Uploaded bySaumil Shah
Hack.LU - The Infosec Crossroads
The document discusses the evolution of information security threats and defenses, highlighting a shift from individual efforts to team-oriented approaches in combating attacks. It emphasizes the need for proactive security measures, including the importance of metrics, user understanding, and intelligence-driven strategies. The speaker advocates for a comprehensive security framework that adapts to evolving attack strategies rather than relying on reactive measures.
More Related Content
Similar to Hack.LU - The Infosec Crossroads
![5G Explained! A High Level Overview [Introduction]](https://cdn.slidesharecdn.com/ss_thumbnails/5gexplainedahighleveloverview-260119165306-cc137a3e-thumbnail.jpg?width=640&height=640&fit=bounds)
Hack.LU - The Infosec Crossroads
- 1.
- 2. HACK.LU 2016NETSQUARE About Me @therealsaumil saumilshah hacker,trainer, speaker, author, photographer educating, entertaining and exasperating audiences since 1999 Saumil Shah CEO, Net-Square
- 3. HACK.LU 2016NETSQUARE Today's attacks succeed becausethe defense is REACTIVE
- 4. HACK.LU 2016NETSQUARE The Evolutionof Attacks
- 5. HACK.LU 2016NETSQUARE Servers Applications DesktopsBrowsers Pockets How Have Targets Shifted?
- 6. HACK.LU 2016NETSQUARE Attacks FollowThe Money Defacement DDoS Phishing ID Theft Financial Transactions Targeted APT
- 7.
- 8. HACK.LU 2016NETSQUARE Firewalls IDS/IPS Antivirus WAF Endpoint Security DEP,ASLR Sandbox One-way Hacking Fragmented Packets Obfuscation Character Encoding DNS Exfiltration ROP, Infoleak Jailbreak Hackers Have A Positive Outlook
- 9. HACK.LU 2016NETSQUARE Latest Example: Stegosploit IMAJS STEGO- DECODER JAVASCRIPT TARGETBROWSER POLYGLOT PIXEL ENCODER EXPLOIT CODE IMAGE ENCODED IMAGE
- 10. HACK.LU 2016NETSQUARE wherein buildingsreveal near- infinite interiors, capable of being traversed through all manner of non-architectural means http://www.bldgblog.com/2010/01/nakatomi-space/ Nakatomi Space
- 11. HACK.LU 2016NETSQUARE It wasdifferent 12 years ago! Individual effort. 1 week dev time. 3-6 months shelf life. Hundreds of public domain exploits. "We did it for the lols."
- 12. HACK.LU 2016NETSQUARE Today... Team effort. 2-12month dev time. 24h to 10d shelf life. Public domain exploits nearly zero. Cost,value of exploits has significantly risen. WEAPONIZATION.
- 13. HACK.LU 2016NETSQUARE The defenders triedto buy back their bugs...
- 14. HACK.LU 2016NETSQUARE Bug Bounties:high stakes game Chris Evans – Pwnium: Element 1337
- 15. HACK.LU 2016NETSQUARE Bug Bounties triedto fill a reactive need.
- 16.
- 17.
- 18.
- 19. HACK.LU 2016NETSQUARE Advanced TechnologyIs...Advanced
- 20. HACK.LU 2016NETSQUARE Technology inthe hands of users @needadebitcard
- 21. HACK.LU 2016NETSQUARE The user'sgoing to pick dancing pigs over security every time. Bruce Schneier
- 22.
- 23.
- 24.
- 25. HACK.LU 2016NETSQUARE Attackers don't follow standardsand certifications.
- 26. HACK.LU 2016NETSQUARE Today's InfosecDefence? Rules Signatures Updates Machine Learning
- 27.
- 28. HACK.LU 2016NETSQUARE Existing strategies do notmatch attacker tactics.
- 29. HACK.LU 2016NETSQUARE Intelligence DrivenSecurity net-square From REACTIVE to PROACTIVE
- 30. HACK.LU 2016NETSQUARE "The Universe tellsyou everything you need to know about it, as long as you are prepared to watch, to listen, to smell, in short to OBSERVE." Sources of Security Intelligence?
- 31.
- 32.
- 33. HACK.LU 2016NETSQUARE Collect EVERYTHING! Seven Axiomsof Security: 1
- 34. HACK.LU 2016NETSQUARE Collect Everything! • Security Data Warehouse: first step towards proactive security. • Retention is CHEAPER than Deletion. • Importance of HISTORICAL DATA increases exponentially with time.
- 35. HACK.LU 2016NETSQUARE Can't MEASURE? Can'tUse. Seven Axioms of Security: 2
- 36. HACK.LU 2016NETSQUARE Why KeepMetrics? • To show you are succeeding – Corollary: to show you are failing • To justify your existence and/or budget • To argue for change • For fun! Marcus Ranum Security Metrics: The Quest For Meaning IT Defense 2016, Mainz
- 37. HACK.LU 2016NETSQUARE How toEstablish Metrics • Look at your process and make a list of what is quantifiable • Ask yourself what quantities you are interested in – Once things are quantified they go up, or down – which is about the only convenient thing of metrics: they don't go sideways, too • Which is a "good" direction: up or down? • Do you know what constitutes a significant movement? • Measure and iterate Marcus Ranum Security Metrics: The Quest For Meaning IT Defense 2016, Mainz
- 38. HACK.LU 2016NETSQUARE Why MetricsWin • Often information security becomes what I call a "battle of two narratives" – Your opponent has the advantage of lying: – "moving this to the cloud will save us $500,000/year!" – To defend your narrative you need facts (from metrics) and credible extrapolations (based on metrics) or your opponent controls the narrative! * * Plan B is to respond with lies of your own Marcus Ranum Security Metrics: The Quest For Meaning IT Defense 2016, Mainz
- 39. HACK.LU 2016NETSQUARE Test likean attacker: RED TEAM. Seven Axioms of Security: 3
- 40. HACK.LU 2016NETSQUARE UNREALISTIC PEN-TESTING SCENARIOS • Wait for new production release • Don't test on production • Don't perform intrusive testing • X is out of scope • Test during off-peak hours
- 41. HACK.LU 2016NETSQUARE Who areyou more scared of? Attackers or Auditors?
- 42. HACK.LU 2016NETSQUARE User RATINGS! SevenAxioms of Security: 4
- 43.
- 44. HACK.LU 2016NETSQUARE numberofusers infosec maturity HopelessUninformed Proactive Rock Stars Identify your target users... Always going to be an enigma. If properly guided, these users are willing to improve their usage habits. The next Rock Star users. Leave them alone, and possibly learn from them.
- 45. HACK.LU 2016NETSQUARE ...and improvetheir maturitynumberofusers infosec maturity Hopeless Uninformed Proactive Rock Stars
- 46. HACK.LU 2016NETSQUARE Set BOOBY TRAPS. SevenAxioms of Security: 5
- 47.
- 48. HACK.LU 2016NETSQUARE ANALYSIS decide Actions. SevenAxioms of Security: 6
- 49.
- 50. HACK.LU 2016NETSQUARE Take InformedDecisions Analysis NEW INITIATIVE Estimate Impact Collect Metrics Determine Actual Impact
- 51. HACK.LU 2016NETSQUARE Security Data Warehouse ANALYSIS ANDINTELLIGENCE GATHERING Collectors SENSORS Actions Applications Internal Users External Users Perimeter Activity
- 52. HACK.LU 2016NETSQUARE BUY-IN FROMTHE TOP And the 7th...
- 53. HACK.LU 2016NETSQUARE The greatesttime-suck for CISOs "Not my circus, Not my monkeys"
- 54. HACK.LU 2016NETSQUARE Is yourinfosec team doing something creative every day?
- 55.