Uploaded byAleksey Lukatskiy
Тенденции, влияющие на информационную безопасность
Документ описывает современные тенденции и проблемы в области информационной безопасности, включая изменение бизнес-моделей, динамичность угроз и фрагментацию организаций. Указывается на высокие риски утечки данных, сложности в обнаружении проникновений и растущую индустриализацию киберпреступности. Также подчеркивается необходимость изменения подхода к безопасности и разработки стратегий для защиты бизнеса.
More Related Content
Similar to Тенденции, влияющие на информационную безопасность
Тенденции, влияющие на информационную безопасность
- 1. Тенденции, влияющие на информационную безопасность АлексейЛукацкий Бизнес-консультант по безопасности, Cisco
- 2. Проблемы безопасности Изменение бизнес-моделей Динамичность угроз Сложность и фрагментация организацийне знают всех своих сетевых устройств BYOD 90% ПОГЛОЩЕНИЯ раз больше облачных сервисов используется, чем знает ИТ и ИБ ОБЛАКА 5–10 основных 500 Android- приложений имеют проблемы с безопасностью ПРИЛОЖЕНИЯ 92% поглощений в первой половине 2014 года 16,775
- 3. Изменение бизнес-моделей Динамичность угроз Сложность и фрагментация Проблемы безопасности Сообществозлоумышленников целенаправленно ведет свою деятельность скрытно 60% Данных крадутся за ЧАСЫ 54%Проникновений остаются необнаруженными МЕСЯЦАМИ ГОДЫМЕСЯЦЫЧАСЫСТАРТ 85%вторжений в PoS не обнаруживаются НЕДЕЛЯМИ НЕДЕЛИ 51%увеличилось число компаний, заявивших о потерях в $10M+ за 3 ГОДА
- 4. Изменение бизнес-моделей Сложность и фрагментация Проблемы безопасности Динамичность угроз ВендоровИБ на конференции RSA Нехватка персонала ИБ 373 12x Среднее число ИБ- вендоров на среднем предприятии 50 Сложность ЛюдиФрагментация
- 5. Любое устройство клюбому облаку ЧАСТНОЕ ОБЛАКО ОБЩЕ- ДОСТУПНОЕ ОБЛАКО ГИБРИДНОЕ ОБЛАКО
- 6.
- 7.
- 8. © 2015 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 8 $ 3.3 55% Мобильность Устройств на работника* IP-траффик мобильный к 2017** 545 44% Облака Облачных приложений на организацию* Рост ежегодной облачной нагрузки*** Рост в M2M IP-траффике 2013–18** 50B Подключенных “умных вещей” к 2020* 36X IoE
- 9. завтра20102000 2005 Изменение ландшафта угроз APTsи кибервойны Черви и вирусы Шпионское ПО и руткит Антивирус (Host-Based) IDS/IPS (Сетевой периметр) Репутация (Global) и песочница Разведка и аналитика (Облако) Ответ предприятия Угрозы
- 10. Время не нанашей стороне Источник: 2012 Verizon Data Breach Investigations Report От компрометации до утечки От атаки до компрометации От утечки до обнаружения От обнаружения до локализации и устранения Секунды Минуты Часы Дни Недели Месяцы Годы 10% 8% 0% 0% 75% 38% 0% 1% 12% 14% 2% 9% 2% 25% 13% 32% 0% 8% 29% 38% 1% 8% 54% 17% 1% 0% 2% 4% Временная шкала событий в % от общего числа взломов Взломы осуществляются за минуты Обнаружение и устранение занимает недели и месяцы
- 11. Угроза распространяется по сети изахватывает как можно больше данных ПРЕДПРИЯТИЕ ЦОД Заражение точки входа происходит за пределами предприятия Интернет и облака ПУБЛИЧНАЯ СЕТЬ Продвинутые угрозы обходят средства защиты периметра КАМПУС ПЕРИМЕТР Анатомия современной угрозы
- 12. Индустриализация киберпреступности От $450миллиардов к $1 триллионуНомер SSN $1 Мобильное вредоносное ПО $150 $Информация о банковском счете >$1000 зависит от типа счета и суммы на нем Учетная запись Facebook $1 за учетную запись с 15 друзьями Данные платежных карт $0.25-$60 Разработка вредоносного ПО $2500 (коммерческое ПО) DDoS DDoS как сервис ~$7/час Спам $50/500K emails Медицинские записи >$50 Эксплойты $1000- $300K © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12
- 13. Пора задуматься осмене стратегии © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13
- 14. Высокая мотивация киберкриминала Изменение бизнес-моделей Динамичность ландшафта угроз Думатькак хакер © 2015 Cisco and/or its affiliates. All rights reserved. 14
- 15. Точечные и статичные решения © 2015Cisco and/or its affiliates. All rights reserved. 15 Фрагментация Сложность Требуют лишнего управления
- 16. Локализовать Вылечить Устранить причины Непрерыв- ное решение © 2015Cisco and/or its affiliates. All rights reserved. 16 Узнать Применить политику Усилить защиту Идентифицировать Блокировать Отразить
- 17.
- 18. Гипотезы безопасности Cisco КонсалтингИнтеграция УправлениеЗнание угроз ПлатформыВидимость Акцент на операционную деятельность Нехватка персонала + Проблемы безопасности + Требуется изменение отношения к ИБ
- 19. Задумайтесь о том,что нужно вашему бизнесу сегодня и завтра Разработайте план уменьшения разрыва между тем, что есть, и тем, что надо Оценить текущий уровень своей защищенности и готовности поддерживать его © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19 http://www.facebook.com/CiscoRu http://twitter.com/CiscoRussia http://www.youtube.com/CiscoRussiaMedia http://www.flickr.com/photos/CiscoRussia http://vkontakte.ru/Cisco http://blogs.cisco.ru/ http://habrahabr.ru/company/cisco http://linkedin.com/groups/Cisco-Russia-3798428 http://slideshare.net/CiscoRu https://plus.google.com/106603907471961036146/posts http://www.cisco.ru/
- 20.
- 21.
Editor's Notes
- #3 Let’s put this acquisition into the context of our customers and their security challenges. Business models are changing: Instead of Corporate Owned IT, we’re in the world of BYOD and 90% of organizations aren’t aware of what devices are attaching to their network which makes security a big issue. http://lerablog.org/business/it/emerging-trends-for-byod-in-2014/ There used to be owned corporate data centers. Now, most of the business is moving to the cloud and two thirds of data is going to come through the cloud. If you consider 5-10 times more cloud services are being used that IT knows about, you can imagine what the problems could be from a Security perspective. http://blogs.cisco.com/security/beyond-data-securityfive-biggest-risks-of-shadow-cloud-it-services/ App stores deliver a new era of productivity – but 92% of Top 500 Android Apps Carry Security or Privacy Risk http://www.infosecurity-magazine.com/view/36612/92-of-top-500-android-apps-carry-security-or-privacy-risk/ Another factoid: 14% of organizations had malware enter the corporate network through social media/web apps (between November 2012-November 2013) http://solutions.webtitan.com/blog/bid/157457/New-Research-on-the-Risks-posed-by-Social-Media-in-your-Business-Network-Security http://www.ostermanresearch.com/whitepapers/orwp_or_201204a.pdf
- #4 The threat landscape is more dynamic than ever.. What we know is that 60% of the data is stolen within hours when a breach occurs. 85% of POS intrusions aren’t discovered for weeks. Customers are asking how they can get real time protection, investigative and remediation capabilities because if they don’t do it within hours a lot of their data is gone. We also know that at least half the time, the adversaries have been into the network/organization MONTHS beforehand trying to see what they want to do. Finally, if you think about companies that have had a breach, the effects of that breach will be felt for years. That information that was stolen will be out on the black market and impacting the way that company thinks about security for years. That’s really what a breach does is, taking it from hours to months to years. Sources: 1) http://www.wired.com/images_blogs/threatlevel/2012/03/Verizon-Data-Breach-Report-2012.pdf & MTD Sales Deck 2) http://www.wired.com/images_blogs/threatlevel/2012/03/Verizon-Data-Breach-Report-2012.pdf & MTD Sales Deck 3) So in the most basic of terms, as a result of breaches over the past three years, the personal information of up to 750 million individuals is or could be for sale on the criminal black market to be used for identity theft, credit card fraud, and countless other illegal activities. (This is from Rosch Testimony)
- #5 Another challenge is complexity and fragmentation. The average number of security vendors for enterprise customers is 50. The big conference for Security is the RSA conference held at the Moscone center every year. 373 vendors were registered for it in 2014. Finally, the demand for cyber security professionals is twelve times greater than it is for general IT professionals. Customers are unable to get talent they need to run operations themselves. They need somebody else who has the skill to help them.
- #6 And here’s how we got to this point of complexity: If you think about the way security has evolved, it began within the perimeter. So if you are inside the perimeter, you are trusted. If you are outside, you are untrusted. That worked for a long time, but it’s clearly not working today because many people are outside the network. They are on any device, accessing any application and in many different clouds. That information is being accessed through the Data Center, public clouds and hybrid clouds. This is what we call the Any to Any problem. It’s about any user on any device, anywhere, accessing any application. And it’s only going to get more challenging …
- #8 Also consider the growth of the Internet; Today, much of this growth is driven by the explosion of mobile devices and increasingly by connected devices like we saw in the video. (CLICK) In 1984, there were a thousand internet devices (CLICK) In 1992, there one million; In 2008, A billion; (CLICK) and we estimate that 50 billion devices will be on the Internet in 2020. >CLICK>>
- #9 For One: Organizations have been quick to evolve with IT innovations. Capturing the benefits of [CLICK] mobility, [CLICK] cloud and the IoT. These new business models have resulted in a new domain in a connect “any to any” environment. The modern extended network is sprawling your perimeter and assets across many entry points. And has created a dynamic threat landscape that cyber criminals are exploiting . With the shortage of IT security professionals compiled with a culture of “putting your head in the sand” and crossing your fingers around a cyber attack is rapidly becoming a strategy you can longer afford. We know it’s not a matter of if, but when you will be attacked. Why ?
- #10 … the threat landscape is changing. It began with basic threats like worms and viruses, or kids in high school trying to compete to see how many email accounts they could hack. Over time, threats evolved to spyware and rootkits and became harder to find and to detect. Now, advanced persistent threats and cyberware are the big problem. Entire nation states are involved, meaning it’s not just enterprises being impacted, but entire governments. They leverage the same exploit patterns at this level as occurred at the individual level (i.e. reputation for IP addresses, sandboxing). But if you look ahead, there is an increased attack surface emerging. “What’s Old is New Again.” We see the reemergence of DDoS. As clouds take over business, one of the ways to disrupt the cloud is through DDoS attacking. We are seeing the threat landscape evolve and using multiple ways of coming at the enterprise and government. Therefore, we are evolving our strategy to deal with these issues.
- #11 You are already compromised. For large and small enterprises, breaches occur within minutes of the attack, yet we don’t discover it for months.
- #12 We are ushering in a new era of capabilities around discovering and stopping threats. Let me demonstrate how through the typical anatomy of a threat. Many of us have web and email gateways to stop infections from a user host. But it’s very easy today for the user to go outside the enterprise and get infected. Once inside, they’ll move around throughout the enterprise, propagating from host to host to execute their mission. For a long time, we’ve used cloud based threat defense, but now we’re adding intelligence to detect things like known bad IPs, bad web locations, and with this, can help our customers analyze their networks. So we’re adding intelligence to defense.
- #13 Today’s cybercriminals are more sophisticated and backed by a multi-billion dollar industry that has been monetized where data and malware are being commoditized. With this their tactics have changed. They are not looking for quick wins, but long-term payouts. Adapting from attacking an individual computer or person and are now aiming to capture the full power of your infrastructure, to gain a long-term return on their investment . What have we done in response? Add individual point in time security solutions to stop individual problems. Now we’re stuck dealing with complexity and fragmentation that has created gaps in our security and reduced visibility .
- #14 So Now What? We need to evolve. Evolve our thinking. Evolve our strategy.
- #15 We need to be threat–centric, and think like an attacker. Why? You are up against a highly motivated and compensated workforce. Who are using advances in technology, changing business models and user behaviors to their advantage . The dynamic threat landscape is demanding an adapt or die strategy. We think like you do. We have taken a threat–centric approach in creating our cybersecurity solutions to tackle your biggest issues .
- #16 Lets be upfront, we are not proposing that we have a magic bullet. It doesn’t exist. And those who tell you it does are only perpetuating your problem. [CLICK] You can go back to a number of “point in time” cybersecurity solutions, such as a stand-alone firewall. We too have learned and adapted to the effects of IT Sprawl, and the industrialization of hacking. Any stand-alone solution, even a firewall on its own in not sufficient in a threat-centric strategy and does not cover the entire attack continuum. What we need to stop these criminals is a security strategy that provides protection [CLICK] Before-During and After and attack. Protection across the entire attack continuum, [CLICK] that is visibility-driven, threat–focused with a platform based approach. Pervasive, continuous and always-on cybersecuirty, across the entire attack continuum . At Cisco, our mission states our intentions…intelligent cybersecurity for the real world. Not claims that we have a fantasy solution to solve your real word cyberthreats.
- #17 Lets be upfront, we are not proposing that we have a magic bullet. It doesn’t exist. And those who tell you it does are only perpetuating your problem. [CLICK] You can go back to a number of “point in time” cybersecurity solutions, such as a stand-alone firewall. We too have learned and adapted to the effects of IT Sprawl, and the industrialization of hacking. Any stand-alone solution, even a firewall on its own in not sufficient in a threat-centric strategy and does not cover the entire attack continuum. What we need to stop these criminals is a security strategy that provides protection [CLICK] Before-During and ПОСЛЕ and attack. Protection across the entire attack continuum, [CLICK] that is visibility-driven, threat–focused with a platform based approach. Pervasive, continuous and always-on cybersecuirty, across the entire attack continuum . At Cisco, our mission states our intentions…intelligent cybersecurity for the real world. Not claims that we have a fantasy solution to solve your real word cyberthreats.
- #18 Lets be upfront, we are not proposing that we have a magic bullet. It doesn’t exist. And those who tell you it does are only perpetuating your problem. [CLICK] You can go back to a number of “point in time” cybersecurity solutions, such as a stand-alone firewall. We too have learned and adapted to the effects of IT Sprawl, and the industrialization of hacking. Any stand-alone solution, even a firewall on its own in not sufficient in a threat-centric strategy and does not cover the entire attack continuum. What we need to stop these criminals is a security strategy that provides protection [CLICK] Before-During and After and attack. Protection across the entire attack continuum, [CLICK] that is visibility-driven, threat–focused with a platform based approach. Pervasive, continuous and always-on cybersecuirty, across the entire attack continuum . At Cisco, our mission states our intentions…intelligent cybersecurity for the real world. Not claims that we have a fantasy solution to solve your real word cyberthreats.
- #19 We base Cisco’s approach to Security Services on three domains of value to improve outcomes for our customers. First, we bring a deep understanding of the security space as seen from the CISO’s point of view. Specifically, supporting changing technologies and business models, coping with a dynamic threat landscape and how make security more effective while reducing its cost and complexity. Second, we bring an operational focus which includes world class expertise, and extracting the maximum value from technology. In particular, we want to help customers get outcomes that improve their security posture and optimize the effectiveness of their multivendor security environments. We can bridge the security talent shortage, both quantitatively in sheer number of people, and their quality. Quality is particularly important when one considers the skills needed for advanced security expertise. -- Our solutions are: Visibility driven: you can see what’s really happening in your environment to gain knowledge about your environment and threats. The more you can see, the more you can correalate this informaion and apply intelligence to understand content, make better decisions and take action – either manually or automatically. Threat focused: policies and controls are important to reduce the surface area of attack but threats still get through. You need to focus on detecting, understanding and stopping threats. With advanced malware and zero day attacks, this is an ongoing process that requires continuous analysis and real-time security intelligence, delivered from the cloud that is shared across all products for improved efficacy. Platform-based: Security is now more than a network issue: it requires an integrate system of agile and open platforms that cover the network, devices and the cloud. These platforms need to be extensible, built for scale and centralized management for unified policy and consistent controls. Customers will move from deploying simply point security appliances to integrating a true platform of scalable, easy-to-deploy services and applications. -- Our portfolio Spans advisory, integraiton and managed security services