1.
BREACH FIXATION
HOW BREACHES DISTORT REALITY AND HOW WE SHOULD RESPOND

2.
MY BACKGROUND
• 20+ Year Security Professional
• Denim Group Principal
• MBA Strategy Guy
• ISSA Distinguished Fellow
• Security Conference Speaker
• Dark Reading Columnist
• Twitter: @johnbdickson

3.
DENIM GROUP | COMPANY
BACKGROUND
• Trusted advisor on all matters of software risk
• External application & network assessments
• Web, mobile, and cloud
• Software development lifecycle development (SDLC) consulting
• Network and infrastructure where applications reside
• Secure development services:
• Secure application development & remediation
• Managed security services
• Developed ThreadFix

4.
ANYBODY REMEMBER THIS GUY?
4

5.
HIS NEW HOME
5

6.
WHY IS THIS IMPORTANT?
6
The day security became
important to business executives

7.
BREACH FIXATION OVERVIEW
7
• What is Breach Fixation?
• How Does Breach Fixation Manifest Itself?
• How you can Use Breach Fixation to Your Advantage

8.
BREACH FIXATION OVERVIEW
8

9.
BREACH FIXATION
9
• A phenomena created by media fixation on breach
stories
• Breach Fixation distorts reality by putting most of the
focus on external activities that we don’t control…
• At the expense of internal security activities that we do
• Affects strategy and resource allocation in a potentially
negative way
• Takes focus away from addressing the root cause while
treating the symptom

10.
WHAT DRIVES MEDIA
CONSUMPTION?
10

11.
BREACH FIXATION
11
• Does anyone know the top security stories consumed
by readers of the major security publications?

12.
A RUBBERNECKING CULTURE?
12

13.
WHAT’S HOT IN SECURITY
13
• Breaches
• APT & Zero Days
• External Threats
• Cyberwar
• Russians, Chinese, Iranians, oh my!
• Finding Vulnerabilities

14.
WHAT’S NOT…
14
• Internal Security Practices
• Coding Standards
• Patch Management
• User Awareness
• Actually Fixing Vulnerabilities

15.
WHAT DOES THAT CREATE?
15
• A Situation Where Basic Security Blocking & Tackling
Remains Problematic
• Window of Exposure of Application Vulnerabilities Remains Egregious
• Well-known Security Weaknesses Continue to be an Avenue of Approach for
Attackers
• Outside the largest and most sophisticated organizations, security only covers a
subset of the enterprise

16.
WHAT DOES THAT CREATE?
16
• A Situation Where External Threats Might Distract
Security Focus
• Whipsawed by #ToD (Threat of the Day) or #YABS (Yet Another Breach Story)
• “Incumbent Spend” around FW, Endpoint, AV, dwarf other areas
• Focus on latest outwardly-focuses security “shiny rock” technologies as panaceas

17.
THE RISK?
17
• Returning to a FUD Culture…

18.
EXAMPLES OF IMPACT
18
• Press DDoS on speaker by the entire media
• Gartner: By 2020, 60% of enterprise information
security budgets will be allocated for rapid detection and
response approaches, up from less than 20% in 2015.
• EY: A Shift to “Active Defense” and its implications
• A cautionary tale: State of Texas Public Utilities
Commission war story

19.
HOW CAN YOU ADDRESS BREACH
FIXATION
19
• Recognize Breach Fixation When a Layperson (e.g.,
“Executive”) References it.
• The First Step to Recovery is Admitting you have a Problem!

20.
HOW CAN YOU ADDRESS BREACH
FIXATION
20
• Constantly Quantify Internal Security Posture
• Measure, measure, measure

21.
HOW TO USE BREACH FIXATION TO
YOUR ADVANTAGE
21
• Use the Positive Force from the Attack Side & Map to
Your Strategy

22.
OTHER STRATEGIES USE BREACH
FIXATION…
22

23.
WRAP UP
23
• Breach Fixation distorts reality by putting most of the
focus on external security activities that we don’t control
at the expense of internal security that we do.
• Sophisticated security practitioners understand how
Breach Fixation can help or hurt them, if not managed
• Once recognized, there are several basic strategies that
one can use to take advantage of Breach Fixation

24.
QUESTIONS AND ANSWERS
John B. Dickson, CISSP
@johnbdickson