SlideShare a Scribd company logo
1 of 31
Download to read offline
GOT HACKED?
IT’STOO LATE
TO RUN NOW.
Janne Kauhanen
Twitter: @JKauhanen
360° OFCYBER SECURITY
2
MINIMIZE ATTACK
SURFACE
PREVENT
INCIDENTS
UNDERSTAND YOUR RISK,
KNOW YOUR ATTACK SURFACE,
UNCOVER WEAK SPOTS
REACT TO BREACHES,
MITIGATE THE DAMAGE,
ANALYZE AND LEARN
RECOGNIZE INCIDENTS
AND THREATS, ISOLATE
AND CONTAIN THEM
AGENDA
3
 Definitions
 Threat detection, a short summary
 Why do you get hacked?
 What to do when you get hacked?
 Incident Response process
 Forensics
 Incident Response capabilities you should (and shouldn’t) have
 Crisis management
SECURITY INCIDENTS
Hacker actions
4
Information leak Widespread
malware infection
Internal
misbehavior
(unintentional
included)
"ASECURITY INCIDENT IS
ANYKINDOFACTION
THAT RESULTS INACHANGE
TOAKNOWN GOOD STATE.“
KURTHAGERMAN,CISO,ARMORDEFENSEINC.
5
THEDOS ANDDON’TS OF
THREAT DETECTION
RECAPOFWEBINAR#3
6
WHYDIDIGETHACKED?
7
"DRIVE BY" &
SCRIPT KIDDIES
FOCUS
SKILL
TARGETED
ATTACKS
IDENTITY
THEFT, 0DAY
EXPLOITS
ADVANCED
PERSISTENT
THREATS
INCIDENT RESPONSE PROCESS
16
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
17
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
18
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
19
Briefing Identification Containment Recovery Aftermath
INCIDENT RESPONSE PROCESS
20
Briefing Identification Containment Recovery Aftermath
FORENSICINVESTIGATION
1. HOW WAS THE DEVICE BREACHED?
‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?
‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?
‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?
‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
21
FORENSICINVESTIGATION
1. HOW WAS THE DEVICE BREACHED?
‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?
‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?
‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?
‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
22
FORENSICINVESTIGATION
1. HOW WAS THE DEVICE BREACHED?
‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?
‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?
‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?
‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
23
FORENSICINVESTIGATION
1. HOW WAS THE DEVICE BREACHED?
‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?
‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?
‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?
‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
24
FORENSICINVESTIGATION
1. HOW WAS THE DEVICE BREACHED?
‒ WHAT WAS THE ROOT CAUSE?
2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE?
‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE?
3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE?
‒ IS THERE A WAY TO DETECT INFECTED DEVICES?
4. WAS DATA EXFILTRATED FROM THE DEVICE?
‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO?
25
IN-HOUSE CAPABILITIES
26
What kind of
capabilities should I
have in-house?
Is there anything I
should not try to do
myself?
“BYFAILING TOPREPARE
YOUARE PREPARING TOFAIL”
BENJAMINFRANKLIN
27
 Scenarios based on real life,
adjusted to target organization
 GameMaster monitors actions
and generates additional
inputs
28
CRISIS MANAGEMENT
EXERCISE
THERE ARETWO TYPES OF
COMPANIES:
THOSE WHOHAVE BEEN
BREACHED, AND THOSE WHO
DON’T KNOW IT YET.
29
Q&A
30
Got hacked? It’s too late to run now!

More Related Content

What's hot

Michael DeMark Corporate Resume
Michael DeMark Corporate ResumeMichael DeMark Corporate Resume
Michael DeMark Corporate Resume
Michael DeMark
 
Cyber Deception After Detection: Safe Observation Environment Using Software ...
Cyber Deception After Detection: Safe Observation Environment Using Software ...Cyber Deception After Detection: Safe Observation Environment Using Software ...
Cyber Deception After Detection: Safe Observation Environment Using Software ...
Shimanaka Tohru
 
Advanced Threat Protection Lifecycle Infographic
Advanced Threat Protection Lifecycle InfographicAdvanced Threat Protection Lifecycle Infographic
Advanced Threat Protection Lifecycle Infographic
Blue Coat
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 

What's hot (20)

Phishing - Prevention and Detection and Remediation
Phishing - Prevention and Detection and RemediationPhishing - Prevention and Detection and Remediation
Phishing - Prevention and Detection and Remediation
 
Detect Threats Faster
Detect Threats FasterDetect Threats Faster
Detect Threats Faster
 
Gunshot detection sheet
Gunshot detection sheetGunshot detection sheet
Gunshot detection sheet
 
The Best Just Got Better, Intercept X Now With EDR
The Best Just Got Better, Intercept X Now With EDRThe Best Just Got Better, Intercept X Now With EDR
The Best Just Got Better, Intercept X Now With EDR
 
Holy Threat Intelligence AMPman! We Need Endpoint Security!
Holy Threat Intelligence AMPman! We Need Endpoint Security!Holy Threat Intelligence AMPman! We Need Endpoint Security!
Holy Threat Intelligence AMPman! We Need Endpoint Security!
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report
 
Threat Deception - Counter Techniques from the Defenders League
Threat Deception - Counter Techniques from the Defenders LeagueThreat Deception - Counter Techniques from the Defenders League
Threat Deception - Counter Techniques from the Defenders League
 
Michael DeMark Corporate Resume
Michael DeMark Corporate ResumeMichael DeMark Corporate Resume
Michael DeMark Corporate Resume
 
The Inmates Are Running the Asylum: Why Some Multi-Factor Authentication Tech...
The Inmates Are Running the Asylum: Why Some Multi-Factor Authentication Tech...The Inmates Are Running the Asylum: Why Some Multi-Factor Authentication Tech...
The Inmates Are Running the Asylum: Why Some Multi-Factor Authentication Tech...
 
Sarwono sutikno + yoko acc cybervulnerability risk and control for evolving...
Sarwono sutikno + yoko acc   cybervulnerability risk and control for evolving...Sarwono sutikno + yoko acc   cybervulnerability risk and control for evolving...
Sarwono sutikno + yoko acc cybervulnerability risk and control for evolving...
 
2016 Zika OYE! and TerrorView Hispanic Social Intelligence Report
2016 Zika OYE! and TerrorView Hispanic Social Intelligence Report2016 Zika OYE! and TerrorView Hispanic Social Intelligence Report
2016 Zika OYE! and TerrorView Hispanic Social Intelligence Report
 
Cyber Deception After Detection: Safe Observation Environment Using Software ...
Cyber Deception After Detection: Safe Observation Environment Using Software ...Cyber Deception After Detection: Safe Observation Environment Using Software ...
Cyber Deception After Detection: Safe Observation Environment Using Software ...
 
How to scale mobile application security testing
How to scale mobile application security testingHow to scale mobile application security testing
How to scale mobile application security testing
 
The Modern Malware Review March 2013
The Modern Malware Review March 2013The Modern Malware Review March 2013
The Modern Malware Review March 2013
 
Cyber Deception Architecture: Covert Attack Reconnaissance Using a Safe SDN A...
Cyber Deception Architecture: Covert Attack Reconnaissance Using a Safe SDN A...Cyber Deception Architecture: Covert Attack Reconnaissance Using a Safe SDN A...
Cyber Deception Architecture: Covert Attack Reconnaissance Using a Safe SDN A...
 
Advanced Threat Protection Lifecycle Infographic
Advanced Threat Protection Lifecycle InfographicAdvanced Threat Protection Lifecycle Infographic
Advanced Threat Protection Lifecycle Infographic
 
Wannacry
WannacryWannacry
Wannacry
 
Best Practices for Scoping Infections and Disrupting Breaches
Best Practices for Scoping Infections and Disrupting BreachesBest Practices for Scoping Infections and Disrupting Breaches
Best Practices for Scoping Infections and Disrupting Breaches
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Wie Sie Ransomware aufspüren und was Sie dagegen machen können
Wie Sie Ransomware aufspüren und was Sie dagegen machen könnenWie Sie Ransomware aufspüren und was Sie dagegen machen können
Wie Sie Ransomware aufspüren und was Sie dagegen machen können
 

Similar to Got hacked? It’s too late to run now!

[Challenge:Future] Proactive Counter-Terrorism
[Challenge:Future] Proactive Counter-Terrorism[Challenge:Future] Proactive Counter-Terrorism
[Challenge:Future] Proactive Counter-Terrorism
Challenge:Future
 
Lab 3 Explore Social Engineering TechniquesIntroductionCybers.pdf
Lab 3 Explore Social Engineering TechniquesIntroductionCybers.pdfLab 3 Explore Social Engineering TechniquesIntroductionCybers.pdf
Lab 3 Explore Social Engineering TechniquesIntroductionCybers.pdf
lalitaggarwal627
 
Insider threat webinar slides no cn
Insider threat webinar slides   no cnInsider threat webinar slides   no cn
Insider threat webinar slides no cn
DevOps.com
 
Cyber Portents and Precursors
Cyber Portents and PrecursorsCyber Portents and Precursors
Cyber Portents and Precursors
University of Hertfordshire
 

Similar to Got hacked? It’s too late to run now! (20)

UN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - MaccagliaUN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - Maccaglia
 
[Challenge:Future] Proactive Counter-Terrorism
[Challenge:Future] Proactive Counter-Terrorism[Challenge:Future] Proactive Counter-Terrorism
[Challenge:Future] Proactive Counter-Terrorism
 
Lab 3 Explore Social Engineering TechniquesIntroductionCybers.pdf
Lab 3 Explore Social Engineering TechniquesIntroductionCybers.pdfLab 3 Explore Social Engineering TechniquesIntroductionCybers.pdf
Lab 3 Explore Social Engineering TechniquesIntroductionCybers.pdf
 
Detecting and mitigating cyber threats and attacks1
Detecting and mitigating cyber threats and attacks1Detecting and mitigating cyber threats and attacks1
Detecting and mitigating cyber threats and attacks1
 
Why_TG
Why_TGWhy_TG
Why_TG
 
Insider threat webinar slides no cn
Insider threat webinar slides   no cnInsider threat webinar slides   no cn
Insider threat webinar slides no cn
 
Keynote : CODE BLUE in the ICU! by Jeff Moss
Keynote : CODE BLUE in the ICU! by Jeff MossKeynote : CODE BLUE in the ICU! by Jeff Moss
Keynote : CODE BLUE in the ICU! by Jeff Moss
 
Ethical Hacking Overview
Ethical Hacking OverviewEthical Hacking Overview
Ethical Hacking Overview
 
2.4.1 - Intro to Cyber Security for students.ppt
2.4.1 - Intro to Cyber Security for students.ppt2.4.1 - Intro to Cyber Security for students.ppt
2.4.1 - Intro to Cyber Security for students.ppt
 
Threat Hunters
Threat HuntersThreat Hunters
Threat Hunters
 
Basic Security Concepts of Computer
Basic Security Concepts of ComputerBasic Security Concepts of Computer
Basic Security Concepts of Computer
 
malware
malware malware
malware
 
The Cyber Pandemic - Jay bavisi
The Cyber Pandemic - Jay bavisiThe Cyber Pandemic - Jay bavisi
The Cyber Pandemic - Jay bavisi
 
Advanced Persistent Threat
Advanced Persistent ThreatAdvanced Persistent Threat
Advanced Persistent Threat
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
PPIT Lecture 17
PPIT Lecture 17PPIT Lecture 17
PPIT Lecture 17
 
Cyber Portents and Precursors
Cyber Portents and PrecursorsCyber Portents and Precursors
Cyber Portents and Precursors
 
A Secure Network Bridging the Gap
A Secure Network Bridging the GapA Secure Network Bridging the Gap
A Secure Network Bridging the Gap
 
Unit-2 ICS.ppt
Unit-2 ICS.pptUnit-2 ICS.ppt
Unit-2 ICS.ppt
 
Cyber threats landscape and defense
Cyber threats landscape and defenseCyber threats landscape and defense
Cyber threats landscape and defense
 

More from F-Secure Corporation

More from F-Secure Corporation (20)

Post-mortem of a data breach
Post-mortem of a data breachPost-mortem of a data breach
Post-mortem of a data breach
 
The Real Costs of SIEM vs. Managed Security Service
The Real Costs of SIEM vs. Managed Security ServiceThe Real Costs of SIEM vs. Managed Security Service
The Real Costs of SIEM vs. Managed Security Service
 
Security A to Z: Glossary of the most important terms
Security A to Z: Glossary of the most important termsSecurity A to Z: Glossary of the most important terms
Security A to Z: Glossary of the most important terms
 
Les attaques menées depuis la France dans le cyber espace
Les attaques menées depuis la France dans le cyber espace Les attaques menées depuis la France dans le cyber espace
Les attaques menées depuis la France dans le cyber espace
 
Les attaques menées depuis la France dans le cyber espace
Les attaques menées depuis la France dans le cyber espaceLes attaques menées depuis la France dans le cyber espace
Les attaques menées depuis la France dans le cyber espace
 
Cyber security webinar 6 - How to build systems that resist attacks?
Cyber security webinar 6 - How to build systems that resist attacks?Cyber security webinar 6 - How to build systems that resist attacks?
Cyber security webinar 6 - How to build systems that resist attacks?
 
Defending Servers - Cyber security webinar part 3
Defending Servers - Cyber security webinar part 3Defending Servers - Cyber security webinar part 3
Defending Servers - Cyber security webinar part 3
 
Defending Workstations - Cyber security webinar part 2
Defending Workstations - Cyber security webinar part 2Defending Workstations - Cyber security webinar part 2
Defending Workstations - Cyber security webinar part 2
 
Cyber security webinar part 1 - Threat Landscape
Cyber security webinar part 1 - Threat LandscapeCyber security webinar part 1 - Threat Landscape
Cyber security webinar part 1 - Threat Landscape
 
F secure Radar vulnerability scanning and management
F secure Radar vulnerability scanning and managementF secure Radar vulnerability scanning and management
F secure Radar vulnerability scanning and management
 
F-Secure Policy Manager - onsite security management with superior control
F-Secure Policy Manager - onsite security management with superior controlF-Secure Policy Manager - onsite security management with superior control
F-Secure Policy Manager - onsite security management with superior control
 
The State of the Net in India
The State of the Net in IndiaThe State of the Net in India
The State of the Net in India
 
Best business protection for windows
Best business protection for windowsBest business protection for windows
Best business protection for windows
 
Six things to take into account when choosing cloud solutions
Six things to take into account when choosing cloud solutionsSix things to take into account when choosing cloud solutions
Six things to take into account when choosing cloud solutions
 
Small and midsize business security is big business
Small and midsize business security is big businessSmall and midsize business security is big business
Small and midsize business security is big business
 
大きなビジネスを生み出す中小中堅企業
大きなビジネスを生み出す中小中堅企業大きなビジネスを生み出す中小中堅企業
大きなビジネスを生み出す中小中堅企業
 
Why should you care about government surveillance?
Why should you care about government surveillance?Why should you care about government surveillance?
Why should you care about government surveillance?
 
Arbeta var du vill- eBook om modern mobilitet
Arbeta var du vill- eBook om modern mobilitetArbeta var du vill- eBook om modern mobilitet
Arbeta var du vill- eBook om modern mobilitet
 
Psb mobile security
Psb mobile securityPsb mobile security
Psb mobile security
 
Internet gatekeeper
Internet gatekeeperInternet gatekeeper
Internet gatekeeper
 

Recently uploaded

%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
masabamasaba
 
Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...
Medical / Health Care (+971588192166) Mifepristone and Misoprostol tablets 200mg
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
Health
 
Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...
Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...
Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...
chiefasafspells
 
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Medical / Health Care (+971588192166) Mifepristone and Misoprostol tablets 200mg
 
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
masabamasaba
 
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
masabamasaba
 
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
masabamasaba
 

Recently uploaded (20)

%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
 
Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ 🏥 Women's Abortion Clinic In Pre...
 
%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain
%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain
%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain
 
Announcing Codolex 2.0 from GDK Software
Announcing Codolex 2.0 from GDK SoftwareAnnouncing Codolex 2.0 from GDK Software
Announcing Codolex 2.0 from GDK Software
 
Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...
Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...
Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
 
Shapes for Sharing between Graph Data Spaces - and Epistemic Querying of RDF-...
Shapes for Sharing between Graph Data Spaces - and Epistemic Querying of RDF-...Shapes for Sharing between Graph Data Spaces - and Epistemic Querying of RDF-...
Shapes for Sharing between Graph Data Spaces - and Epistemic Querying of RDF-...
 
%in ivory park+277-882-255-28 abortion pills for sale in ivory park
%in ivory park+277-882-255-28 abortion pills for sale in ivory park %in ivory park+277-882-255-28 abortion pills for sale in ivory park
%in ivory park+277-882-255-28 abortion pills for sale in ivory park
 
What Goes Wrong with Language Definitions and How to Improve the Situation
What Goes Wrong with Language Definitions and How to Improve the SituationWhat Goes Wrong with Language Definitions and How to Improve the Situation
What Goes Wrong with Language Definitions and How to Improve the Situation
 
Microsoft AI Transformation Partner Playbook.pdf
Microsoft AI Transformation Partner Playbook.pdfMicrosoft AI Transformation Partner Playbook.pdf
Microsoft AI Transformation Partner Playbook.pdf
 
%in Benoni+277-882-255-28 abortion pills for sale in Benoni
%in Benoni+277-882-255-28 abortion pills for sale in Benoni%in Benoni+277-882-255-28 abortion pills for sale in Benoni
%in Benoni+277-882-255-28 abortion pills for sale in Benoni
 
Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...
Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...
Love witchcraft +27768521739 Binding love spell in Sandy Springs, GA |psychic...
 
%in kempton park+277-882-255-28 abortion pills for sale in kempton park
%in kempton park+277-882-255-28 abortion pills for sale in kempton park %in kempton park+277-882-255-28 abortion pills for sale in kempton park
%in kempton park+277-882-255-28 abortion pills for sale in kempton park
 
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
 
Architecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the pastArchitecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the past
 
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
 
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
 
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
 
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
 
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
 

Got hacked? It’s too late to run now!

  • 1. GOT HACKED? IT’STOO LATE TO RUN NOW. Janne Kauhanen Twitter: @JKauhanen
  • 2. 360° OFCYBER SECURITY 2 MINIMIZE ATTACK SURFACE PREVENT INCIDENTS UNDERSTAND YOUR RISK, KNOW YOUR ATTACK SURFACE, UNCOVER WEAK SPOTS REACT TO BREACHES, MITIGATE THE DAMAGE, ANALYZE AND LEARN RECOGNIZE INCIDENTS AND THREATS, ISOLATE AND CONTAIN THEM
  • 3. AGENDA 3  Definitions  Threat detection, a short summary  Why do you get hacked?  What to do when you get hacked?  Incident Response process  Forensics  Incident Response capabilities you should (and shouldn’t) have  Crisis management
  • 4. SECURITY INCIDENTS Hacker actions 4 Information leak Widespread malware infection Internal misbehavior (unintentional included)
  • 5. "ASECURITY INCIDENT IS ANYKINDOFACTION THAT RESULTS INACHANGE TOAKNOWN GOOD STATE.“ KURTHAGERMAN,CISO,ARMORDEFENSEINC. 5
  • 6. THEDOS ANDDON’TS OF THREAT DETECTION RECAPOFWEBINAR#3 6
  • 7. WHYDIDIGETHACKED? 7 "DRIVE BY" & SCRIPT KIDDIES FOCUS SKILL TARGETED ATTACKS IDENTITY THEFT, 0DAY EXPLOITS ADVANCED PERSISTENT THREATS
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16. INCIDENT RESPONSE PROCESS 16 Briefing Identification Containment Recovery Aftermath
  • 17. INCIDENT RESPONSE PROCESS 17 Briefing Identification Containment Recovery Aftermath
  • 18. INCIDENT RESPONSE PROCESS 18 Briefing Identification Containment Recovery Aftermath
  • 19. INCIDENT RESPONSE PROCESS 19 Briefing Identification Containment Recovery Aftermath
  • 20. INCIDENT RESPONSE PROCESS 20 Briefing Identification Containment Recovery Aftermath
  • 21. FORENSICINVESTIGATION 1. HOW WAS THE DEVICE BREACHED? ‒ WHAT WAS THE ROOT CAUSE? 2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE? ‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE? 3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE? ‒ IS THERE A WAY TO DETECT INFECTED DEVICES? 4. WAS DATA EXFILTRATED FROM THE DEVICE? ‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO? 21
  • 22. FORENSICINVESTIGATION 1. HOW WAS THE DEVICE BREACHED? ‒ WHAT WAS THE ROOT CAUSE? 2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE? ‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE? 3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE? ‒ IS THERE A WAY TO DETECT INFECTED DEVICES? 4. WAS DATA EXFILTRATED FROM THE DEVICE? ‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO? 22
  • 23. FORENSICINVESTIGATION 1. HOW WAS THE DEVICE BREACHED? ‒ WHAT WAS THE ROOT CAUSE? 2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE? ‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE? 3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE? ‒ IS THERE A WAY TO DETECT INFECTED DEVICES? 4. WAS DATA EXFILTRATED FROM THE DEVICE? ‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO? 23
  • 24. FORENSICINVESTIGATION 1. HOW WAS THE DEVICE BREACHED? ‒ WHAT WAS THE ROOT CAUSE? 2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE? ‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE? 3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE? ‒ IS THERE A WAY TO DETECT INFECTED DEVICES? 4. WAS DATA EXFILTRATED FROM THE DEVICE? ‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO? 24
  • 25. FORENSICINVESTIGATION 1. HOW WAS THE DEVICE BREACHED? ‒ WHAT WAS THE ROOT CAUSE? 2. HOW DID THE ATTACKER COMMUNICATE WITH THE DEVICE? ‒ IS THE ATTACKER STILL ABLE TO COMMUNICATE WITH THE DEVICE? 3. WAS THE ATTACKER ABLE TO MOVE BEYOND THIS DEVICE? ‒ IS THERE A WAY TO DETECT INFECTED DEVICES? 4. WAS DATA EXFILTRATED FROM THE DEVICE? ‒ HOW MUCH DATA, WHAT KIND OF DATA, AND WHERE DID IT GO? 25
  • 26. IN-HOUSE CAPABILITIES 26 What kind of capabilities should I have in-house? Is there anything I should not try to do myself?
  • 27. “BYFAILING TOPREPARE YOUARE PREPARING TOFAIL” BENJAMINFRANKLIN 27
  • 28.  Scenarios based on real life, adjusted to target organization  GameMaster monitors actions and generates additional inputs 28 CRISIS MANAGEMENT EXERCISE
  • 29. THERE ARETWO TYPES OF COMPANIES: THOSE WHOHAVE BEEN BREACHED, AND THOSE WHO DON’T KNOW IT YET. 29