With network data breaches being reported weekly, it appears our implementation of prevention solutions is failing. With the average time to detect a breach being greater than 6 months our detection solutions also appear to be failing. Maybe these solutions and technologies are working correctly and we are just not training our teams how to manage, maintain, and leverage those solutions effectively. In this presentation I will be discussing security testing and validation methodologies that includes Internal/external pentesting, social engineering, and red team/blue team exercises. In addition I will be covering how using these methodologies we can better prepare and build a more robust security environment that will keep your organization off the front page.

1. FAIL NOW
SO I DON’T FAIL LATER

2. Who am I
DERAL HEILAND CISSP
RESEARCH LEAD RAPID7 GLOBAL SERVICES
25+ YEARS OF EXPERIENCE IN THE INFORMATION TECHNOLOGY, 15 OF THAT IN
SECURITY AND LAST 8 YEAR AS A PENETRATION TESTER AND CONSULTING FOR
CORPORATIONS AND GOVERNMENT AGENCIES
DERAL_HEILAND@RAPID7.COM
@PERCENT_X

4. Agenda
4
Not here to tell you what to do, but here to give
you some food for thought.
Share some good stories and have an open
discussion.
Please engage with me during this discussion

5. Data Breaches
2015 BREACHES
– Ashley Madison, undetected unknown
– Office of Personnel Management - undetected – 11.5 Months
– Anthem undetected – 9 months
– Premera – undetected - 8.75 Months
– IRS – undetected unknown

6. Data Breaches
6
• WHAT CAN WE OBSERVE FROM THESE BREACHES?
1. Data breaches are taking a long time to detect
2. Malicious actors are after PII data

7. Data Breaches
• WHY IS IT TAKING SO LONG TO DETECT BREACHES?
• HOW DO WE CHANGE THE TREND?

8. 8
LAYERED SECURITY

9. Prevention

10. Prevention
A GOOD SOLUTION REQUIRES ?
– Understanding your environment
– Understanding where your risk lie
– Implementing some best practices
Never ever going to be 100% successful

11. Prevention
Detection

12. Detection
A GOOD SOLUTION REQUIRES ?
– Effort
– Understanding
– Match your business model

13. Prevention
Detection
Response

14. Response
A GOOD SOLUTION REQUIRES ?
– A plan
– Employees involvement
– Incident response team

15. SOMETHING IS JUST NOT WORKING

16. 16
TRAINING FOR SUCCESS

17. Prevention
Detection
Response
Testing/Training

18. Training and education
18
• TRAIN YOUR STAFF
• Hacker conferences
• Formal security training
• ALLOW YOUR STAFF TO USE THEIR TRAINING
• FORCE YOUR STAFF TO USE THEIR TRAINING
• CROSS TRAIN

19. Self Assessment
Wireless testing Social Engineering
Vulnerability
scanning
Penetration Testing Code Review
Configuration
Review

20. Hacker Brain Storming
20
• INTERNAL EXERCISES
• ALLOW YOUR EMPLOYEES TO THINK EVIL (ENCOURAGE IT)
• COME UP WITH IDEAS AND TEST THEM OUT
• SHARE INFORMATION

21. 21
PARTNERSHIP FOR SUCCESS

22. Partnership
22
• CONSULTING SERVICES
• Build a plan
• Use it as a training opportunity
• Red/Blue team exercises
• INDIVIDUAL CONSULTANT
• Build a relationship
• Brain storm on how an assessment should transpire
• Ask question ( learn from this resource)

23. Questions
DERAL HEILAND CISSP
RESEARCH LEAD – RAPID7 GLOBAL SERVICES
DERAL_HEILAND@RAPID7.COM
@PERCENT_X