Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Hackers contemplations
Ähnlich wie Hackers contemplations (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Hackers contemplations
- 1. We Reap What We Have Sown Where Do We Go From Here? Chris Roberts Chris@AttivoNetworks.com Sidragon1 (LinkedIn and Twitter)
- 2. Agenda • We’re broken – How to take 500 and make 20 • 1001 ways to remember your password – How to go back to the beginning • Our history – Painful lessons to learn • Education or eradication? – What roles do the humans play in the future? • Do no harm… – Can we use this? • Security, safety, risk? – What is right, and how to use it • Replace the blinky stuff – What is going to work to safeguard the future? • Wrapping it all up – Some wise words from someone else
- 3. Intro
- 4. The Purple Goatee… • In the InfoSec/Cyber industry for too many years... • Broke Nigeria, ISS, Mars Rover, airplanes, trains, etc. – Researched a whole lot more… • Now with Attivo Networks (official stuff comes out next week). – Why? Because I’m fed up of the blinky reactive stuff… – Why? Because the deceptive space gives us asymmetric defense for once. • Currently researching humans, consciousness computing and shipping. – Because there’s better ways than passwords! – Because the future’s not already scary enough – Because it seemed like a good idea to make a ship roll over… • Might also have a whisky collection that borders on the obsessive… – Occasionally travels with the whisky football (thanks Inbar!)
- 5. We’re Broken
- 8. 2018 Top 10: (2.5 billion) • Aadhar: 1.1 billion • Marriott/Starwood 350-500 million • Exactis: 340 million • MyFitnessPal: 150 million • Quora: 100 million • MyHeritage: 92 million • Cambridge: 87 million • Google+ 52.5 million • Chegg: 40 million • Facebook: 29 million Privacy Rights Computer Business Review Experian
- 9. 124 Billion For What?!?
- 10. 386 Conferences…
- 11. Hundreds Of Vendors Lying
- 12. Oh, That Reminds Me…
- 13. Change The Paradigm! How “Hackers” see themselves Who “Hackers” ACTUALLY are How the media and a LOT of society SEE’S “Hackers”
- 14. How Do We Fix This? How do we take 1,200 vendors and find the few good one? • Shoot the blinky lights (-350) • Taser the AI/ML (-300) • Cattle prod to BlockCypherSIEMIntel (-200) • More reactive stuff? (-200) • “We’ve got a solution for all of it” (-100) DO • Focus on those who listen more than talk. • Talk with those who focus on outcomes, metrics and improvements within both human AND technical realms. • Look for proactive, predictive AND solutions that focus on asymmetric defense. • Look for solutions NOT Band-Aids.
- 15. Worst case, play buzzword bingo: The winning vendor is whomever uses the LEAST buzzwords!
- 16. 1001 Ways To Remember Password
- 17. Band-Aid Not Fixing… • HOW many companies are out there trying to solve ONE simple problem? • HOW many billions will we spend on password management (answer 2019, $10 Billion or so) • How many solutions out there overly complicate a simple thing… • It’s a freaking password, we’ve had them since the 60’s and we’ve still NOT solved them!
- 19. Mapping The Brain… Left: Recording my brain interacting with my test computer Right: Replayed a heap of times along with phone and two other devices. The brain interacting with the various systems, get a baseline with some deviation
- 20. 2020 Password Management Not MitM, but Drill in the Middle…
- 21. Same Issues, Different Application: • We’ve been talking about transportation, intermodal and all things with wings, wheels, tracks, tyres and fins for 10 years or more… • As researchers, we’ve shouted from the tallest places, and still MANY of the industries don’t pay attention… • So, time to put the hammer down!
- 22. Planes Today… ALL the data ALL the time ALL the locations 10,000 Sensors in wing 7-8TB data per day 5,000 data points a sec. (engines)
- 23. Yea…Guess Who’s Going Back To Planes
- 25. Cars And Lorries
- 26. Ships Through The Front Door… Open RDP to a few container ships??
- 27. Make It Roll Over… RDP to ship then Maintenance system scan to: Ballast control module…May 2018
- 28. And…Over Again SATCOM – Navigation – RDP – Maintenance – Ballast Control
- 29. Locomotives: What to do when you get banned from several airlines…
- 30. Trains, Signals And Rail Yards… Rail yard, run by 3rd party, manages freight across the entire country. TELNET access, ID=Admin PWD=Admin1 GE-EMD Locomotive Cellular, rail-line or network access to train ID=Admin PWD=000000 ElectroLogIXS switch (scattered ALL over the USA.) Allows signals to be interrupted AND changed… Man NOT Present, bypassed. PWD=password Can change signals from RED to GREEN Etc.
- 31. 3 years of research and still NOBODY is really listening.
- 32. Why Can We Still Break Everything?
- 33. Our History…
- 34. Computing, IT, InfoSec, CyberBS
- 35. Wrong!
- 37. What Happened?
- 38. Advertising targeted the boys and the teenagers… The “male geniuses” came into being…
- 39. And This BS…
- 40. We Need To Bring Back BALANCE!
- 42. We Need People Who Care...
- 45. Fix The Basics!
- 46. Back to Basics • The human: – 1 hour of awareness training PER year – ½ session of “don’t click shit” – ½ session of “don’t send shit” – No understanding of balancing work and life security – P@ssw0rd1 used at work and on Facebook etc. – Thinks the “S” in HTTPS is for wimps
- 47. Fix the humans
- 48. Change the conversation Safety NOT Security
- 49. Back to Basics (2) • Your computers: – The ones on the FLAT network running W2k – The ones in the warehouse running XP – The ones the vendor said don’t touch – The ones on the Internet with RDP!! – The ones on the Internet with 1433/3306/Etc. – The ones you don’t even know about!
- 50. Remove the easy ways in!
- 51. Back to Basics (3) • Your perimeter: – Accept it, you don’t have one – The laptops, iPhones, IoT took your control away – Computer No1 on YOUR network is hacked – 2018’s NGIPS/UBA/NGFW isn’t going to help – Reactive, static defenses suck and don’t work – There is NO cake, no fairy and NO simple answer – Start looking at preventative, proactive, predictive
- 52. Get eyes inside your world!
- 53. Back to Basics (4) • Passwords (still) – Stop the re-use! – Teach pass phrases and password vaults. – Teach separation/segmentation – 2FA, it’s NOT hard to integrate – All your users DON’T need to be admin! – All your admins NEED to be separated – All your developers DON’T need to hardcode
- 54. Education and simpler integration
- 55. Back to Basics (5) • Get a plan – Face it, shit’s going to hit the fan at some point. – Be prepared, simpler to reach for the IR forms than wonder WHAT to do… – Have the communications plan in place ready to go… – Have the humans prepared. (No, not cannibalism) – Practice makes perfect, headless chicken mode is NOT needed… – Know the steps (OODA or NIST IR)
- 56. Get a plan!
- 57. If We Fail To Educate…
- 58. AI: Best Case Scenario… We can’t look after ourselves let alone each other.
- 59. The system wakes up…Realizes we’ll never listen as a collective species. Pops smoke and exit’s stage left…
- 61. Do No Harm, Can It Work?
- 62. What Is It? “Given an existing problem, it may be better not to do something, or even to do nothing, than to risk causing more harm than good.” Basically the OODA loop (where A might equal simply leaving it alone!)
- 63. Or, In Our Language…
- 64. PS: Duct Tape Does NOT Fix Everything…
- 65. As An Industry… • Do we have the discipline to take a step back and understand that our approach for the last 25+ years has NOT worked? • Do we have the humility to go to the business and ask for their help in understanding HOW to efficiently integrate? • Can we talk business risk and NOT geek?
- 66. Security, Safety OR Risk?
- 67. Safety vs. Security • Human’s have evolved over the last 50-60,00 years. • Humans have always been targeted, depending upon various circumstances. • We UNDERSTAND safety. • Security is NOT part of our language.
- 68. There is NO such thing as security. There is just the measurement of RISK.
- 69. • Arguably there is nothing that can be totally secured. – Therefore, does a state of security really exist? – If yes, then HOW do you measure security? – If no, then WHY are we going round in circles trying to tell folks what exactly?!? • Change the conversations, talk about risk. – NOT “cyber risk” but simply business risk. – We know that companies have quantified risk for as long as someone’s been willing to sell insurance. – If we can’t beat them…join them! Risk Not Security:
- 70. Existential Crisis For InfoSec…
- 71. Replace The Blinky Stuff…
- 72. Static Defense…
- 74. Walls… Fire, Brick, Etc. “Walls for the last 4,100 years have provided temporary relief at best, but a fools folly for the most part. They are nothing more than a willy waving exercise designed to attract MORE attention and innovation in how to circumvent and bypass.”
- 76. More Blinky Lights… • You have SIEM installed…and more alerts than a team of minions could ever handle. • You WOULD have policies, procedures and controls IF you could all agree… • You get a penetration test, but let’s face it…most of the time it’s a checkbox NOT an actual off the leash test… • You congratulate yourself when the auditor leaves WITHOUT finding the skeletons. • You don’t have good metrics to report to the board…
- 77. Assets! How many of you KNOW what assets you HAVE Let alone where they are…
- 78. So, That Just Shot Endpoint too…
- 79. Blunt • You don’t have a perimeter: – You lost that when you allowed email to become mobile and the cloud took it to a whole new level, let alone your 3rd parties and supply chain have access everywhere... – When the coffee machine talks to the fridge and Alexa answers…you don’t have a perimeter! • You haven’t fixed the basics: – Patches done ALL over the place (on stuff you can find) hopefully…ish – You have an SDLC for developers and all those teams are managed correctly? – You have shared code ALL over your apps, and don’t know it. – Defaults in place, passwords not separated, local admin for users? – You train your users annually and expect them to remember? (never mind PPC’s) • I’m here.. – And you are not watching all your logs ALL the time OR you’ve tuned me out? – You think that antivirus is effective or rely upon endpoint protection. – You think your firewall’s going to save you…
- 80. Preventative, Proactive, Deceptive! Asymmetric Defense!
- 81. Explain! Your current network… Building in asymmetric defense
- 82. Wrapping It All Up…
- 83. Our History
- 84. Our Future
- 85. All Of Us… • Irrespective of your background. • Irrespective of your race, creed, color, faith, or eye color. • Absolutely irrespective of your orientation! • Change takes ALL of us. – This isn’t securities problem, it isn’t the researchers fault, we need to stop blaming the hackers. – This isn’t the C-Suites blame to carry, nor is it the users issue to solve. Developers need to be out of the firing line as does EVERYONE in the business. • We ALL take some of the responsibility, therefore we ALL have to solve it…together!
- 87. 5 million apps, 6 billion connected people, 26 Billion devices, 3 million shortfall in InfoSec…
- 88. Breaking things is easy… …fixing them is a whole lot harder
- 89. “We may have all come on different ships, but we’re in the same boat now” Martin Luther King, Jr. 89
- 90. I will fail We will succeed
- 91. “So long and thanks for all the fish” Douglas Adams, you are missed. Thank you to BugCrowd AND everyone listening!