SlideShare a Scribd company logo
1 of 32
Download to read offline
Modern Adversaries
Why modern hackers are winning the battle
and how we can still win the war
Andy Manoske, Principal
Who is Amplify Partners?
We are an early stage, entrepreneur-focused
venture capital firm investing in technical teams solving
technical problems
@AmplifyPartners

www.amplifypartners.com
About the Author
Andy Manoske
Product @ AlienVault 

(Open Threat Exchange, AlienVault Labs Research)
Product @ NetApp

(Product Security, Cryptography)
Principal, Amplify Partners
Economics & Computer Science @ SJSU

(Mathematic Economics, Information Security)
@a2d2

Cyberattack Reports to US-CERT by Year
0
17500
35000
52500
70000
2006 2007 2008 2009 2010 2011 2012 2013 2014
Successful cyberattacks are on the rise…
Source: US CERT
…because we are facing
more sophisticated
attackers
Source: Verizon DBIR 2014
The modern hacker is an advanced adversary…
but not necessarily because it’s better than previous

generations of attackers.
(Sorry, Neo)
Instead, modern hacking tools are more advanced

and more available than ever before
Source: Axiomatic Design/Design Patterns Mashup: Part 2 (Cyber Security)
These tools make even novice modern hackers….
…incredibly dangerous
Modern adversaries are able to strike highly defended 

targets
because hacking tools have advanced faster than

security systems that detect and stop attacks
Anthem was well defended
200 person 

Information Security Staff
$50 Million

spent on security per year
Source: Indianapolis Business Journal
But they were not prepared for
their adversary’s complex attack
>12 Months 

Access to sensitive user data
80 Million

Records stolen
Source: Crowdstrike, NYT
To build new security systems 

that can defend against complex attacks
We need to build software that can detect, and stop,

modern tools used by modern adversaries
Who are Modern
Adversaries?
The modern hacker is 

frequently a professional
…who attacks 

private businesses

for financial gain
Source: Hackmageddon
Most modern attacks target companies to steal valuable data:
Source: Hackmageddon
most frequently financial data or intellectual property.
Hackers then sell this stolen data on the
black market
and that data is used increasingly to
commit identity theft, espionage, and
possibly even acts of terrorism.
Reported PII theft and fraud, 2006-2014
Not every cyberattack is focused on profit.
Defacing or destroying online property remains a
key objective for many advanced adversaries
Reported PII theft and fraud, 2006-2014There are typically three types of
modern adversary
State Sponsored

Hackers
Organized Crime Hacktivists
Reported PII theft and fraud, 2006-2014
State Sponsored Adversary: 

Energetic Bear / Dragonfly
Russian hacking group either supported
or directly managed by Russian state
intelligence
● Unpublicized attack on petroleum
pipeline operator to steal energy
infrastructure information
● Unpublicized Industrial Control System
(ICS) sabotage of EU-based energy
management operator to cause future
attacks and outages
Reported PII theft and fraud, 2006-2014
Organized Crime Adversary: 

Solntsevskaya Bratva
Largest crime syndicate of the Russian
mob heavily involved in cybercrime,
with >$3B in annual revenue from
hacking
● 2014 JP Morgan Chase data breach
targeting wealth management and
credit card user data
● 2008 cyberattacks to spread
disinformation on Georgian government
websites during Russia’s invasion of
South Ossetia
Reported PII theft and fraud, 2006-2014Hacktivist Adversary: 

AntiSec
Anarchist campaign of former members
of hacking group Lulzsec and members
of the Anonymous community.
● 2014 data breach of the US
International Association of Chiefs of
Police to leak personnel data in
response to investigations on Occupy
Wall Street protestors.
● 2011 compromise of Fox News’ Twitter
account to spread fake story that
President Obama had been injured in a
Terrorist bombing.
Most attacks are being perpetrated
by organized crime hackers and
hacktivists
Source: Hackmageddon
Attacker Sophistication
Attacker Resources
Hacktivists
Organized Crime
State Sponsored Hacking
Which means most attacks are from less
individually sophisticated adversaries…
…who employ less sophisticated attacks…
…reliant upon pre-made tools and malware
To confront the majority of attacks from
advanced adversaries
We must detect and stop modern hacking
tools
Unfortunately, modern hacking tools and
malware are good at evading detection
Encryption
Modern malware is frequently encrypted to defeat

signature-based intrusion detection systems
Botnets
Modern hacking tools and malware hide behind 

legions of slaved “zombie” computers
But while botnets and encryption may hide
most tools and malware
The command and control (or “C2”)
structure behind those tools generally
remains the same
Source: Cisco
Source: AlienVault
Example: Attackers who struck the US Office of Personnel
Management (OPM)
used the same C2 server…
…that was used to attack
as well as several US 

companies in…
Defense Aviation
Oil and Gas

Infrastructure
Source: AlienVault, Symantec
There is a lot of things the security industry can do to 

confront modern threats…
…but if we want to stop most attacks from advanced 

adversaries we need to build software that
SHARES DATA ON ATTACKERS
Automatically shares analysis data to 

open-source platforms to be used in

security defenses
PERFORMS DYNAMIC ANALYSIS
Introspects incoming files and traffic for

possible C2 infrastructure
TL;DR
A new generation of modern adversaries

is driving a hacking boom
This generation has access to powerful, 

easy to use hacking tools
If we do not rethink our approach and update

our security systems, the advantage enjoyed

by modern adversaries will continue to grow

More Related Content

What's hot

Axxera End Point Security Protection
Axxera End Point Security ProtectionAxxera End Point Security Protection
Axxera End Point Security ProtectionShawn Crimson
 
What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...
What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...
What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...Symantec
 
The State Of Information and Cyber Security in 2016
The State Of Information and Cyber Security in 2016The State Of Information and Cyber Security in 2016
The State Of Information and Cyber Security in 2016Shannon G., MBA
 
Real Life Examples of Cybersecurity with Neo4j
 Real Life Examples of Cybersecurity with Neo4j Real Life Examples of Cybersecurity with Neo4j
Real Life Examples of Cybersecurity with Neo4jNeo4j
 
Updated Cyber Security and Fraud Prevention Tools Tactics
Updated Cyber Security and Fraud Prevention Tools TacticsUpdated Cyber Security and Fraud Prevention Tools Tactics
Updated Cyber Security and Fraud Prevention Tools TacticsBen Graybar
 
Year of pawnage - Ian trump
Year of pawnage  - Ian trumpYear of pawnage  - Ian trump
Year of pawnage - Ian trumpMAXfocus
 
Cyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & RecommendationsCyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & RecommendationsUlf Mattsson
 
Cyber Security 101: What Your Agency Needs to Know
Cyber Security 101: What Your Agency Needs to KnowCyber Security 101: What Your Agency Needs to Know
Cyber Security 101: What Your Agency Needs to KnowSandra Fathi
 
Open Source Insight: Security Breaches and Cryptocurrency Dominating News
Open Source Insight: Security Breaches and Cryptocurrency Dominating NewsOpen Source Insight: Security Breaches and Cryptocurrency Dominating News
Open Source Insight: Security Breaches and Cryptocurrency Dominating NewsBlack Duck by Synopsys
 
The Top Three 2021 Cyber Threats
The Top Three 2021 Cyber ThreatsThe Top Three 2021 Cyber Threats
The Top Three 2021 Cyber ThreatsSai Huda
 
cybersecurity and cyber crime
cybersecurity and cyber crimecybersecurity and cyber crime
cybersecurity and cyber crimeDarshan Aswani
 
State of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and SolutionsState of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and SolutionsGoutama Bachtiar
 
140707_Cyber-Security
140707_Cyber-Security140707_Cyber-Security
140707_Cyber-SecurityTara Gravel
 
Strategies to combat new, innovative cyber threats in 2019
Strategies to combat new, innovative cyber threats in 2019Strategies to combat new, innovative cyber threats in 2019
Strategies to combat new, innovative cyber threats in 2019SrikanthRaju7
 
HE Mag_New Cyber Threats_ITSource
HE Mag_New Cyber Threats_ITSourceHE Mag_New Cyber Threats_ITSource
HE Mag_New Cyber Threats_ITSourceBrian Arellanes
 
Security - intelligence - maturity-model-ciso-whitepaper
Security - intelligence - maturity-model-ciso-whitepaperSecurity - intelligence - maturity-model-ciso-whitepaper
Security - intelligence - maturity-model-ciso-whitepaperCMR WORLD TECH
 
[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...
[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...
[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...CODE BLUE
 

What's hot (20)

Digital Threat Landscape
Digital Threat LandscapeDigital Threat Landscape
Digital Threat Landscape
 
Axxera End Point Security Protection
Axxera End Point Security ProtectionAxxera End Point Security Protection
Axxera End Point Security Protection
 
What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...
What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...
What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...
 
The State Of Information and Cyber Security in 2016
The State Of Information and Cyber Security in 2016The State Of Information and Cyber Security in 2016
The State Of Information and Cyber Security in 2016
 
Real Life Examples of Cybersecurity with Neo4j
 Real Life Examples of Cybersecurity with Neo4j Real Life Examples of Cybersecurity with Neo4j
Real Life Examples of Cybersecurity with Neo4j
 
Updated Cyber Security and Fraud Prevention Tools Tactics
Updated Cyber Security and Fraud Prevention Tools TacticsUpdated Cyber Security and Fraud Prevention Tools Tactics
Updated Cyber Security and Fraud Prevention Tools Tactics
 
Year of pawnage - Ian trump
Year of pawnage  - Ian trumpYear of pawnage  - Ian trump
Year of pawnage - Ian trump
 
Cyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & RecommendationsCyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & Recommendations
 
Cyber Security 101: What Your Agency Needs to Know
Cyber Security 101: What Your Agency Needs to KnowCyber Security 101: What Your Agency Needs to Know
Cyber Security 101: What Your Agency Needs to Know
 
Open Source Insight: Security Breaches and Cryptocurrency Dominating News
Open Source Insight: Security Breaches and Cryptocurrency Dominating NewsOpen Source Insight: Security Breaches and Cryptocurrency Dominating News
Open Source Insight: Security Breaches and Cryptocurrency Dominating News
 
The Top Three 2021 Cyber Threats
The Top Three 2021 Cyber ThreatsThe Top Three 2021 Cyber Threats
The Top Three 2021 Cyber Threats
 
cybersecurity and cyber crime
cybersecurity and cyber crimecybersecurity and cyber crime
cybersecurity and cyber crime
 
State of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and SolutionsState of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and Solutions
 
140707_Cyber-Security
140707_Cyber-Security140707_Cyber-Security
140707_Cyber-Security
 
Strategies to combat new, innovative cyber threats in 2019
Strategies to combat new, innovative cyber threats in 2019Strategies to combat new, innovative cyber threats in 2019
Strategies to combat new, innovative cyber threats in 2019
 
HE Mag_New Cyber Threats_ITSource
HE Mag_New Cyber Threats_ITSourceHE Mag_New Cyber Threats_ITSource
HE Mag_New Cyber Threats_ITSource
 
Data Security Breach: The Sony & Staples Story
Data Security Breach: The Sony & Staples StoryData Security Breach: The Sony & Staples Story
Data Security Breach: The Sony & Staples Story
 
Security - intelligence - maturity-model-ciso-whitepaper
Security - intelligence - maturity-model-ciso-whitepaperSecurity - intelligence - maturity-model-ciso-whitepaper
Security - intelligence - maturity-model-ciso-whitepaper
 
[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...
[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...
[CB21] Keynote1:Shaking the Cybersecurity Kaleidoscope – An Immersive Look in...
 
Security/Compliance - Advanced Threat Detection and Compliance
Security/Compliance - Advanced Threat Detection and ComplianceSecurity/Compliance - Advanced Threat Detection and Compliance
Security/Compliance - Advanced Threat Detection and Compliance
 

Similar to Modern Adversaries (Amplify Partners)

Types of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsTypes of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsLearningwithRayYT
 
8 Types of Cyber Attacks That Can Bother CISOs in 2020
8 Types of Cyber Attacks That Can Bother CISOs in 20208 Types of Cyber Attacks That Can Bother CISOs in 2020
8 Types of Cyber Attacks That Can Bother CISOs in 2020SecPod Technologies
 
Corporate threat vector and landscape
Corporate threat vector and landscapeCorporate threat vector and landscape
Corporate threat vector and landscapeyohansurya2
 
54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docx
54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docx54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docx
54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docxalinainglis
 
Cyber threats landscape and defense
Cyber threats landscape and defenseCyber threats landscape and defense
Cyber threats landscape and defensefantaghost
 
Building A Recommender System For Architecture Related...
Building A Recommender System For Architecture Related...Building A Recommender System For Architecture Related...
Building A Recommender System For Architecture Related...Ariana Davis
 
Detecting ARP Spoofing Essay
Detecting ARP Spoofing EssayDetecting ARP Spoofing Essay
Detecting ARP Spoofing EssayKimberly Bundy
 
UN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - MaccagliaUN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - MaccagliaStefano Maccaglia
 
E security and payment 2013-1
E security  and payment 2013-1E security  and payment 2013-1
E security and payment 2013-1Abdelfatah hegazy
 
ShadyRAT: Anatomy of targeted attack
ShadyRAT: Anatomy of targeted attackShadyRAT: Anatomy of targeted attack
ShadyRAT: Anatomy of targeted attackVladyslav Radetsky
 
Malware Problem Analysis Paper.pdfMalware Problem Analysis Paper
Malware Problem Analysis Paper.pdfMalware Problem Analysis PaperMalware Problem Analysis Paper.pdfMalware Problem Analysis Paper
Malware Problem Analysis Paper.pdfMalware Problem Analysis PaperSarah Jimenez
 
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...Invincea, Inc.
 
PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018
PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018
PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018Panda Security
 
The Comprehensive Security Policy In The Trojan War
The Comprehensive Security Policy In The Trojan WarThe Comprehensive Security Policy In The Trojan War
The Comprehensive Security Policy In The Trojan WarMandy Cross
 
Malware Awareness Essay
Malware Awareness EssayMalware Awareness Essay
Malware Awareness EssaySydney Noriega
 
Craig wilson
Craig wilsonCraig wilson
Craig wilsonIPPAI
 
E-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONS
E-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONSE-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONS
E-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONSrausdeen anfas
 
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsStop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsInvincea, Inc.
 

Similar to Modern Adversaries (Amplify Partners) (20)

Types of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsTypes of Threat Actors and Attack Vectors
Types of Threat Actors and Attack Vectors
 
8 Types of Cyber Attacks That Can Bother CISOs in 2020
8 Types of Cyber Attacks That Can Bother CISOs in 20208 Types of Cyber Attacks That Can Bother CISOs in 2020
8 Types of Cyber Attacks That Can Bother CISOs in 2020
 
Corporate threat vector and landscape
Corporate threat vector and landscapeCorporate threat vector and landscape
Corporate threat vector and landscape
 
54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docx
54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docx54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docx
54 Chapter 1 • The Threat EnvironmentFIGURE 1-18 Cyberwar .docx
 
Cyber threats landscape and defense
Cyber threats landscape and defenseCyber threats landscape and defense
Cyber threats landscape and defense
 
Dbr Case
Dbr CaseDbr Case
Dbr Case
 
Building A Recommender System For Architecture Related...
Building A Recommender System For Architecture Related...Building A Recommender System For Architecture Related...
Building A Recommender System For Architecture Related...
 
Detecting ARP Spoofing Essay
Detecting ARP Spoofing EssayDetecting ARP Spoofing Essay
Detecting ARP Spoofing Essay
 
UN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - MaccagliaUN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - Maccaglia
 
E security and payment 2013-1
E security  and payment 2013-1E security  and payment 2013-1
E security and payment 2013-1
 
ShadyRAT: Anatomy of targeted attack
ShadyRAT: Anatomy of targeted attackShadyRAT: Anatomy of targeted attack
ShadyRAT: Anatomy of targeted attack
 
Malware Problem Analysis Paper.pdfMalware Problem Analysis Paper
Malware Problem Analysis Paper.pdfMalware Problem Analysis PaperMalware Problem Analysis Paper.pdfMalware Problem Analysis Paper
Malware Problem Analysis Paper.pdfMalware Problem Analysis Paper
 
Cybersecurity - Sam Maccherola
Cybersecurity - Sam MaccherolaCybersecurity - Sam Maccherola
Cybersecurity - Sam Maccherola
 
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
 
PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018
PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018
PandaLabs Reveals its Predictions for Cybersecurity Trends in 2018
 
The Comprehensive Security Policy In The Trojan War
The Comprehensive Security Policy In The Trojan WarThe Comprehensive Security Policy In The Trojan War
The Comprehensive Security Policy In The Trojan War
 
Malware Awareness Essay
Malware Awareness EssayMalware Awareness Essay
Malware Awareness Essay
 
Craig wilson
Craig wilsonCraig wilson
Craig wilson
 
E-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONS
E-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONSE-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONS
E-COMMERCE SECURITY, FRAUD ISSUES AND PROTECTIONS
 
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsStop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
 

Recently uploaded

Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAshyamraj55
 
The Kubernetes Gateway API and its role in Cloud Native API Management
The Kubernetes Gateway API and its role in Cloud Native API ManagementThe Kubernetes Gateway API and its role in Cloud Native API Management
The Kubernetes Gateway API and its role in Cloud Native API ManagementNuwan Dias
 
Cybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptxCybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptxGDSC PJATK
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1DianaGray10
 
How Accurate are Carbon Emissions Projections?
How Accurate are Carbon Emissions Projections?How Accurate are Carbon Emissions Projections?
How Accurate are Carbon Emissions Projections?IES VE
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdfPedro Manuel
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintMahmoud Rabie
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8DianaGray10
 
100+ ChatGPT Prompts for SEO Optimization
100+ ChatGPT Prompts for SEO Optimization100+ ChatGPT Prompts for SEO Optimization
100+ ChatGPT Prompts for SEO Optimizationarrow10202532yuvraj
 
99.99% of Your Traces Are (Probably) Trash (SRECon NA 2024).pdf
99.99% of Your Traces  Are (Probably) Trash (SRECon NA 2024).pdf99.99% of Your Traces  Are (Probably) Trash (SRECon NA 2024).pdf
99.99% of Your Traces Are (Probably) Trash (SRECon NA 2024).pdfPaige Cruz
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IES VE
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024D Cloud Solutions
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDELiveplex
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfinfogdgmi
 
IEEE Computer Society’s Strategic Activities and Products including SWEBOK Guide
IEEE Computer Society’s Strategic Activities and Products including SWEBOK GuideIEEE Computer Society’s Strategic Activities and Products including SWEBOK Guide
IEEE Computer Society’s Strategic Activities and Products including SWEBOK GuideHironori Washizaki
 
UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7DianaGray10
 
UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPathCommunity
 
Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemAsko Soukka
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsSeth Reyes
 

Recently uploaded (20)

Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
 
The Kubernetes Gateway API and its role in Cloud Native API Management
The Kubernetes Gateway API and its role in Cloud Native API ManagementThe Kubernetes Gateway API and its role in Cloud Native API Management
The Kubernetes Gateway API and its role in Cloud Native API Management
 
Cybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptxCybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptx
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1
 
How Accurate are Carbon Emissions Projections?
How Accurate are Carbon Emissions Projections?How Accurate are Carbon Emissions Projections?
How Accurate are Carbon Emissions Projections?
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdf
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership Blueprint
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8
 
100+ ChatGPT Prompts for SEO Optimization
100+ ChatGPT Prompts for SEO Optimization100+ ChatGPT Prompts for SEO Optimization
100+ ChatGPT Prompts for SEO Optimization
 
20230104 - machine vision
20230104 - machine vision20230104 - machine vision
20230104 - machine vision
 
99.99% of Your Traces Are (Probably) Trash (SRECon NA 2024).pdf
99.99% of Your Traces  Are (Probably) Trash (SRECon NA 2024).pdf99.99% of Your Traces  Are (Probably) Trash (SRECon NA 2024).pdf
99.99% of Your Traces Are (Probably) Trash (SRECon NA 2024).pdf
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdf
 
IEEE Computer Society’s Strategic Activities and Products including SWEBOK Guide
IEEE Computer Society’s Strategic Activities and Products including SWEBOK GuideIEEE Computer Society’s Strategic Activities and Products including SWEBOK Guide
IEEE Computer Society’s Strategic Activities and Products including SWEBOK Guide
 
UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7
 
UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation Developers
 
Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystem
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and Hazards
 

Modern Adversaries (Amplify Partners)

  • 1. Modern Adversaries Why modern hackers are winning the battle and how we can still win the war Andy Manoske, Principal
  • 2. Who is Amplify Partners? We are an early stage, entrepreneur-focused venture capital firm investing in technical teams solving technical problems @AmplifyPartners
 www.amplifypartners.com
  • 3. About the Author Andy Manoske Product @ AlienVault 
 (Open Threat Exchange, AlienVault Labs Research) Product @ NetApp
 (Product Security, Cryptography) Principal, Amplify Partners Economics & Computer Science @ SJSU
 (Mathematic Economics, Information Security) @a2d2

  • 4. Cyberattack Reports to US-CERT by Year 0 17500 35000 52500 70000 2006 2007 2008 2009 2010 2011 2012 2013 2014 Successful cyberattacks are on the rise… Source: US CERT
  • 5. …because we are facing more sophisticated attackers Source: Verizon DBIR 2014
  • 6. The modern hacker is an advanced adversary… but not necessarily because it’s better than previous
 generations of attackers. (Sorry, Neo)
  • 7. Instead, modern hacking tools are more advanced
 and more available than ever before Source: Axiomatic Design/Design Patterns Mashup: Part 2 (Cyber Security)
  • 8. These tools make even novice modern hackers…. …incredibly dangerous
  • 9. Modern adversaries are able to strike highly defended 
 targets because hacking tools have advanced faster than
 security systems that detect and stop attacks
  • 10. Anthem was well defended 200 person 
 Information Security Staff $50 Million
 spent on security per year Source: Indianapolis Business Journal
  • 11. But they were not prepared for their adversary’s complex attack >12 Months 
 Access to sensitive user data 80 Million
 Records stolen Source: Crowdstrike, NYT
  • 12. To build new security systems 
 that can defend against complex attacks We need to build software that can detect, and stop,
 modern tools used by modern adversaries
  • 14. The modern hacker is 
 frequently a professional …who attacks 
 private businesses
 for financial gain Source: Hackmageddon
  • 15. Most modern attacks target companies to steal valuable data: Source: Hackmageddon most frequently financial data or intellectual property.
  • 16. Hackers then sell this stolen data on the black market and that data is used increasingly to commit identity theft, espionage, and possibly even acts of terrorism. Reported PII theft and fraud, 2006-2014
  • 17. Not every cyberattack is focused on profit. Defacing or destroying online property remains a key objective for many advanced adversaries
  • 18. Reported PII theft and fraud, 2006-2014There are typically three types of modern adversary State Sponsored
 Hackers Organized Crime Hacktivists
  • 19. Reported PII theft and fraud, 2006-2014 State Sponsored Adversary: 
 Energetic Bear / Dragonfly Russian hacking group either supported or directly managed by Russian state intelligence ● Unpublicized attack on petroleum pipeline operator to steal energy infrastructure information ● Unpublicized Industrial Control System (ICS) sabotage of EU-based energy management operator to cause future attacks and outages
  • 20. Reported PII theft and fraud, 2006-2014 Organized Crime Adversary: 
 Solntsevskaya Bratva Largest crime syndicate of the Russian mob heavily involved in cybercrime, with >$3B in annual revenue from hacking ● 2014 JP Morgan Chase data breach targeting wealth management and credit card user data ● 2008 cyberattacks to spread disinformation on Georgian government websites during Russia’s invasion of South Ossetia
  • 21. Reported PII theft and fraud, 2006-2014Hacktivist Adversary: 
 AntiSec Anarchist campaign of former members of hacking group Lulzsec and members of the Anonymous community. ● 2014 data breach of the US International Association of Chiefs of Police to leak personnel data in response to investigations on Occupy Wall Street protestors. ● 2011 compromise of Fox News’ Twitter account to spread fake story that President Obama had been injured in a Terrorist bombing.
  • 22. Most attacks are being perpetrated by organized crime hackers and hacktivists Source: Hackmageddon
  • 23. Attacker Sophistication Attacker Resources Hacktivists Organized Crime State Sponsored Hacking Which means most attacks are from less individually sophisticated adversaries…
  • 24. …who employ less sophisticated attacks… …reliant upon pre-made tools and malware
  • 25. To confront the majority of attacks from advanced adversaries We must detect and stop modern hacking tools
  • 26. Unfortunately, modern hacking tools and malware are good at evading detection Encryption Modern malware is frequently encrypted to defeat
 signature-based intrusion detection systems Botnets Modern hacking tools and malware hide behind 
 legions of slaved “zombie” computers
  • 27. But while botnets and encryption may hide most tools and malware The command and control (or “C2”) structure behind those tools generally remains the same Source: Cisco
  • 28. Source: AlienVault Example: Attackers who struck the US Office of Personnel Management (OPM) used the same C2 server…
  • 29. …that was used to attack as well as several US 
 companies in… Defense Aviation Oil and Gas
 Infrastructure Source: AlienVault, Symantec
  • 30. There is a lot of things the security industry can do to 
 confront modern threats…
  • 31. …but if we want to stop most attacks from advanced 
 adversaries we need to build software that SHARES DATA ON ATTACKERS Automatically shares analysis data to 
 open-source platforms to be used in
 security defenses PERFORMS DYNAMIC ANALYSIS Introspects incoming files and traffic for
 possible C2 infrastructure
  • 32. TL;DR A new generation of modern adversaries
 is driving a hacking boom This generation has access to powerful, 
 easy to use hacking tools If we do not rethink our approach and update
 our security systems, the advantage enjoyed
 by modern adversaries will continue to grow