2019 DerbyCon - Ryan Elkins - Scientific Computing for Information Security

1. Scientific Computing for
Information Security
Forging the missing link
Ryan Elkins
@ryanelkins
ryan-elkins@outlook.com

2. Ryan Elkins
@the_ryan_elkins
@ryanelkins
My views are my own.
Information Security Architect Security Researcher

3. Thank you!
• Jeremiah Grossman (Influence/Reference)
• HD Moore (Project Sonar)
• Evan Perotti (AWS API)
• Dan Kaminsky (Influence/Reference)
• Justin Bollinger (crt.sh automation)
• Toby Hendricks (Jupyter and data science)

4. David Rowan – Wired – Atech 2017

5. Security
Strategy and
Architecture
Security
Awareness
and
Education
Governance,
Risk, and
Compliance
Monitoring
and Incident
Response
Vulnerability
Management
Network
Security
Endpoint
Protection
Secure
Development
Access
Protection
Data
Protection
Bolt-on Security Embedded Security
On-Premise Multi-Cloud
Business
Solution
Business
Solution
$$$$$$
Modular software, unopinionated deployment.Security by Design

6. Multi-Cloud
Hybrid Multi-Cloud
$$$
$$$
$$$
$$$
$$$
$$$
$$$
$$$
$$$
$$$
An interconnected, decentralized ecosystem.

7. Robotic Process Automation Eliminate manual processes.
DevOps
Information
Security
Engineering
Systems
Administration
Quality
Assurance
Production
Support
Lifecycle
Management

9. Three major shifts driving mass adoption.

10. Democratized Accessibility Increasing number of public data sets.

11. Data Gravity Computational capabilities must be built near the data.

12. Financially Viable No longer cost prohibitive.

13. Let’s get started!

14. Jupyter Notebook?
?
?

15. ?
?Jupyter Notebook?

16. • Open source web application for interactive
computing.
• Supports over 40 programming languages.
• Notebooks contain live code, equations,
visualizations, and narrative text.
Jupyter – Julia, Python, and R

18. Security experts love to tell stories.
Data visualizations help us tell
these stories.

19. 5th Grade Science
Scientific Method
The scientific method is an empirical method
of acquiring knowledge that has
characterized the development
of science since at least the 17th century.

20. Asking the right questions.
Sharing the right insights.

21. Asking the right questions.
Sharing the right insights.
• Adversary: How can I perform passive reconnaissance without
touching the target?

22. Asking the right questions.
Sharing the right insights.
• Adversary: How can I perform passive reconnaissance without
touching the target?
• CISO: What does our external attack surface look like?

23. Asking the right questions.
Sharing the right insights.
• Adversary: How can I perform passive reconnaissance without
touching the target?
• CISO: What does our external attack surface look like?
• CEO: What does our company look like to our shareholders,
customers, and competitors?

24. Passive Recon Demo
http://securityriskadvisors.com/blog/creating-a-
project-sonar-fdns-api-with-aws/ - Evan Perotti

31. Derbycon.com
- Passive recon

32. Certificate Transparency Reporting
Special thanks to Justin Bollinger
@Bandrel for developing the script to
enumerate and parse crt.sh.

33. Program Value/Measurement
“Security technology management
keeps the system fine tuned. But the
secret sauce? That’s in data
enrichment. That’s where the magic
happens.”
- Robert Herjavec

34. • Patch Management Team: Why are we so busy over the holidays?
• Security Manager: At what times do we need to increase staffing?
• CISO: Why are our vulnerability counts increasing?
Asking the right questions.
Sharing the right insights.

35. Program Value/Measurement
Common Vulnerabilities &
Exposures (CVEs)
• Growth over the past 20
years.

36. Expertise must keep up with an
evolving attack surface and a
dynamic nature of threats.
Competition for talent
Challenges to Solve
“the average CISO tenure is only about 24 to 48 months”
- 38% leave for higher compensation
- 36% leave for lack of security culture
- 34% leave for not being active members with executive
management or board of directors
- 31% leave from lack of budget

37. Expertise must keep up with an
evolving attack surface and a
dynamic nature of threats.
Programs are reactive and rarely
maintain a multi-year roadmap.
Competition for talent
Program continuity
Challenges to Solve

38. Expertise must keep up with an
evolving attack surface and a
dynamic nature of threats.
Programs are reactive and rarely
maintain a multi-year roadmap.
Visibility and speed of execution
must improve with automation.
Competition for talent
Program continuity
Continuous risk measurement
Challenges to Solve

39. Thank you!
• Name: Ryan Elkins
• Twitter: @ryanelkins
• Email: ryan-elkins@outlook.com