Presented at InnoTech Oklahoma 2017. All rights reserved.

1. Today’s Cyber Challenges
Methodology to Secure Your Business
Joe Leonard, CISO
CISM, CISA, CRISC, CISSP, CEH
October 5, 2017
FUTURE. BUILT.

2. Agenda
q Introduction
q Today’s Cyber Challenges
q Attack Vectors
q Disruption Technology
q Business Challenges
q Security Framework
q Security Tools
q Insider Stories
q Summary

3. Introduction

4. Introduction
• Presidio Chief Information Security Officer
• Over 11 years at Presidio
• 39 Years in Security
• Organizations
– US Army (Electronic Warfare)
– EDS (Cellular Communications)
– BBN Planet/GTE Internetworking (ISP)
– Digex (Network/Web Hosting)
– Northrop Grumman (Consulting)
– Presidio (Consulting)
• Certifications
– CISM, CISA, CRISC, CISSP, CEH, CCSK

5. Todays’ Goal
• Pass along knowledge from many engagements
• Pass along some ideas that can help you
• Pass long some best practices
• Pass along some common mistakes and pitfalls
• Promise no sales pitch
• No FUD to discuss security
• Open discussion about security

6. Today’s Cyber Challenges
Methodology to Secure Your Business
• Today’s cybersecurity landscape has many challenges. There are many
attack vectors and the frequency of the attacks are increasing. How do
we protect our organizations from these attacks? Do we have the
resources, the budget or the knowledge to defend against these
attacks?
• During this session we will talk about a methodology for protecting your
organization’s critical data which includes security strategy, compliance
requirements, continuous testing, architecture challenges, incident
response and monitoring. This session will discuss today’s
cybersecurity challenges and how this methodology will help you protect
your organization.

7. Today’s Cyber Challenges

8. Attack Vectors Changing

9. Attack Vectors Changing
Attack vectors need to be evaluated
Cyber
Weapon
s
1 Tbps DDoS
France -­ OVH

10. Security in the News
Security and Exchange Commission
Exploited Vulnerability -­ Electronic
Data Gathering, Analysis, and
Retrieval (EDGAR)
Data can be used for insider trading
Exploited Apache Struts Flaw
Impact – 145 million people

11. And the Winner is
3 Billion Records Compromised

12. Security Awareness – Changing Culture

13. Disruption Technology

14. Disruption Technology

15. Business Challenges

16. Poll Question
• What are your top Cyber Security challenges?

17. Business Challenges

18. Security Framework

19. Security Framework
Comprehensive security framework
that address todays changing cyber
threat landscape.
Benefits:
• Strategy aligned with business
goals and risk
• Continuous Risk Management
lifecycle approach
• Governance (Security Framework)
• Architecture Roadmap
• Managed Services
• Incident Response Program
• Executive level KPIs
Business
Intelligence
(Customer)
Strategy
Incident Response
Governance
Managed Security Services
Architecture Consulting
Security Analysis
Baseline
Reporting
Roadmap

20. Baseline
Business
Intelligence
(Customer)
Strategy
Baseline
Roadmap
B Q2 Q3 Q4
Continuous-Testing-&-Remediation
Services:
• Yearly Baseline Risk Assessment
• Quarterly Remediation Testing
• Compliance
• HIPAA, PCI, FISMA and
FERPA
• Penetration Testing
Benefits:
• Improve Executive Visibility
• Improve Security Posture
• Develop Roadmap
• Detect and Manage Risks
• Meet Compliance Requirements
• Reduce Costs

21. Poll Question
• How frequently do you test your systems?

22. When?
• Yearly baseline
• Quarterly review and remediation testing
• Compliance -­ HIPAA, PCI, GDPR and FISMA
• Penetration Testing
• NIST 800-­53 R4, NIST 800-­171, CIS Controls 20
• Validation of new controls
Benefits
• Improve security posture
• Detect and manage risks
• Meet compliance requirements
• Reduce costs
Internal Assessment
Physical Security
Penetration Testing
Wireless Infrastructure
External Assessment
Social Engineering
Web Applications
Device Hardening
Remote Access
Governance
Executive
Summary
Report
Vulnerability
Register
Detailed
Risk Report
Baseline Testing

23. Intelligence
Gathering
External
Internal
Attacks
Command &
Control
Analysis
Cleanup
Presentation
Scope
• Intelligence Gathering
• External / Internal Attacks
• Command & Control (C&C)
• Analysis / Lessons Learned
• Improved Incident Response
• Replicate Real World Attacks
• Increase Security Awareness
Deliverables
• Executive Summary
• Detailed Red Team Analysis (ROE)
• Onsite After Action Review
Red Team

24. Security Analysis
Services:
• Malware file based analysis
• Traffic Analysis
• PCAP Analysis
• IDS/IPS
• Passive Vulnerability Assessment
• Passive Module (Tap /Span)
• Reporting
Benefits:
• Identify Indicators of Compromise
(IOC)
• Identify Targeted Attacks
• Identify traffic anomaly
• Identify attackers
Business
Intelligence
(Customer)
Strategy
Security Analysis
Baseline
Roadmap

25. Architecture Consulting
Services:
• Security Architecture
• Firewall Analysis
• Device Hardening
• Active Directory Analysis
• PKI Assessments
Benefits:
• Architecture aligned to Business
Goals
• Develop High-­Level Designs
• Layered Security Architecture
• Network Segmentation
• Roadmap Development
• Improve Security Posture
Business
Intelligence
(Customer)
Strategy
Architecture Consulting
Security Analysis
Baseline
Roadmap

26. Governance
Services:
• NIST Cyber Security Framework
• NIST 800-­53
• NIST 800-­171 (CUI)
• FISMA
• ISO 27001
• CIS Controls 20
Benefits:
• Risk Management Viewpoint
• Improve Risk Posture
• Operation Preparedness
• Regulatory Compliance
• Investment Validation
• Resource Prioritization
Business
Intelligence
(Customer)
StrategyGovernance
Architecture Consulting
Security Analysis
Baseline
Roadmap

27. Governance Frameworks

28. Managed Security Services
Services:
• 24 x 7 x 365 coverage
• Advanced Security Managed
Platform
• Detection, analysis, response,
escalation and mitigation
• Security event correlation
• Threat Intelligence
• Service Device Management
• Reporting
Benefits:
• Comprehensive platform
• Governance & Compliance
• Service Device Management
Business
Intelligence
(Customer)
StrategyGovernance
Managed Security Services
Architecture Consulting
Security Analysis
Baseline
Roadmap

29. Incident Response – Emergency and Retainer
Services:
• Subscription services
• Incident coordination,
containment and investigation
• Log, host and network forensics
• Creation of IR processes
• Remediation planning
• Threat & Incident Reporting
• Table Top Exercises
Benefits:
• Organization understands role
• Security readiness for attack
• Incident containment
• Central communication point
• Reduce brand damage
Business
Intelligence
(Customer)
Strategy
Incident Response
Governance
Managed Security Services
Architecture Consulting
Security Analysis
Baseline
Roadmap

30. Poll Question
• Does your organization have an incident
response team?

31. Reporting
Services:
• KPI
• Risk Management
• Vulnerability Management
Benefits:
• Dynamic Risk Score
• Improved Risk Visibility
• Improved Vulnerability
Tracking
• Yearly and Quarterly
Comparison Improvements
Business
Intelligence
(Customer)
Strategy
Incident Response
Governance
Managed Security Services
Architecture Consulting
Security Analysis
Baseline
Reporting
Roadmap

32. Security Tools

33. Scanning Tools
• Tenable Nessus
• Burp Suite Pro
• LUCY (Social
Engineering)
• Nmap
• Metasploit
• Mimikatz
• Responder
• BloodHound
Direct Action Kit RFID Harvester
• When victim is within a
few feet, their RFID
badge information is
grabbed.
• System can then clone
the badge for use by
security consultant.
Physical Security
• Lack of door plates on
critical ingress doors can
allow access with kit
tools
• Improperly installed locks
can lead to easy bypass
Wireless Testing
• Wi-­Fi Pineapple
• Evil Twin Attacks on
open wireless networks
• Cracking pre-­shared
keys with high-­power
Amazon GPU cluster
Commercial /
Open Source tools
• Shrum Tool
• Shove Knife Tool
• Plastic shims
• Lock pick tools
• USB Key logger
• Video Cable Display
Mirror
• Hinge-­mount door catch
Security Tools

34. Insider Stories
What could go wrong?

35. Insider Stories
• Impersonation
• Phishing
• Spear Phishing
• Media Drop
• Red Team

36. Story 1 Impersonate Support Team
36
1 2
• I’m here to help with a problem on
the computer.
• Coincidence -­ another business
system is down.
• Receptionist provides the outage
information, branch manager and
direct number.
• Information sent to attacker 2.
• A remote attacker 2 calls the
branch manager from a spoofed
number for the real support team.
• Wanted to let you know we’re
coming to look at the system.
1
• Receptionist is notified to escort
the support team to the system.
• Attacker 1 is escorted to the
business system.
• Gathered photos of alarm
systems/wiring diagrams. Had
access to financial servers and
15,000 loan applications.

37. Story 2 Impersonate Executive
37
• Complete IT Survey
• Success 75-­80% credentials
• Admins responded
• Employees are afraid to
question authority

38. Story 3 – Multi-­tier Attacks
• < 20 minutes on-­site
– 1 inserted USB
– Server room compromised
– 7 sets of credentials compromised
– 12 sets of spear phishing
– Full VPN Access
– Full email access
• Attacks
– Reconnaissance (badge)
– Phishing
– Tailgate
– USB
– Human Error

39. Story 4 Red Team
• GOAL – Gain access to pharmaceutical price
list
– 1st night – dumpster diving – price lists found
– 2nd night – building reconnaissance – door locks vulnerable
– Gained access – knitting hook picked door lock (loiding)
– Badge ID System left out in open – guessed easy password
– Created admin account and badges
– Deleted forced entry alerts from camera and door security
system
– Used newly created badges to access environment
– Installed keystroke loggers on keyboards
– Gained domain admin privileges
– Gained full admin access to pharmaceutical server

40. Summary
q Introduction
q Today’s Cyber Challenges
q Attack Vectors
q Disruption Technology
q Business Challenges
q Security Framework
q Security Tools
q Insider Stories
q Summary

41. Thank you
Joe Leonard
jleonard@presidio.com