This document discusses many challenges facing security teams, including lack of visibility into all IT systems and assets ("shadow IT"), numerous vulnerabilities being discovered regularly, inability to identify attack paths, and poor communication between security and business teams. It advocates adopting a continuous monitoring approach that automates asset discovery, vulnerability assessments, log analysis and security metrics to improve visibility, prioritize risks, and demonstrate security's value to the business.

1. SHADOW IT
Florian Hammers

2. New Threats Discovered Every Day
90M
network devices vulnerable
HEARTBLEED
70%
SHELLSHOCK
of all Internet-facing
machines exposed
Almost every Linux system
vulnerable due to glibc flaw
GHOST SCADA
Numerous remote code execution
vulnerabilities discovered
WINDOWS
Numerous remote code execution
vulnerabilities discovered
Multiple zero days leveraged by
exploit kits
FLASH
Billion
Android devices possibly affected by
major flaw in Media Library
STAGEFRIGHT

3. VULNERABILITIES
WE HAVE NAMED
DRIVING AGENDAS

4. NOT IMPROVEMENTS
KNEE JERK REACTIONS
LOGOS LEAD TO

5. Many Old Issues Still Linger
Lack of visibility due to large compound
annual growth rates
CAGR
SHAKESPEARE
Given a few tries, a chimp banging on a
keyboard would guess your password
Inability to identify attack path to defend
against breach
INVADER
Communication failure between security
staff and the business
STUTTER ROT26
Data is not encrypted… Why is the data not
encrypted?!
A a
Buying expensive bandaids for massive
bullet holes
BANDIT

6. Lack of visibility due to large
compound annual growth rates
CAGR

7. VISIBILITY
MOST ORGANISATIONS LACK

8. SHADOW ITSHADOW IT
Dictionary
Shadow IT |ˈʃadəʊ it| noun
IT systems and solutions used by employees without explicit
approval by operations or security.
Systems not known to the organisation through lack of visibility.

9. It only takes a few seconds for a new
virtual machine to spin up but days,
weeks or months to detect it

11. of workers in the US are using
personal smartphones
for work purposes
90%

13. *According to 400 respondents to the Tenable “State of Security” survey 2015
Compound annual growth rate of infrastructure*

14. Using a 20th Century approach to
address a 21st Century problem

15. PERIODIC SCANNING
IS NOT ENOUGH

16. ASSET DISCOVERY
Deploy an automated asset inventory discovery
tool and use it to build a preliminary asset inventory
of systems connected to an organization's public and
private network(s). Both active tools that scan
through network address ranges and passive tools
that identify hosts based on analysing their traffic
should be employed.
SANS CRITICAL SECURITY CONTROL #1

17. Takes a 21st Century Approach
NESSUS®
CLOUD
NESSUS®
VULNERABILITY SCANNER
PVS™
PASSIVE VULNERABILITY SCANNER
LCE™
LOG CORRELATION ENGINE
SECURITYCENTER™
PVS
N
SC
NC
LCE
CONTINUOUS VIEW
NESSUS®
AGENTS
NA

18. Automatic Workflows
NESSUS®
CLOUD
NESSUS®
VULNERABILITY SCANNER
PVS™
PASSIVE VULNERABILITY SCANNER
LCE™
LOG CORRELATION ENGINE
SECURITYCENTER™
CONTINUOUS VIEW
NESSUS®
AGENTS

19. What assets, data
and vulnerabilities
reside on the network?

20. Inability to identify attack path to defend
against breach
INVADER

21. Example Attack Path
Foothold
Found
via phishing or vulnerability
Evade
Hide forensic
footprints
Explore
Find data and
systems of
interest
Profit
Sell data to other
3rd parties
Exfiltrate
Extract customer
data or IP
Establish
Install code for
permanence

22. ATTACK
SURFACE
CONTINUOUSLY MONITOR THE

23. What controls
should be implemented
to continuously protect
and monitor the
assets?

24. CONTINUOUSLY
DEPLOY&VERIFY

25. Buying expensive bandaids for massive
bullet holes
BANDIT

26. The Almighty Security Vendors Will Save Us!

27. Security isn’t about spending a portion
of the annual budget on tools –
it’s about doing the right activities
to reduce risk

28. Communication failure between security staff and
the business
STUTTER

29. How can I
Demonstrate I have
continuous situational
Awareness?

31. How do I
communicate the
effectiveness of security
and demonstrate value
to the business?

32. Bits and bytes don’t belong in the boardroom
Metrics are the language of Business

33. CONTROL
IF YOU CAN’T
MEASURE
YOU CAN’T

34. IMPROVE
IF YOU CAN’T
MEASURE
YOU CAN’T

35. FUNDAMENTALS
PRACTICE THE
FIRST

36. Organisations need to stop
focusing on the
AND FIX THE
100DAY
0DAY

37. The biggest issue we face in
security today isn’t
IT’S APATHY
APT

38. IN REAL-TIME
Category-Defining
Continuous Network
Monitoring Enables Rapid
Asset and Vulnerability
Discovery
Metrics That Matter to the
Business, Easily Surfaced
and Visualised.
Demonstrate Value.
All of your devices. All of your applications. On-premise, or in the cloud
WE MONITOR YOUR SECURITY
Prioritise What Needs to be
Fixed First. Integrate into
Third Party Processes to
Communicate Needs.