Stop wasting your time learning pentesting.
I see lots of courses out there for pentesting.
They teach you that attacks are all like this,
your intermediate services are running,
all the IPs, the ports, the domains,
the services that's running behind these ports,
and trying to find a vulnerability in one of them.
Then, getting into the organization,
and start spreading from there.
Or in other courses they teach you web bug hunting
and they tell you like, all the success is all about,
or all the attacks is all about what?
They try to find SQL injection, or XSS,
or path traversal attack, or whatever
the vulnerability is.
and this really can get into the organization.
Which all of these ways are used to be used before,
but right now most of the attacks don't look like that.
Before I get to tell you what real attacks look like,
let me introduce myself.
My name is Amr Thabet, and I used to work in Symantec,
in the attack investigation team.
Tracking down all the top actors
in the cyber-security field,
all the big organizations, or big gangs
that attack big organizations or big companies like,
Sony or different banks like Bank of America,
or Bank of Bangladesh or whatever the big targets are.
Mostly like enterprises or governments,
or embassies, or like a company that has
a big financial resource, or as well,
they have some political motivation behind these attacks.
What's common between all these attacks is that
they rely on, the first thing that they rely on,
which was common between almost all of these attacks,
that they develop their own malware.
Most of these attacks are actually malware attacks,
They get into the organization by sending
their own customized malware,
either though a spear phishing or through whatever
the social engineering they go for.
They target mostly the employees inside the company.
They send them this malware,
and once it get into one machine inside the organization,
they start moving from one machine to another,
to a third, to a fourth,
dropping different malware samples along the way.
The first thing is that maybe
the malicious document for example.
And after they send this malicious document
they have developed in house, then,
it drops a specific malware they also developed,
that this malware starts the first phase of the attack.
Once they understand the environment,
they drop another malware they have developed
only for this company, only for this organization
they are attacking, or a specific sector.
They are targeting multiple organizations
at the same time, from the same sector.
Once they get into attacking this,
once they get into understanding
everything about this machine,
they try to look for other machines in the network,
infecting one after another.
So, what I want to say is that if you really want
to build your skill in cyber security,
and you really want to be in the top most demanded skill,
if you want to have this most demanded skill,
and you want to be in the top candidate applying for a job,
you need first to understand how real attacks look like.
How do they look like step-by-step,
and what are the steps that companies or organizations
are taking to defend against these attacks.
And as I described to you, that most of these attacks
rely on malware and social engineering.
Let me tell you how all of these attacks look like
step-by-step, how they are from inside,
and as well I will tell you
how organizations defend against these attacks.
I'm actually having a free live webinar
that I will be talking about that, I will be teaching
that step-by-step for you.
I will be giving you all the tools,
all the information, all the instant response tips
to respond to and mitigate these type of attacks.
And the most important, two things most important,
first thing is that what are all the job roles
that plays on defending against these attacks.
What are the different skillsets that are required
for every one of these jobs.
I will tell you this is how organization look like,
a small organization, medium organization or big enterprise.
How do you defend and respond to these attacks.
How their structure as a security team.
How their security teams is structured.
What are like, there's level one is this, is that,
this team does this part, and this team does this part,
and what are the skills that required for every one of them.
And I will give you all the tools,
all the resources to learn all of these fields.
So, it's actually free, so just sign up,
save it in your calendar.
I will send you also, if you register,
I will send you a link to add it to you calendar,
including the link to how to join.
So once you register, add it to your calendar,
and show up into this webinar.
It will be free, it will be live,
we'll have a Q&A as well, so make sure that you are there.
And see you in the webinar.
Bye-bye.