SACON session by Wayne Tufek on Enterprise Security Architecture

1. PRACTICAL SECURITY
ARCHITECTURE
WAYNE TUFEK
15TH – 16TH OF FEBRUARY 2019
SACON
BANGALORE

2. 2
Sensitivity: Confidential
DWELL TIME
Time of initial
compromise
Eradication of
vulnerability
Identification
of incident
Containment
Time to Identification
Dwell Time
Exposure Time
T0 T1 T2 T3T-1
Time
vulnerability
appears
Time to containmentTime to Compromise

3. 3
Sensitivity: Confidential
DWELL TIME
• Prevention based strategies will fail
• Time to detect and time to respond metrics are irrelevant
• The more time an attacker has in your environment the more
likely they will action on their objectives
• The longer it takes to detect an attack, the worse the
consequences
• Detect the attack
• Prevent the attack spreading
• Identify the source of the attack
• Dwell time and lateral movement are co-dependent

4. 4
Sensitivity: Confidential
DWELL TIME STATISTICS
Source: Mandiant M-Trends 2018

5. 5
Sensitivity: Confidential
PROTECT
• Email filtering
• Web filtering
• Firewalls and network segmentation
• Anti-malware
• Whitelisting
• Secure configuration and builds
• Multifactor authentication
• Third party risk management
• Vulnerability management (inc patching)
• Privileged access management
• Security awareness
• Physical security
• Secure software development practices

6. 6
Sensitivity: Confidential
DETECT
• Log consolidation
• Security analytics
• Alert fatigue
• Deception technologies
• East-West visibility

7. 7
Sensitivity: Confidential
RESPOND
• Incident response process
• Data breach notification process

8. 8
Sensitivity: Confidential
RECOVER
• Backups
• Disaster recovery plan
• Business continuity plan
• Distribute IT
• Code Spaces

9. 9
Sensitivity: Confidential
DECEPTION
• Current security systems generate a lot of alerts, many of them
false positives
• Alert over load
• Evolution of the honey pot
• Deception technologies are defined by the use of decoys
and/or tricks designed to thwart, or throw off an attacker,
disrupt an attacker's automation tools, delay an attacker's
activities or detect an attack
• Almost zero false positive solution

10. 10
Sensitivity: Confidential
EXERCISE

11. 11
Sensitivity: Confidential
QUESTIONS?
Questions

12. 12
Sensitivity: Confidential
PA S S I O N • I N T E G R I T Y • E X P E R I E N C E • R E S U LT S