have a really hard
time resonating with the appropriate person. Like think about Active Directory, for example. If you
have never set up Active Directory or maintained an Active Directory environment by yourself or
in your home lab, you're probably not going to really understand the struggles that the
typical identity guy or Active Directory admin or engineer or architect has to go through.
I mean, just from scratch, set up a server. It doesn't need to be a really high-powered
server. You could find something cheap. I loved running things in VMs because I'm
notorious for doing things the exact wrong way. So I create little 02:59] along the
way. It's kind of like playing a video game. When you make a little bit of accomplishment,
save the progress. You make a little bit more accomplishment, save the progress. That way,
when you realize at the end where you're like, “I screwed up,
not just the last step. I screwed up 10 steps ago,” I can then revert back to it.
I guess going back to the main point is having a good hands-on experience and being familiar
with what people are dealing with from a hands-on perspective is going to set you apart than anybody
with book knowledge or whatever training session they've gone through. So however you can do that,
get that done. There are so much free solutions out there. I mean, I think of everything from
the hackable components where, hey, I want to find a hackable system that allows me to hack
something. Or there are so many scripts that I can leverage within VMware and PowerCLI. I can
press a button. Within 15 minutes, I can have a huge domain environment for me to play with,
and I can break things and try to hack things and compromise things.
I went through my OSCP certification a few years ago, and one of my favorite things about it is
during the OSCP certification is you have access to this lab. Most of the time, all the labs that
I had played with, I had set them up. So I didn't know really how or I wasn't aware how they were
configured. So it took a little bit of time kind of breaking them. But you still had the
ability to revert the snapshot. So as soon as you 04:23] things or something, I could still go well,
“Oops, I broke it. Let's go ahead and revert it.” So I love just having that ability.
Yeah. That also gives you the sort of blank check to make really big swings when you're trying to
solve something because you know that you're not just – That's not the end of it, right?
Yeah, exactly. Having a lab is a great resource, just to fall back on for reference. I mean,
I can't tell you how many times I'm in the conversation with a customer. We were just talking
about dumping credentials out of LSASS. I was just talking with a customer who didn't think that was
possible, and I was like, “Hang on. Give me a minute.” On the same Zoom session, I jumped over
my home lab. I’m like, “Let's just do this. All right, we're going to interactively log in. Now,
there's a credential sitting in the cache and LSASS. Now, let me just grab a tool.”
I just used a – I think I used Mimikatz for that one. I just used Mimikatz, ran it, and then, “Hey.
Look at the clear text password, just sitting right there.” I didn't have to break it. It didn't
have to sniff it. I didn't have to do any sort of like weird stuff that he thought was necessary
for it. It's just that password sitting in your credential, and having that sitting there as a
lab really allowed me to kind of differentiate myself. Not only like, “Hey, this guy knows
what he's talking about.” But, “Wow, that was great. Thank you for showing that to me.”
Then from that point on, I had a different level of interaction with that customer because like,
okay, not only do I need to trust what he's saying to me now, but he has that hands-on
familiarity with doing things like that, that maybe I don't necessarily have.
Okay. So is this something that you could create at home? So like I'm trying to think
like if we're talking like a team that maybe has a combined living space or lives with their parents,
is this something that you could do on the kitchen table? Or is this something
that really needs like its own space? What are the space and resource requirements to
setting up something like this? Yeah. So it doesn't take much.
There's a few different ways you can do it. I mean, we have so many more options now than we
did 20 years ago. Let's say that you just want a server. Like I used to use OVH all the time.
They do dedicated server hosting. I would pay – I think it was like $50 a month, and I
would have a dedicated server with a gig Internet connection that I had full KVM access to. I would
load up VMware on it, and I would have my own hypervisor. I can remote into it externally.
So you don't need to have a lot or even space to store it. But you have all of
these cloud options that we really didn't have 20 years ago. So we'll get that.
Azure and GCP and AWS often will have three credits for a certain period of time or their
free tier. So if you want to use $300 worth of just playing within GCP, sign up for Google,
and they'll give you several hundred dollars’ worth of just getting familiar. They have the
side benefit of now you having familiarity with GCP and potentially liking it so much that you
keep it in there. But you have a $300 coupon. So if you want to play around with something for
a little bit, spin up some VMs and use that. Take advantage of those opportunities.
I've gone through all of those, but I still like my hands-on stuff. I still feel like for me to do
what I would want to do in lab environments like that are hosted in the cloud, it would just be too
cost-prohibitive. So in my basement, I've got a bunch of different servers that I just buy off of
eBay. I start with like Intel NUCs, really cheap, small, little power. From there, it just expanded.
Now, I've got a whole bunch of DELL R730s, running vSAN. I've got NASs and SANs. So just be careful
because it is something that gets addictive when you start playing around with it.
But start small. Take advantage of free opportunities.
Look on eBay and Craigslist for a cheap, low-power server like an Intel NUC that
you can get for maybe 100, 200 bucks. The biggest thing to keep that you're going to run
into is disk I/O and memory. Once you start getting 10 VMs spun up on a single server,
even if you only give four gigs of memory for each one of those, that's 40 gigs of – That's
a lot of memory that you're getting into, a lot of disk I/O that you're going to require.
So try to get as much memory and as much disk I/O as you can on whatever it is because if you get
just some single solid state disk, you're only going to get a couple of VMs running on that at
the same time. If you get a machine that only has maybe 16 or 32 gigs of memory, you're only
going to run one or two VMs, and that's probably not as beneficial as something with 128.
Well, good. Next question was the specific sort of numbers from a money
standpoint. What would be bare bones essential pieces of hardware and software you would need
to get set up on a lab like this? Is it something that you could build for the price of a pizza or
more of a used car or somewhere in between? So if I were starting from scratch, like I'm just
jumping into cybersecurity, I would literally just buy an Intel NUC, max it out. I think the Intel
NUCs, you can get one with 64 gigs of memory, and you could put a couple of SSD drives in it.
I have the little square ones with the i7 Processor in it. Then I also had the Intel Skull
Canyon I think is what they call it, which is like more of a gamer one. The only reason why I went
with that is to have the faster processor. But between like 300 to 400 dollars, you can
get one of these little boxes, and they're quiet. They don't consume a lot of memory,
super easy to set up. They're really common. So you'll see walkthrough guides of people doing
even really complex stuff with hypervisors and virtualization on them. So if you want to even
get into something like vSAN to figure out how to do nested hypervisors on a single Intel NUC,
and then you could do like mocking up vSAN, where you have a three-node vSAN cluster. But
it's still just running off of a single Intel NUC. So there's a lot of fun stuff
that you can do with just a little device that shouldn't cost you any more than $400.
From there, like I said, it's a slippery slope. You'll probably buy at least one more
Intel NUC and then eventually probably buy a server or two. But from a starting point,
I don't think it is a cost of a pizza or even necessarily a used car, somewhere in between.
Yeah. Okay, very good. So without showing a physical walkthrough here, what are the
basic steps to get all of this hardware and software connected and running smoothly? Once
you've got your security lab at home set up, can you suggest like a first project that you
could use to like get your hands dirty? Yeah. So when you're starting from setup, let's
just go to the example of the Intel NUC. You've just got one Intel NUC. Load up whatever your
favorite hypervisor is. If you're not familiar with any of them, Proxmox is really easy. It's
open source and free, so you don't have to worry about licensing stuff. I prefer VMware, vSphere or
ESXi. My only concern is the whole Broadcom thing. What's going to happen with VMware? So I mean,
that's a whole other conversation. But at least from my standpoint, I've
really been focusing on VMware as my hypervisor of choice, even though I've been trying to learn
a few others, just as a contingency plan. Once you have that setup, create templates.
There are easy ways to say, okay, I've got my evaluation copy that I downloaded from
Microsoft of Windows Server, and then I've got my Windows 10 machine. Then find a place where you
can store your CD images, your ISOs. So store the ISOs. Build a couple of templates.
Then what's great about templates is I can right click and just say deploy from template.
Within seconds, I've got a fresh new VM that I can break to my heart's content,
knowing that I can just delete it right away. Or if things work out well, snapshot it,
and then use it for reference later. But that's really kind of the fundamentals of my home
security lab or any real security lab is loading up a hypervisor. Find a place to stash your ISOs
and all of your other bootable media. Then find a place to keep your templates. So create a couple
of templates. It's going to save you a ton of time, instead of having to install Windows over
and over and over again. 12:18] template and then you can spin off of those really quick.
What you do with it from there is really you can get into a lot of different stuff. I actually have
a breaking point device. It's an Ixia device, a traffic simulation. So if I stand up a firewall
or some sort of IPS or malware detection, I can run through this tool that allows me to generate
either like benign traffic that mimics things like an enterprise environment. Or I could play through
different scenarios like, “Hey, I want to look like what malicious traffic looks like.” Then
I could have different ways to play with that data as it's flowing through. But that's more like kind
of once you build out those fundamental things, then you can start playing with other things,
including like traffic simulation. That's amazing. All right. Well, Paul Giorgi,
thank you very much for the Cyber Work hack here. Where can our listeners and viewers find out more
about you and your company, XM Cyber? Yeah. So xmcyber.com is our website. We're
involved in pretty much all of the major shows. So if you're walking around RSA or Black Hat or
whatever the conferences you're at, you're probably going to be able to find some sort
of presence with us there. But we’re a global organization and really focused on teaching
organizations what attack paths management is, and helping them learn how to prioritize and address
risks and remediate them appropriately. Awesome. Paul Giorgi, thank you, again,
for your time and insights today. Yeah, no problem.
And thank you all for watching this episode of Cyber Work hacks. This is the start of an
ongoing series of videos that we're getting going in 2023, and we're going to have lots more to
come. So make sure to subscribe and check that. Until then, we'll see you soon. Take care.
Hey. If you're worried about choosing the right cybersecurity career, click here to
see the 12 most in-demand cybersecurity roles. I ask experts working in the field how to get hired
and how to do the work of these security roles, so you can choose your study with confidence.
I'll see you there © 2023 Cyber Work