Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Today's Cyber Challenges: Methodology to Secure Your Business
Ähnlich wie Today's Cyber Challenges: Methodology to Secure Your Business (20)
Mehr von JoAnna Cheshire
Mehr von JoAnna Cheshire (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Today's Cyber Challenges: Methodology to Secure Your Business
- 1. Today’s Cyber Challenges Methodology to Secure Your Business Joe Leonard, CISO CISM, CISA, CRISC, CISSP, CEH October 5, 2017 FUTURE. BUILT.
- 2. Agenda q Introduction q Today’s Cyber Challenges q Attack Vectors q Disruption Technology q Business Challenges q Security Framework q Security Tools q Insider Stories q Summary
- 3. Introduction
- 4. Introduction • Presidio Chief Information Security Officer • Over 11 years at Presidio • 39 Years in Security • Organizations – US Army (Electronic Warfare) – EDS (Cellular Communications) – BBN Planet/GTE Internetworking (ISP) – Digex (Network/Web Hosting) – Northrop Grumman (Consulting) – Presidio (Consulting) • Certifications – CISM, CISA, CRISC, CISSP, CEH, CCSK
- 5. Todays’ Goal • Pass along knowledge from many engagements • Pass along some ideas that can help you • Pass long some best practices • Pass along some common mistakes and pitfalls • Promise no sales pitch • No FUD to discuss security • Open discussion about security
- 6. Today’s Cyber Challenges Methodology to Secure Your Business • Today’s cybersecurity landscape has many challenges. There are many attack vectors and the frequency of the attacks are increasing. How do we protect our organizations from these attacks? Do we have the resources, the budget or the knowledge to defend against these attacks? • During this session we will talk about a methodology for protecting your organization’s critical data which includes security strategy, compliance requirements, continuous testing, architecture challenges, incident response and monitoring. This session will discuss today’s cybersecurity challenges and how this methodology will help you protect your organization.
- 9. Attack Vectors Changing Attack vectors need to be evaluated Cyber Weapon s 1 Tbps DDoS France - OVH
- 10. Security in the News Security and Exchange Commission Exploited Vulnerability - Electronic Data Gathering, Analysis, and Retrieval (EDGAR) Data can be used for insider trading Exploited Apache Struts Flaw Impact – 145 million people
- 11. And the Winner is 3 Billion Records Compromised
- 12. Security Awareness – Changing Culture
- 16. Poll Question • What are your top Cyber Security challenges?
- 19. Security Framework Comprehensive security framework that address todays changing cyber threat landscape. Benefits: • Strategy aligned with business goals and risk • Continuous Risk Management lifecycle approach • Governance (Security Framework) • Architecture Roadmap • Managed Services • Incident Response Program • Executive level KPIs Business Intelligence (Customer) Strategy Incident Response Governance Managed Security Services Architecture Consulting Security Analysis Baseline Reporting Roadmap
- 20. Baseline Business Intelligence (Customer) Strategy Baseline Roadmap B Q2 Q3 Q4 Continuous-Testing-&-Remediation Services: • Yearly Baseline Risk Assessment • Quarterly Remediation Testing • Compliance • HIPAA, PCI, FISMA and FERPA • Penetration Testing Benefits: • Improve Executive Visibility • Improve Security Posture • Develop Roadmap • Detect and Manage Risks • Meet Compliance Requirements • Reduce Costs
- 21. Poll Question • How frequently do you test your systems?
- 22. When? • Yearly baseline • Quarterly review and remediation testing • Compliance - HIPAA, PCI, GDPR and FISMA • Penetration Testing • NIST 800-53 R4, NIST 800-171, CIS Controls 20 • Validation of new controls Benefits • Improve security posture • Detect and manage risks • Meet compliance requirements • Reduce costs Internal Assessment Physical Security Penetration Testing Wireless Infrastructure External Assessment Social Engineering Web Applications Device Hardening Remote Access Governance Executive Summary Report Vulnerability Register Detailed Risk Report Baseline Testing
- 23. Intelligence Gathering External Internal Attacks Command & Control Analysis Cleanup Presentation Scope • Intelligence Gathering • External / Internal Attacks • Command & Control (C&C) • Analysis / Lessons Learned • Improved Incident Response • Replicate Real World Attacks • Increase Security Awareness Deliverables • Executive Summary • Detailed Red Team Analysis (ROE) • Onsite After Action Review Red Team
- 24. Security Analysis Services: • Malware file based analysis • Traffic Analysis • PCAP Analysis • IDS/IPS • Passive Vulnerability Assessment • Passive Module (Tap /Span) • Reporting Benefits: • Identify Indicators of Compromise (IOC) • Identify Targeted Attacks • Identify traffic anomaly • Identify attackers Business Intelligence (Customer) Strategy Security Analysis Baseline Roadmap
- 25. Architecture Consulting Services: • Security Architecture • Firewall Analysis • Device Hardening • Active Directory Analysis • PKI Assessments Benefits: • Architecture aligned to Business Goals • Develop High-Level Designs • Layered Security Architecture • Network Segmentation • Roadmap Development • Improve Security Posture Business Intelligence (Customer) Strategy Architecture Consulting Security Analysis Baseline Roadmap
- 26. Governance Services: • NIST Cyber Security Framework • NIST 800-53 • NIST 800-171 (CUI) • FISMA • ISO 27001 • CIS Controls 20 Benefits: • Risk Management Viewpoint • Improve Risk Posture • Operation Preparedness • Regulatory Compliance • Investment Validation • Resource Prioritization Business Intelligence (Customer) StrategyGovernance Architecture Consulting Security Analysis Baseline Roadmap
- 28. Managed Security Services Services: • 24 x 7 x 365 coverage • Advanced Security Managed Platform • Detection, analysis, response, escalation and mitigation • Security event correlation • Threat Intelligence • Service Device Management • Reporting Benefits: • Comprehensive platform • Governance & Compliance • Service Device Management Business Intelligence (Customer) StrategyGovernance Managed Security Services Architecture Consulting Security Analysis Baseline Roadmap
- 29. Incident Response – Emergency and Retainer Services: • Subscription services • Incident coordination, containment and investigation • Log, host and network forensics • Creation of IR processes • Remediation planning • Threat & Incident Reporting • Table Top Exercises Benefits: • Organization understands role • Security readiness for attack • Incident containment • Central communication point • Reduce brand damage Business Intelligence (Customer) Strategy Incident Response Governance Managed Security Services Architecture Consulting Security Analysis Baseline Roadmap
- 30. Poll Question • Does your organization have an incident response team?
- 31. Reporting Services: • KPI • Risk Management • Vulnerability Management Benefits: • Dynamic Risk Score • Improved Risk Visibility • Improved Vulnerability Tracking • Yearly and Quarterly Comparison Improvements Business Intelligence (Customer) Strategy Incident Response Governance Managed Security Services Architecture Consulting Security Analysis Baseline Reporting Roadmap
- 32. Security Tools
- 33. Scanning Tools • Tenable Nessus • Burp Suite Pro • LUCY (Social Engineering) • Nmap • Metasploit • Mimikatz • Responder • BloodHound Direct Action Kit RFID Harvester • When victim is within a few feet, their RFID badge information is grabbed. • System can then clone the badge for use by security consultant. Physical Security • Lack of door plates on critical ingress doors can allow access with kit tools • Improperly installed locks can lead to easy bypass Wireless Testing • Wi-Fi Pineapple • Evil Twin Attacks on open wireless networks • Cracking pre-shared keys with high-power Amazon GPU cluster Commercial / Open Source tools • Shrum Tool • Shove Knife Tool • Plastic shims • Lock pick tools • USB Key logger • Video Cable Display Mirror • Hinge-mount door catch Security Tools
- 34. Insider Stories What could go wrong?
- 35. Insider Stories • Impersonation • Phishing • Spear Phishing • Media Drop • Red Team
- 36. Story 1 Impersonate Support Team 36 1 2 • I’m here to help with a problem on the computer. • Coincidence - another business system is down. • Receptionist provides the outage information, branch manager and direct number. • Information sent to attacker 2. • A remote attacker 2 calls the branch manager from a spoofed number for the real support team. • Wanted to let you know we’re coming to look at the system. 1 • Receptionist is notified to escort the support team to the system. • Attacker 1 is escorted to the business system. • Gathered photos of alarm systems/wiring diagrams. Had access to financial servers and 15,000 loan applications.
- 37. Story 2 Impersonate Executive 37 • Complete IT Survey • Success 75-80% credentials • Admins responded • Employees are afraid to question authority
- 38. Story 3 – Multi-tier Attacks • < 20 minutes on-site – 1 inserted USB – Server room compromised – 7 sets of credentials compromised – 12 sets of spear phishing – Full VPN Access – Full email access • Attacks – Reconnaissance (badge) – Phishing – Tailgate – USB – Human Error
- 39. Story 4 Red Team • GOAL – Gain access to pharmaceutical price list – 1st night – dumpster diving – price lists found – 2nd night – building reconnaissance – door locks vulnerable – Gained access – knitting hook picked door lock (loiding) – Badge ID System left out in open – guessed easy password – Created admin account and badges – Deleted forced entry alerts from camera and door security system – Used newly created badges to access environment – Installed keystroke loggers on keyboards – Gained domain admin privileges – Gained full admin access to pharmaceutical server
- 40. Summary q Introduction q Today’s Cyber Challenges q Attack Vectors q Disruption Technology q Business Challenges q Security Framework q Security Tools q Insider Stories q Summary