SlideShare a Scribd company logo

Threat Hunting, Detection, and Incident Response in the Cloud

•
•
Ben Johnson
Ben Johnson

SaaS and IaaS are new frontiers for a lot of security teams. We'll explore some thoughts at how you might approach some of these areas of your environment from a hunting or IR perspective. This was from a Sans webinar on 2019-09-25.

Technology
1 of 61
Download to read offline
SEP 25, 2019 | BEN JOHNSON, CTO & CO-FOUNDER SANS WEBCAST THREAT HUNTING IN THE CLOUD: TIME FOR A POWER-UP?
ABSTRACT Threat hunting is an important weapon in the arsenal of proactive enterprise security. With the shift to the cloud, however, the threat landscape is rapidly evolving. Faced with automated attacks, multiple perimeters to defend, and a growing mobile workforce, threat hunters need to reassess the mission. What is the surface area they need to protect? When does threat hunting stop and incident response start? And whats the difference between threat hunting and detection? In this session, we will discuss these topics and provide guidance for becoming more effective at detection and response in SaaS and IaaS environments.
Ç BACKGROUND CHECK // BEN JOHNSON Co-Founder and CTO, Obsidian Security Co-founder and former CTO of Carbon Black, built the first EDR product; Previously, NSA CNO and AI Lab 2000 20172010 Employment Board Seats 1st Technical Advisor (Amicus Curiae) to US FISA Court
TODAY’S GOALS • Spark contemplation • Encourage more cloud-focused talks (2019 papers on maturing threat programs only speak about endpoint and network!?)
AGENDA • Cloud challenges • Threatscape • Threat Hunting & Incident Response • Overview • Cloud • Tips & Take-aways • Q & A
DISCLAIMERS • For “Cloud,” I mean “other people’s computers,” which includes both SaaS and IaaS. • We are not here to discuss the benefits of cloud. • You need more than an hour to learn this.
CLOUD SECURITY CHALLENGES
DEFENDER CHALLENGES Skills Gap + Deploy-and-Decay + = LACK OF CYBER SELF-ESTEEM Huge Data (more than big) Attacker Successes +
THEN VS. NOW: EXPANDING UNIVERSE EMAIL WORD PROCESSOR COMMUNICATION CONTENT MANAGEMENT INFORMATION TECHNOLOGY SALES & MARKETING FINANCE HUMAN RESOURCES SECURITY Companies are picking a “cloud stack” of business services…the difference being these new technologies are designed for connection.
CLOUDS TALK TO CLOUDS
WHO PROTECTS CLOUD? (HINT: YOU)
SAAS? STILL YOUR PROBLEM The SaaS Provider handles all aspects except for identity and access management, client devices controls, and data accountability. The Customer, therefore, must understand users, devices & data related to that service.
THREATSCAPE
2019 HEADLINES
BREACHES ARE ACCELERATING 2015 2016 2017 2014 2015 2016 2017 2014 2013 2012 2011 2010 2009 2008
LEAGUE OF ADVERSARIES Cybercriminals • Broad-based and targeted • Financially motivated • Getting more sophisticated Hactivists • Targeted and destructive • Unpredictable motivations • Generally less sophisticated Nation-States • Targeted and 
 multi-stage • Motivated by data collection  • Highly sophisticated with endless resources Insiders • Targeted and destructive • Unpredictable motivations • Sophistication varies
INFORMATION SECURITY AND THE CLOUD “IT is going from 0 to 100 in the cloud and leaving us in the dust” - Fmr. CISO, Financial Tech Company “We’re blind to all these new SaaS accounts” - Director, Cyber Intelligence, 
 Top Athletics Brand “We have 300 AWS accounts and no governance” - Public Tech Company “Hackers don’t break in, they login.” - Several CISOs “50% of our IR Engagements are Office 365.” - Principal IR, Rapid7
THREAT HUNTING & INCIDENT RESPONSE
IS THE ENVIRONMENT HEALTHY? The absence of disease does not mean health.
THREAT DETECTION • Detection is HARD. It is never-ending. • This leads us to supplement technology…
The inevitability of 
 Threat Hunting: 
 there’s always a gap between automated threat detection and the universe of threats. Universe of threats Automated threat detection processes HUNTING: FILLING THE AUTOMATION GAP
HUNTING: IDEAL V.S. REALITY Ideal Reality
CAN HUNTING BE FORMULAIC? What’s the formula for threat hunting? X FTE * Y tooling + Z buy-in = Threat Hunting?
HUNTING: START WITH VISIBILITY Scanning Continuous Recording Continuous Recording + Intelligence Continuous Recording + Intelligence + Prevalence Continuous Recording + Intelligence + Prevalence + Relationships
Ç HOW DO WE THREAT HUNT? Search: X xxxx xxxx xxxx xxxx xxxx xxxx NOT... NOT Y NOT Z ∴ X yyyy yyyy yyyy zzzz zzzz zzzz zzzz x yzy yz x x zz z y y
Ç HOW DO WE THREAT HUNT? Raw 
 & 
 Unfiltered
EFFICIENT HUNTING (& TRIAGE): FAIL FAST Move quickly with feedback loops and validated learning. Disprove hypotheses as fast as possible! Start hunting Successful discovery Fail intelligently
SO WHY HUNT? 1.To produce detection rules that can be automated 2.To find evil that is not yet detected through automated means 3.To understand risks and other problems that are often only uncovered through human inspection
CLOUD HUNTING & IR
GETTING STARTED • Do you do this on-premises? • Do you have access to apps/environments? • What are you hunting for? • “Cloud hunting” is not mainstream
INTERNAL BUY-IN • Find time! (and if necessary, approval) • Get access to data • UI Access? • API/data access? • Show results (to allow for further investment)
G SUITE • Starting with the UI • Need Reports access • admin.google.com • Go to Audit section
G SUITE // ADMIN • Keep a close eye on Admin activity
G SUITE // LOGINS & USERS
G SUITE // ACCOUNT ACCESS (TOKENS, RECOVERY) • OAuth Access • Changing recovery information?
OFFICE 365 // AUDITLOG • Starting with the UI • https:// protection.office.com/ unifiedauditlog • A bit better than G Suite
OFFICE 365 // MAILBOX CHANGES
OFFICE 365 // FILTERING & EXPORT • Better filtering and exporting than G Suite • Aside from logins, look for mail forwarding rules, delegations, permissions changes
SALESFORCE // LEAVES A LOT TO BE DESIRED • If you want event log data, you have to pay extra $$ • API is not very “fun” to interact with
SALESFORCE // CLIENT BROWSERS
SALESFORCE // LOGINS, SETUP, & NETWORK ACCESS
AWS // ADVANCED MODE? • AWS is a BEAST • https://us- west-1.console.aws.a mazon.com/cloudtrail/ • AWS CLI tool allows for easier access to data
AWS // CLOUDTRAIL & IAM • Cloudtrail logs give you ability to hunt in large volumes of data • CreateBucket, RunInstances, ModifySnapshotAttribute
AWS // ACCESS CREEP? DORMANT ACCOUNTS MISMATCHED PERMISSIONS 238 days 181 days 87 days 79 days 22 days 17 days 9 days 8 days 20758 lines
OK, SO …
OFFICE 365 • Enable the Audit Log • Get access (either to UI or data) • Get familiar with data • Pull logs into ELK or similar • Know why you are doing this…
AWS • Enable Cloudtrail (first trail free) • Get access (either to UI or data) • Get familiar with data • Pull logs into ELK or similar • Know why you are doing this… (Do you see a trend here?)
TIPS & TAKE-AWAYS
REDUCE ENTROPY, REDUCE RISK (AND REDUCE NOISE)
HUNTING/ DETECTION Hunting TRIAGE INVESTIGATION CLEANUP Discovery Incident Response THE DETECTION-RESPONSE SPECTRUM
HUNTING RUNBOOK •Get data & logs! •Filter out the common stuff •Enrichment -> raw logs are often not the most useful •IP locations, account resolutions, timestamp conversions •Be ready to dive into what events “mean” (read API docs) •Be ready to convert into IR if something is found •Produce a deliverable — a new rule, a more automated process, a weakness, etc.
HUNTING TIPS •Pick a service or problem area you can dive into •Carve out time! Cannot hunt on the run •Partner with the application owner and get read access •Have data already flowing (increase logging/auditing) •Take a red-team mindset — find the weaknesses to start •Eradicate and recover, creating new detection rules and sharing the knowledge with the application owner
MORE TIPS •Address the lack of visibility and disconnect between security and cloud teams / application owners •Don’t spread yourself thin, get good at something •Write code, write code, write code •Educate the IT/engineering staff and bear them fruit •Never manually hunt the same thing twice: automate your work •Hunting can quickly turn into IR, so be prepared for that •Get the data into a better platform (enrichment, filtering)
HUNTING IDEAS •Look for weaknesses because threats may be near •Audit who has Administrator / privileged-access •If you are focusing on external actors hunt for mailbox rules, delegations, lots of outbound messages, new user additions, permission grants, public S3 buckets, password resets for other services after an unusual login •If focusing on internal actors, hunt for records and file access, privileged account usage, sharing files too broadly, OAuth apps
HUNTING IDEAS (CONT’D) 1. Are there password logins when they all should be SAML/SSO? 2. Are new admins (privileged users) being created? 3. Are user credentials being reset by application owner and security is unaware? 4. Are users expanding your surface area through API keys, OAuth tokens, etc? 5. Are service accounts being added? 6. Are mail, calendar delegation rules being implemented? 7. And of course suspicious logins … (but what is “suspicious”?)
THANK YOU Q & A Poll: Please let us know if you would attend a follow-on deeper-dive into any of the topics or specific apps/services.
LINKS 1.https://support.microsoft.com/en-us/help/4026501/office-auditing-in-office-365-for-admins 2.https://github.com/OfficeDev/O365-InvestigationTooling 3.https://github.com/kiamatthews/office365-management-api-elk 4.https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf 5.https://logz.io/blog/aws-cloudtrail-elk-stack/
Ç GLENN CHISHOLM BEN JOHNSON MATT WOLFF ben@obsidiansecurity.com @chicagoben @obsidiansec slideshare.net/chicagoben Thank You.

Recommended

An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)Ahmad Haghighi
 
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyWhat We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyPriyanka Aash
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat IntelligenceNTT Innovation Institute Inc.
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report Morane Decriem
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Soc
SocSoc
SocMukesh Chaudhari
 

Recommended

An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)Ahmad Haghighi
 
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyWhat We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyPriyanka Aash
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat IntelligenceNTT Innovation Institute Inc.
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report Morane Decriem
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Soc
SocSoc
SocMukesh Chaudhari
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)PECB
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat IntelligenceSirius
 
Detection and Response Roles
Detection and Response RolesDetection and Response Roles
Detection and Response RolesFlorian Roth
 
Introduction to QRadar
Introduction to QRadarIntroduction to QRadar
Introduction to QRadarPencilData
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon
 
Information Security
Information SecurityInformation Security
Information Securitychenpingling
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Intrusion detection system
Intrusion detection systemIntrusion detection system
Intrusion detection systemAparna Bhadran
 
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Raffael Marty
 
SIEM Architecture
SIEM ArchitectureSIEM Architecture
SIEM ArchitectureNishanth Kumar Pathi
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity frameworkShriya Rai
 
Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Splunk
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSSylvain Martinez
 
You Can't Stop The Breach Without Prevention And Detection
You Can't Stop The Breach Without Prevention And DetectionYou Can't Stop The Breach Without Prevention And Detection
You Can't Stop The Breach Without Prevention And DetectionCrowdStrike
 
Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Asia Pte Ltd
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3Shawn Croswell
 
Microsoft Teams in the Modern Workplace
Microsoft Teams in the Modern WorkplaceMicrosoft Teams in the Modern Workplace
Microsoft Teams in the Modern WorkplaceJoanne Klein
 
System Security on Cloud
System Security on CloudSystem Security on Cloud
System Security on CloudTu Pham
 

More Related Content

What's hot

Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)PECB
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat IntelligenceSirius
 
Detection and Response Roles
Detection and Response RolesDetection and Response Roles
Detection and Response RolesFlorian Roth
 
Introduction to QRadar
Introduction to QRadarIntroduction to QRadar
Introduction to QRadarPencilData
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon
 
Information Security
Information SecurityInformation Security
Information Securitychenpingling
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Intrusion detection system
Intrusion detection systemIntrusion detection system
Intrusion detection systemAparna Bhadran
 
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Raffael Marty
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity frameworkShriya Rai
 
Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Splunk
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSSylvain Martinez
 
You Can't Stop The Breach Without Prevention And Detection
You Can't Stop The Breach Without Prevention And DetectionYou Can't Stop The Breach Without Prevention And Detection
You Can't Stop The Breach Without Prevention And DetectionCrowdStrike
 
Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Asia Pte Ltd
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3Shawn Croswell
 

What's hot (20)

Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
 
Detection and Response Roles
Detection and Response RolesDetection and Response Roles
Detection and Response Roles
 
Introduction to QRadar
Introduction to QRadarIntroduction to QRadar
Introduction to QRadar
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
 
Information Security
Information SecurityInformation Security
Information Security
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Intrusion detection system
Intrusion detection systemIntrusion detection system
Intrusion detection system
 
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...
 
SIEM Architecture
SIEM ArchitectureSIEM Architecture
SIEM Architecture
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity framework
 
Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTS
 
You Can't Stop The Breach Without Prevention And Detection
You Can't Stop The Breach Without Prevention And DetectionYou Can't Stop The Breach Without Prevention And Detection
You Can't Stop The Breach Without Prevention And Detection
 
Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service Netpluz Managed SOC - MSS Service
Netpluz Managed SOC - MSS Service
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3
 

Similar to Threat Hunting, Detection, and Incident Response in the Cloud

Microsoft Teams in the Modern Workplace
Microsoft Teams in the Modern WorkplaceMicrosoft Teams in the Modern Workplace
Microsoft Teams in the Modern WorkplaceJoanne Klein
 
System Security on Cloud
System Security on CloudSystem Security on Cloud
System Security on CloudTu Pham
 
(SEC402) Enterprise Cloud Security via DevSecOps 2.0
(SEC402) Enterprise Cloud Security via DevSecOps 2.0(SEC402) Enterprise Cloud Security via DevSecOps 2.0
(SEC402) Enterprise Cloud Security via DevSecOps 2.0Amazon Web Services
 
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin FalckLuncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin FalckNorth Texas Chapter of the ISSA
 
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...Michael Noel
 
Protecting your Teams Work across Microsoft 365
Protecting your Teams Work across Microsoft 365Protecting your Teams Work across Microsoft 365
Protecting your Teams Work across Microsoft 365Joanne Klein
 
Are You Leveraging the Cloud? Or is it Leveraging You?
Are You Leveraging the Cloud? Or is it Leveraging You?Are You Leveraging the Cloud? Or is it Leveraging You?
Are You Leveraging the Cloud? Or is it Leveraging You?Tom Mumford
 
Keynote at the Cyber Security Summit Prague 2015
Keynote at the Cyber Security Summit Prague 2015Keynote at the Cyber Security Summit Prague 2015
Keynote at the Cyber Security Summit Prague 2015Claus Cramon Houmann
 
Introduction to the Current Threat Landscape
Introduction to the Current Threat LandscapeIntroduction to the Current Threat Landscape
Introduction to the Current Threat LandscapeMelbourne IT
 
Best practices for automating cloud security processes with Evident.io and AWS
Best practices for automating cloud security processes with Evident.io and AWSBest practices for automating cloud security processes with Evident.io and AWS
Best practices for automating cloud security processes with Evident.io and AWSAmazon Web Services
 
Intro to INFOSEC
Intro to INFOSECIntro to INFOSEC
Intro to INFOSECSean Whalen
 
A Vision for Shared, Central Intelligence to Ebb a Growing Flood of Alerts
A Vision for Shared, Central Intelligence to Ebb a Growing Flood of AlertsA Vision for Shared, Central Intelligence to Ebb a Growing Flood of Alerts
A Vision for Shared, Central Intelligence to Ebb a Growing Flood of AlertsPriyanka Aash
 
SOC Meets Cloud: What Breaks, What Changes, What to Do?
SOC Meets Cloud: What Breaks, What Changes, What to Do?SOC Meets Cloud: What Breaks, What Changes, What to Do?
SOC Meets Cloud: What Breaks, What Changes, What to Do?Anton Chuvakin
 
Who owns Software Security
Who owns Software SecurityWho owns Software Security
Who owns Software SecuritydevObjective
 
Top 5 security errors and how to avoid them - DEM06-S - Mexico City AWS Summit
Top 5 security errors and how to avoid them - DEM06-S - Mexico City AWS SummitTop 5 security errors and how to avoid them - DEM06-S - Mexico City AWS Summit
Top 5 security errors and how to avoid them - DEM06-S - Mexico City AWS SummitAmazon Web Services
 
Security and Compliance with SharePoint and Office 365
Security and Compliance with SharePoint and Office 365Security and Compliance with SharePoint and Office 365
Security and Compliance with SharePoint and Office 365Richard Harbridge
 
Realities of Security in the Cloud
Realities of Security in the CloudRealities of Security in the Cloud
Realities of Security in the CloudAlert Logic
 
Cyber security event
Cyber security eventCyber security event
Cyber security eventTryzens
 

Similar to Threat Hunting, Detection, and Incident Response in the Cloud (20)

Microsoft Teams in the Modern Workplace
Microsoft Teams in the Modern WorkplaceMicrosoft Teams in the Modern Workplace
Microsoft Teams in the Modern Workplace
 
System Security on Cloud
System Security on CloudSystem Security on Cloud
System Security on Cloud
 
(SEC402) Enterprise Cloud Security via DevSecOps 2.0
(SEC402) Enterprise Cloud Security via DevSecOps 2.0(SEC402) Enterprise Cloud Security via DevSecOps 2.0
(SEC402) Enterprise Cloud Security via DevSecOps 2.0
 
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin FalckLuncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
 
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
 
Protecting your Teams Work across Microsoft 365
Protecting your Teams Work across Microsoft 365Protecting your Teams Work across Microsoft 365
Protecting your Teams Work across Microsoft 365
 
Are You Leveraging the Cloud? Or is it Leveraging You?
Are You Leveraging the Cloud? Or is it Leveraging You?Are You Leveraging the Cloud? Or is it Leveraging You?
Are You Leveraging the Cloud? Or is it Leveraging You?
 
Keynote at the Cyber Security Summit Prague 2015
Keynote at the Cyber Security Summit Prague 2015Keynote at the Cyber Security Summit Prague 2015
Keynote at the Cyber Security Summit Prague 2015
 
Introduction to the Current Threat Landscape
Introduction to the Current Threat LandscapeIntroduction to the Current Threat Landscape
Introduction to the Current Threat Landscape
 
Best practices for automating cloud security processes with Evident.io and AWS
Best practices for automating cloud security processes with Evident.io and AWSBest practices for automating cloud security processes with Evident.io and AWS
Best practices for automating cloud security processes with Evident.io and AWS
 
Intro to INFOSEC
Intro to INFOSECIntro to INFOSEC
Intro to INFOSEC
 
A Vision for Shared, Central Intelligence to Ebb a Growing Flood of Alerts
A Vision for Shared, Central Intelligence to Ebb a Growing Flood of AlertsA Vision for Shared, Central Intelligence to Ebb a Growing Flood of Alerts
A Vision for Shared, Central Intelligence to Ebb a Growing Flood of Alerts
 
SOC Meets Cloud: What Breaks, What Changes, What to Do?
SOC Meets Cloud: What Breaks, What Changes, What to Do?SOC Meets Cloud: What Breaks, What Changes, What to Do?
SOC Meets Cloud: What Breaks, What Changes, What to Do?
 
Who owns Software Security
Who owns Software SecurityWho owns Software Security
Who owns Software Security
 
Who Owns Software Security?
Who Owns Software Security?Who Owns Software Security?
Who Owns Software Security?
 
Top 5 security errors and how to avoid them - DEM06-S - Mexico City AWS Summit
Top 5 security errors and how to avoid them - DEM06-S - Mexico City AWS SummitTop 5 security errors and how to avoid them - DEM06-S - Mexico City AWS Summit
Top 5 security errors and how to avoid them - DEM06-S - Mexico City AWS Summit
 
Cloudsourcing2013
Cloudsourcing2013Cloudsourcing2013
Cloudsourcing2013
 
Security and Compliance with SharePoint and Office 365
Security and Compliance with SharePoint and Office 365Security and Compliance with SharePoint and Office 365
Security and Compliance with SharePoint and Office 365
 
Realities of Security in the Cloud
Realities of Security in the CloudRealities of Security in the Cloud
Realities of Security in the Cloud
 
Cyber security event
Cyber security eventCyber security event
Cyber security event
 

More from Ben Johnson

Prepare the battlefield: Shape your environment for better cyber defense
Prepare the battlefield: Shape your environment for better cyber defensePrepare the battlefield: Shape your environment for better cyber defense
Prepare the battlefield: Shape your environment for better cyber defenseBen Johnson
 
Detection + 1 in the Cloud Age
Detection + 1 in the Cloud AgeDetection + 1 in the Cloud Age
Detection + 1 in the Cloud AgeBen Johnson
 
State of Cyber: Views from an Industry Insider
State of Cyber: Views from an Industry InsiderState of Cyber: Views from an Industry Insider
State of Cyber: Views from an Industry InsiderBen Johnson
 
Seeing through the Fog: Navigating the Security Landscape of a Cloud-First World
Seeing through the Fog: Navigating the Security Landscape of a Cloud-First WorldSeeing through the Fog: Navigating the Security Landscape of a Cloud-First World
Seeing through the Fog: Navigating the Security Landscape of a Cloud-First WorldBen Johnson
 
Practical Cyber: Lessons from 500,000 Miles of Security Evangelism
Practical Cyber: Lessons from 500,000 Miles of Security EvangelismPractical Cyber: Lessons from 500,000 Miles of Security Evangelism
Practical Cyber: Lessons from 500,000 Miles of Security EvangelismBen Johnson
 

More from Ben Johnson (7)

Prepare the battlefield: Shape your environment for better cyber defense
Prepare the battlefield: Shape your environment for better cyber defensePrepare the battlefield: Shape your environment for better cyber defense
Prepare the battlefield: Shape your environment for better cyber defense
 
Lean Security
Lean SecurityLean Security
Lean Security
 
Detection + 1 in the Cloud Age
Detection + 1 in the Cloud AgeDetection + 1 in the Cloud Age
Detection + 1 in the Cloud Age
 
State of Cyber: Views from an Industry Insider
State of Cyber: Views from an Industry InsiderState of Cyber: Views from an Industry Insider
State of Cyber: Views from an Industry Insider
 
Lean Hunting
Lean HuntingLean Hunting
Lean Hunting
 
Seeing through the Fog: Navigating the Security Landscape of a Cloud-First World
Seeing through the Fog: Navigating the Security Landscape of a Cloud-First WorldSeeing through the Fog: Navigating the Security Landscape of a Cloud-First World
Seeing through the Fog: Navigating the Security Landscape of a Cloud-First World
 
Practical Cyber: Lessons from 500,000 Miles of Security Evangelism
Practical Cyber: Lessons from 500,000 Miles of Security EvangelismPractical Cyber: Lessons from 500,000 Miles of Security Evangelism
Practical Cyber: Lessons from 500,000 Miles of Security Evangelism
 

Recently uploaded

[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilV3cube
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...apidays
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024The Digital Insurer
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CVKhem
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 

Recently uploaded (20)

[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 

Threat Hunting, Detection, and Incident Response in the Cloud

  • 1. SEP 25, 2019 | BEN JOHNSON, CTO & CO-FOUNDER SANS WEBCAST THREAT HUNTING IN THE CLOUD: TIME FOR A POWER-UP?
  • 2.
  • 3. ABSTRACT Threat hunting is an important weapon in the arsenal of proactive enterprise security. With the shift to the cloud, however, the threat landscape is rapidly evolving. Faced with automated attacks, multiple perimeters to defend, and a growing mobile workforce, threat hunters need to reassess the mission. What is the surface area they need to protect? When does threat hunting stop and incident response start? And whats the difference between threat hunting and detection? In this session, we will discuss these topics and provide guidance for becoming more effective at detection and response in SaaS and IaaS environments.
  • 4. Ç BACKGROUND CHECK // BEN JOHNSON Co-Founder and CTO, Obsidian Security Co-founder and former CTO of Carbon Black, built the first EDR product; Previously, NSA CNO and AI Lab 2000 20172010 Employment Board Seats 1st Technical Advisor (Amicus Curiae) to US FISA Court
  • 5. TODAY’S GOALS • Spark contemplation • Encourage more cloud-focused talks (2019 papers on maturing threat programs only speak about endpoint and network!?)
  • 6. AGENDA • Cloud challenges • Threatscape • Threat Hunting & Incident Response • Overview • Cloud • Tips & Take-aways • Q & A
  • 7. DISCLAIMERS • For “Cloud,” I mean “other people’s computers,” which includes both SaaS and IaaS. • We are not here to discuss the benefits of cloud. • You need more than an hour to learn this.
  • 9. DEFENDER CHALLENGES Skills Gap + Deploy-and-Decay + = LACK OF CYBER SELF-ESTEEM Huge Data (more than big) Attacker Successes +
  • 10. THEN VS. NOW: EXPANDING UNIVERSE EMAIL WORD PROCESSOR COMMUNICATION CONTENT MANAGEMENT INFORMATION TECHNOLOGY SALES & MARKETING FINANCE HUMAN RESOURCES SECURITY Companies are picking a “cloud stack” of business services…the difference being these new technologies are designed for connection.
  • 11. CLOUDS TALK TO CLOUDS
  • 12. WHO PROTECTS CLOUD? (HINT: YOU)
  • 13. SAAS? STILL YOUR PROBLEM The SaaS Provider handles all aspects except for identity and access management, client devices controls, and data accountability. The Customer, therefore, must understand users, devices & data related to that service.
  • 17. LEAGUE OF ADVERSARIES Cybercriminals • Broad-based and targeted • Financially motivated • Getting more sophisticated Hactivists • Targeted and destructive • Unpredictable motivations • Generally less sophisticated Nation-States • Targeted and 
 multi-stage • Motivated by data collection  • Highly sophisticated with endless resources Insiders • Targeted and destructive • Unpredictable motivations • Sophistication varies
  • 18. INFORMATION SECURITY AND THE CLOUD “IT is going from 0 to 100 in the cloud and leaving us in the dust” - Fmr. CISO, Financial Tech Company “We’re blind to all these new SaaS accounts” - Director, Cyber Intelligence, 
 Top Athletics Brand “We have 300 AWS accounts and no governance” - Public Tech Company “Hackers don’t break in, they login.” - Several CISOs “50% of our IR Engagements are Office 365.” - Principal IR, Rapid7
  • 19. THREAT HUNTING & INCIDENT RESPONSE
  • 20. IS THE ENVIRONMENT HEALTHY? The absence of disease does not mean health.
  • 21. THREAT DETECTION • Detection is HARD. It is never-ending. • This leads us to supplement technology…
  • 22. The inevitability of 
 Threat Hunting: 
 there’s always a gap between automated threat detection and the universe of threats. Universe of threats Automated threat detection processes HUNTING: FILLING THE AUTOMATION GAP
  • 23. HUNTING: IDEAL V.S. REALITY Ideal Reality
  • 24. CAN HUNTING BE FORMULAIC? What’s the formula for threat hunting? X FTE * Y tooling + Z buy-in = Threat Hunting?
  • 25. HUNTING: START WITH VISIBILITY Scanning Continuous Recording Continuous Recording + Intelligence Continuous Recording + Intelligence + Prevalence Continuous Recording + Intelligence + Prevalence + Relationships
  • 26. Ç HOW DO WE THREAT HUNT? Search: X xxxx xxxx xxxx xxxx xxxx xxxx NOT... NOT Y NOT Z ∴ X yyyy yyyy yyyy zzzz zzzz zzzz zzzz x yzy yz x x zz z y y
  • 27. Ç HOW DO WE THREAT HUNT? Raw 
 & 
 Unfiltered
  • 28. EFFICIENT HUNTING (& TRIAGE): FAIL FAST Move quickly with feedback loops and validated learning. Disprove hypotheses as fast as possible! Start hunting Successful discovery Fail intelligently
  • 29. SO WHY HUNT? 1.To produce detection rules that can be automated 2.To find evil that is not yet detected through automated means 3.To understand risks and other problems that are often only uncovered through human inspection
  • 31. GETTING STARTED • Do you do this on-premises? • Do you have access to apps/environments? • What are you hunting for? • “Cloud hunting” is not mainstream
  • 32. INTERNAL BUY-IN • Find time! (and if necessary, approval) • Get access to data • UI Access? • API/data access? • Show results (to allow for further investment)
  • 33. G SUITE • Starting with the UI • Need Reports access • admin.google.com • Go to Audit section
  • 34. G SUITE // ADMIN • Keep a close eye on Admin activity
  • 35. G SUITE // LOGINS & USERS
  • 36. G SUITE // ACCOUNT ACCESS (TOKENS, RECOVERY) • OAuth Access • Changing recovery information?
  • 37. OFFICE 365 // AUDITLOG • Starting with the UI • https:// protection.office.com/ unifiedauditlog • A bit better than G Suite
  • 38. OFFICE 365 // MAILBOX CHANGES
  • 39. OFFICE 365 // FILTERING & EXPORT • Better filtering and exporting than G Suite • Aside from logins, look for mail forwarding rules, delegations, permissions changes
  • 40. SALESFORCE // LEAVES A LOT TO BE DESIRED • If you want event log data, you have to pay extra $$ • API is not very “fun” to interact with
  • 42. SALESFORCE // LOGINS, SETUP, & NETWORK ACCESS
  • 43. AWS // ADVANCED MODE? • AWS is a BEAST • https://us- west-1.console.aws.a mazon.com/cloudtrail/ • AWS CLI tool allows for easier access to data
  • 44. AWS // CLOUDTRAIL & IAM • Cloudtrail logs give you ability to hunt in large volumes of data • CreateBucket, RunInstances, ModifySnapshotAttribute
  • 45. AWS // ACCESS CREEP? DORMANT ACCOUNTS MISMATCHED PERMISSIONS 238 days 181 days 87 days 79 days 22 days 17 days 9 days 8 days 20758 lines
  • 47. OFFICE 365 • Enable the Audit Log • Get access (either to UI or data) • Get familiar with data • Pull logs into ELK or similar • Know why you are doing this…
  • 48. AWS • Enable Cloudtrail (first trail free) • Get access (either to UI or data) • Get familiar with data • Pull logs into ELK or similar • Know why you are doing this… (Do you see a trend here?)
  • 49.
  • 50.
  • 52. REDUCE ENTROPY, REDUCE RISK (AND REDUCE NOISE)
  • 54. HUNTING RUNBOOK •Get data & logs! •Filter out the common stuff •Enrichment -> raw logs are often not the most useful •IP locations, account resolutions, timestamp conversions •Be ready to dive into what events “mean” (read API docs) •Be ready to convert into IR if something is found •Produce a deliverable — a new rule, a more automated process, a weakness, etc.
  • 55. HUNTING TIPS •Pick a service or problem area you can dive into •Carve out time! Cannot hunt on the run •Partner with the application owner and get read access •Have data already flowing (increase logging/auditing) •Take a red-team mindset — find the weaknesses to start •Eradicate and recover, creating new detection rules and sharing the knowledge with the application owner
  • 56. MORE TIPS •Address the lack of visibility and disconnect between security and cloud teams / application owners •Don’t spread yourself thin, get good at something •Write code, write code, write code •Educate the IT/engineering staff and bear them fruit •Never manually hunt the same thing twice: automate your work •Hunting can quickly turn into IR, so be prepared for that •Get the data into a better platform (enrichment, filtering)
  • 57. HUNTING IDEAS •Look for weaknesses because threats may be near •Audit who has Administrator / privileged-access •If you are focusing on external actors hunt for mailbox rules, delegations, lots of outbound messages, new user additions, permission grants, public S3 buckets, password resets for other services after an unusual login •If focusing on internal actors, hunt for records and file access, privileged account usage, sharing files too broadly, OAuth apps
  • 58. HUNTING IDEAS (CONT’D) 1. Are there password logins when they all should be SAML/SSO? 2. Are new admins (privileged users) being created? 3. Are user credentials being reset by application owner and security is unaware? 4. Are users expanding your surface area through API keys, OAuth tokens, etc? 5. Are service accounts being added? 6. Are mail, calendar delegation rules being implemented? 7. And of course suspicious logins … (but what is “suspicious”?)
  • 59. THANK YOU Q & A Poll: Please let us know if you would attend a follow-on deeper-dive into any of the topics or specific apps/services.
  • 61. Ç GLENN CHISHOLM BEN JOHNSON MATT WOLFF ben@obsidiansecurity.com @chicagoben @obsidiansec slideshare.net/chicagoben Thank You.