John Dickson is an internationally recognized security leader, entrepreneur and Principal at Denim Group, Ltd. He has nearly 20 years hands-on experience in intrusion detection, network security and application security in the commercial, public and military sectors. As a Denim Group Principal, he helps executives and Chief Security Officers (CSO’s) of Fortune 500 companies and government organizations launch and expand their critical application security initiatives. His leadership has been instrumental in Denim Group being honored by Inc. Magazine as one of the fastest growing companies in the industry for five years in a row.

1. BREACH FIXATION
HOW BREACHES DISTORT REALITY AND HOW WE SHOULD RESPOND

2. MY BACKGROUND
• 20+ Year Security Professional
• Denim Group Principal
• MBA Strategy Guy
• ISSA Distinguished Fellow
• Security Conference Speaker
• Dark Reading Columnist
• Twitter: @johnbdickson

3. DENIM GROUP | COMPANY
BACKGROUND
• Trusted advisor on all matters of software risk
• External application & network assessments
• Web, mobile, and cloud
• Software development lifecycle development (SDLC) consulting
• Network and infrastructure where applications reside
• Secure development services:
• Secure application development & remediation
• Managed security services
• Developed ThreadFix

4. ANYBODY REMEMBER THIS GUY?
4

5. HIS NEW HOME
5

6. WHY IS THIS IMPORTANT?
6
The day security became
important to business executives

7. BREACH FIXATION OVERVIEW
7
• What is Breach Fixation?
• How Does Breach Fixation Manifest Itself?
• How you can Use Breach Fixation to Your Advantage

8. BREACH FIXATION OVERVIEW
8

9. BREACH FIXATION
9
• A phenomena created by media fixation on breach
stories
• Breach Fixation distorts reality by putting most of the
focus on external activities that we don’t control…
• At the expense of internal security activities that we do
• Affects strategy and resource allocation in a potentially
negative way
• Takes focus away from addressing the root cause while
treating the symptom

10. WHAT DRIVES MEDIA
CONSUMPTION?
10

11. BREACH FIXATION
11
• Does anyone know the top security stories consumed
by readers of the major security publications?

12. A RUBBERNECKING CULTURE?
12

13. WHAT’S HOT IN SECURITY
13
• Breaches
• APT & Zero Days
• External Threats
• Cyberwar
• Russians, Chinese, Iranians, oh my!
• Finding Vulnerabilities

14. WHAT’S NOT…
14
• Internal Security Practices
• Coding Standards
• Patch Management
• User Awareness
• Actually Fixing Vulnerabilities

15. WHAT DOES THAT CREATE?
15
• A Situation Where Basic Security Blocking & Tackling
Remains Problematic
• Window of Exposure of Application Vulnerabilities Remains Egregious
• Well-known Security Weaknesses Continue to be an Avenue of Approach for
Attackers
• Outside the largest and most sophisticated organizations, security only covers a
subset of the enterprise

16. WHAT DOES THAT CREATE?
16
• A Situation Where External Threats Might Distract
Security Focus
• Whipsawed by #ToD (Threat of the Day) or #YABS (Yet Another Breach Story)
• “Incumbent Spend” around FW, Endpoint, AV, dwarf other areas
• Focus on latest outwardly-focuses security “shiny rock” technologies as panaceas

17. THE RISK?
17
• Returning to a FUD Culture…

18. EXAMPLES OF IMPACT
18
• Press DDoS on speaker by the entire media
• Gartner: By 2020, 60% of enterprise information
security budgets will be allocated for rapid detection and
response approaches, up from less than 20% in 2015.
• EY: A Shift to “Active Defense” and its implications
• A cautionary tale: State of Texas Public Utilities
Commission war story

19. HOW CAN YOU ADDRESS BREACH
FIXATION
19
• Recognize Breach Fixation When a Layperson (e.g.,
“Executive”) References it.
• The First Step to Recovery is Admitting you have a Problem!

20. HOW CAN YOU ADDRESS BREACH
FIXATION
20
• Constantly Quantify Internal Security Posture
• Measure, measure, measure

21. HOW TO USE BREACH FIXATION TO
YOUR ADVANTAGE
21
• Use the Positive Force from the Attack Side & Map to
Your Strategy

22. OTHER STRATEGIES USE BREACH
FIXATION…
22

23. WRAP UP
23
• Breach Fixation distorts reality by putting most of the
focus on external security activities that we don’t control
at the expense of internal security that we do.
• Sophisticated security practitioners understand how
Breach Fixation can help or hurt them, if not managed
• Once recognized, there are several basic strategies that
one can use to take advantage of Breach Fixation

24. QUESTIONS AND ANSWERS
John B. Dickson, CISSP
@johnbdickson