SlideShare a Scribd company logo

BSides San Diego 2017 - Sophisticuffs: The rumble over adversary sophistication

•
•
Paül Jaramillo
Paül Jaramillo

It has been a reoccurring theme for corporate victims of a major breach to publicly state that the attack perpetrated on them was sophisticated. Some may even go so far as to have their 3rd party DFIR partner(s) make statements on their behalf to the effect that the attack would have been successful at most companies. All this is done in an attempt to avoid the dreaded assumption of IT Security negligence on their part. Imagine if the press release stated that the attack might have been thwarted if they implemented processes and controls that were recommended by internal staff years ago. While we will never read that statement, many practitioners are left to wonder what was so unique and advanced about this attack. With this presentation we will present analysis of existing public attacks against traits that are more common in truly advanced attacks. These include but are not limited to the ability to operate undetected, precise targeting, use of non-public zero days and custom payloads, ability to defeat in place security controls, strong operational security, speed and of course overall effectiveness. We will also make clear delineations between what constitutes and advanced attack versus an advanced adversary. The output of this will be a model that can be applied to help characterize your adversaries capabilities.

Technology
1 of 25
Download to read offline
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICUFFS: THE RUMBLE OVER ADVERSARY SOPHISTICATION PAUL JARAMILLO
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. PAUL JARAMILLO Twitter @DFIR_Janitor Biography Currently: Principal Consultant @CrowdStrike Previously: § Fortune 500 Energy § Fortune 100 Manufacturing § Fortune 10 Conglomerate § Dept. of Energy § Fortune 100 Telecommunications Focused on Incident Response & Digital Forensics
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. State of Affairs Sophistication vs Effectiveness Sophisticated Actor vs Attack Measurements of Sophistication Adversaries of Infamy Recommendations
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. STATE OF AFFAIRS § Breachapalooza continues § Struggles to implement common critical controls § Continued resource misallocation on buzzwords & knee jerks § Massive inequality between InfoSec have’s and have nots § Dwell time improving § Board awareness & engagement vastly increasing § Defending failures with “Sophisticated”
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. STATE OF AFFAIRS § You had me at “Sophisticated” Attack :-/ § Password dump, guessing, reuse § Phishing § Fake login portal § Common tools, exploits (mimikatz, wiper, etc) § Ancient vulnerabilities (JBoss, Cold Fusion, MS08-067, Wordpress, etc) § Ransomware Image Credit: reddit.com
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATION VS EFFECTIVENESS § Why does sophistication matter so much to the arm chair incident responder? § We know it matters to security vendors J § Should it matter to the impacted org? § Tight correlation with chances for successful defense § “Commercially reasonable effort” scapegoat § Supports better resource allocation Image Credit: imgur.com
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATION VS EFFECTIVENESS
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATED ACTOR VS ATTACK Rule #1 - Sophisticated Actor != Sophisticated Attack Sophisticated Actor = [Basic Attack … Sophisticated Attack] Image credit: xkcd.com
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATED ACTOR VS ATTACK Rule #2 - Sophisticated Actor != Zero Days Sophisticated Actor = [Code Reuse, Custom Malware, Custom Tools, Zero Days, Etc] On APT - “We personally do not believe in the advanced part of the acronym, unless the threats involve specific zero-day exploits” ORLY?
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. MEASUREMENTS OF THREAT ACTOR SOPHISTICATION § Attack Precision § Cross-platform Capabilities § Targeting § OPSEC § Resilience § Stealth
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - ATTACK PRECISION Ability of Threat Actor to closely align their planned attacks with an organization's given vulnerabilities, including overall efficiency § WEAK(1) – Spray & pray, exploit kits, Apache exploits against IIS, etc § BASIC(4) – Brute force, observable mistakes such as CLI typos, accidental AV & IDS detection § STRONG(7) – Skillful targeting of people, authentication & directory services § FIERCE(10) – Demonstrated mastery of unique business process, timing, and/or closed technologies
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - CROSS PLATFORM CAPABILITIES Ability of Threat Actor to operate in a full spectrum of diverse technologies § WEAK(1) – PHP websites, cracked MS Windows § BASIC(4) – MS Windows client & servers, web servers § STRONG(7) – OSX, Linux, Unix, Android, IoT(?) § FIERCE(10) – Embedded computing, firmware, telecommunications & network gear, and other closed systems
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - TARGETING Ability of Threat Actor to successfully compromise well-defended “hard” targets, as compared to ”soft” targets § WEAK(1) – Grandma, individual credit cards & banking, software licenses § BASIC(4) – Corporate brands, political causes, corporate wire fraud § STRONG(7) – Data theft, destruction or modification with grave damage to organization or national security implication § FIERCE(10) – Critical systems or processes (kinetic damage, financial catastrophe)
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - OPSEC Ability of Threat Actor to avoid providing their adversaries with any useful information about them § WEAK(1) – Bragging that you did it, claiming responsibility § BASIC(4) – Observable tool marks, traceable personas § STRONG(7) – Breadcrumbs, diversified tools & infrastructure § FIERCE(10) – Frame someone else, clandestine, covert
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - RESILIENCE Ability of a Threat Actor to maintain access in an organization’s environment § WEAK(1) – AV solves your problem § BASIC(4) – Indicator blocks, reimages, and password changes solves your problem § STRONG(7) – Complex remediation, requiring 3rd party assistance § FIERCE(10) – Source code compromise, Supply chain compromise, Human implant
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - STEALTH Ability of Threat Actor to avoid detection § WEAK(1) – Mass scanning, large phishing campaigns § BASIC(4) – “Smash & grab” aka immediate action on objectives § STRONG(7) – Less than 1 year average dwell time § FIERCE(10) – Greater than 1 year average dwell time with continued activity
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Anonymous - 18 (2006 to Present, 2010 Operation Payback, 2011 HBGary) § Attack Precision (4) § Cross Platform Capability (4) § Targeting (4) § OPSEC (4) § Resilience (1) § Stealth (1) Image Credit: ArsTechnica
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Carbanak/Carbon Spider - 35 (2013 to Present, Swift attacks, Hotel chains, Retail, etc) § Attack Precision (10) § Cross Platform Capability (7) § Targeting (4^) § OPSEC (4) § Resilience (4) § Stealth (4) Image Credit: Buzzfeed
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Silent Chollima/DarkSeoul - 36 (2009 to Present, South Korea, Sony, etc) § Attack Precision (7) § Cross Platform Capability (4) § Targeting (7) § OPSEC (4) § Resilience (7) § Stealth (7) Image Credit: KnowYourMeme
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Axiom/Aurora Panda/APT17 - 51 (2009 to Present, Google, Adobe, Bit9, etc) § Attack Precision (10) § Cross Platform Capability (7) § Targeting (10) § OPSEC (7) § Resilience (7) § Stealth (10) Image Credit: people-you-knew.tumblr.com
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Equation Group - 60 (1996 to Present, Stuxnet, Flame, Grayfish) § Attack Precision (10) § Cross Platform Capability (10) § Targeting (10) § OPSEC (10) § Resilience (10) § Stealth (10) Image Credit: Kaspersky
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. RECOMMENDATIONS § Before calling out an organization § Could you detect it? Prevent it? Image Credit: quickmeme.com
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. RECOMMENDATIONS Become a better defender and threat intelligence consumer 1. Collect & analyze all indicators, TTPs, and associated context around your own incidents using Kill Chain model 2. Complete your own organizational threat profile 3. Collect & analyze available data around threat actors targeting your organization using the ACTOR model 4. Proactively provide messaging around high visibility threats & risks 5. Align organizational priority around your biggest threats (e.g. new controls, threat hunting, M&A, people, etc)
2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. QUESTIONS? Image Credit: memecrunch.com

Recommended

Bsides Chicago2017
Bsides Chicago2017Bsides Chicago2017
Bsides Chicago2017
Paül Jaramillo
 
Hunting_GrrCON22.pdf
Hunting_GrrCON22.pdfHunting_GrrCON22.pdf
Hunting_GrrCON22.pdf
Paül Jaramillo
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
Hostway|HOSTING
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE - ATT&CKcon
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
Infosec
 

Recommended

Bsides Chicago2017
Bsides Chicago2017Bsides Chicago2017
Bsides Chicago2017
Paül Jaramillo
 
Hunting_GrrCON22.pdf
Hunting_GrrCON22.pdfHunting_GrrCON22.pdf
Hunting_GrrCON22.pdf
Paül Jaramillo
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
Hostway|HOSTING
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE - ATT&CKcon
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
Infosec
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
Katie Nickels
 
Six Degrees of Domain Admin - BloodHound at DEF CON 24
Six Degrees of Domain Admin - BloodHound at DEF CON 24Six Degrees of Domain Admin - BloodHound at DEF CON 24
Six Degrees of Domain Admin - BloodHound at DEF CON 24
Andy Robbins
 
Architecture centric support for security orchestration and automation
Architecture centric support for security orchestration and automationArchitecture centric support for security orchestration and automation
Architecture centric support for security orchestration and automation
Chadni Islam
 
Deception technology for advanced detection
Deception technology for advanced detectionDeception technology for advanced detection
Deception technology for advanced detection
Jisc
 
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop ThemUnderstanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
CrowdStrike
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Caputre the flag
Caputre the flagCaputre the flag
Caputre the flag
UIT
 
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
Iván Portillo
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat Landscape
Dragos, Inc.
 
Everything about TAXII
Everything about TAXIIEverything about TAXII
Everything about TAXII
stixproject
 
IBM AppScan Source - The SAST solution
IBM AppScan Source - The SAST solutionIBM AppScan Source - The SAST solution
IBM AppScan Source - The SAST solution
hearme limited company
 
Fidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception SolutionFidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception Solution
Fidelis Cybersecurity
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
Tom K
 
The Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
The Message Within - Using McAfee DLP to Detect Hidden Steganographic ContentThe Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
The Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
bfanelli
 
Threat Hunting for Command and Control Activity
Threat Hunting for Command and Control ActivityThreat Hunting for Command and Control Activity
Threat Hunting for Command and Control Activity
Sqrrl
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Introduction to STIX 101
Introduction to STIX 101Introduction to STIX 101
Introduction to STIX 101
stixproject
 
CNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksCNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer Attacks
Sam Bowne
 
10 Critical Corporate Cyber Security Risks
10 Critical Corporate Cyber Security Risks10 Critical Corporate Cyber Security Risks
10 Critical Corporate Cyber Security Risks
Heimdal Security
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
Adrian Sanabria
 
A Sober Look at Machine Learning
A Sober Look at Machine LearningA Sober Look at Machine Learning
A Sober Look at Machine Learning
Sven Krasser
 
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike
 

More Related Content

What's hot

Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
Katie Nickels
 
Six Degrees of Domain Admin - BloodHound at DEF CON 24
Six Degrees of Domain Admin - BloodHound at DEF CON 24Six Degrees of Domain Admin - BloodHound at DEF CON 24
Six Degrees of Domain Admin - BloodHound at DEF CON 24
Andy Robbins
 
Architecture centric support for security orchestration and automation
Architecture centric support for security orchestration and automationArchitecture centric support for security orchestration and automation
Architecture centric support for security orchestration and automation
Chadni Islam
 
Deception technology for advanced detection
Deception technology for advanced detectionDeception technology for advanced detection
Deception technology for advanced detection
Jisc
 
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop ThemUnderstanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
CrowdStrike
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Caputre the flag
Caputre the flagCaputre the flag
Caputre the flag
UIT
 
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
Iván Portillo
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat Landscape
Dragos, Inc.
 
Everything about TAXII
Everything about TAXIIEverything about TAXII
Everything about TAXII
stixproject
 
IBM AppScan Source - The SAST solution
IBM AppScan Source - The SAST solutionIBM AppScan Source - The SAST solution
IBM AppScan Source - The SAST solution
hearme limited company
 
Fidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception SolutionFidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception Solution
Fidelis Cybersecurity
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
Tom K
 
The Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
The Message Within - Using McAfee DLP to Detect Hidden Steganographic ContentThe Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
The Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
bfanelli
 
Threat Hunting for Command and Control Activity
Threat Hunting for Command and Control ActivityThreat Hunting for Command and Control Activity
Threat Hunting for Command and Control Activity
Sqrrl
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Introduction to STIX 101
Introduction to STIX 101Introduction to STIX 101
Introduction to STIX 101
stixproject
 
CNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksCNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer Attacks
Sam Bowne
 
10 Critical Corporate Cyber Security Risks
10 Critical Corporate Cyber Security Risks10 Critical Corporate Cyber Security Risks
10 Critical Corporate Cyber Security Risks
Heimdal Security
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
Adrian Sanabria
 

What's hot (20)

Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
Six Degrees of Domain Admin - BloodHound at DEF CON 24
Six Degrees of Domain Admin - BloodHound at DEF CON 24Six Degrees of Domain Admin - BloodHound at DEF CON 24
Six Degrees of Domain Admin - BloodHound at DEF CON 24
 
Architecture centric support for security orchestration and automation
Architecture centric support for security orchestration and automationArchitecture centric support for security orchestration and automation
Architecture centric support for security orchestration and automation
 
Deception technology for advanced detection
Deception technology for advanced detectionDeception technology for advanced detection
Deception technology for advanced detection
 
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop ThemUnderstanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
 
Caputre the flag
Caputre the flagCaputre the flag
Caputre the flag
 
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
STIC XV CCN-CERT - Cibervigilancia con warrior (Ivan Portillo y Wiktor Nykiel)
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat Landscape
 
Everything about TAXII
Everything about TAXIIEverything about TAXII
Everything about TAXII
 
IBM AppScan Source - The SAST solution
IBM AppScan Source - The SAST solutionIBM AppScan Source - The SAST solution
IBM AppScan Source - The SAST solution
 
Fidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception SolutionFidelis - Live Demonstration of Deception Solution
Fidelis - Live Demonstration of Deception Solution
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
 
The Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
The Message Within - Using McAfee DLP to Detect Hidden Steganographic ContentThe Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
The Message Within - Using McAfee DLP to Detect Hidden Steganographic Content
 
Threat Hunting for Command and Control Activity
Threat Hunting for Command and Control ActivityThreat Hunting for Command and Control Activity
Threat Hunting for Command and Control Activity
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
Introduction to STIX 101
Introduction to STIX 101Introduction to STIX 101
Introduction to STIX 101
 
CNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksCNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer Attacks
 
10 Critical Corporate Cyber Security Risks
10 Critical Corporate Cyber Security Risks10 Critical Corporate Cyber Security Risks
10 Critical Corporate Cyber Security Risks
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 

Similar to BSides San Diego 2017 - Sophisticuffs: The rumble over adversary sophistication

A Sober Look at Machine Learning
A Sober Look at Machine LearningA Sober Look at Machine Learning
A Sober Look at Machine Learning
Sven Krasser
 
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike
 
Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...
Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...
Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...
MLconf
 
Evolving Cybersecurity Threats
Evolving Cybersecurity Threats Evolving Cybersecurity Threats
Evolving Cybersecurity Threats
Nevada County Tech Connection
 
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated IndustriesCASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries
NowSecure
 
How to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrikeHow to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrike
Adam Barrera
 
Reading the Security Tea Leaves
Reading the Security Tea LeavesReading the Security Tea Leaves
Reading the Security Tea Leaves
Ed Bellis
 
Identity Relationship Management - The Right Approach for a Complex Digital W...
Identity Relationship Management - The Right Approach for a Complex Digital W...Identity Relationship Management - The Right Approach for a Complex Digital W...
Identity Relationship Management - The Right Approach for a Complex Digital W...
ForgeRock
 
An Inside Look At The WannaCry Ransomware Outbreak
An Inside Look At The WannaCry Ransomware OutbreakAn Inside Look At The WannaCry Ransomware Outbreak
An Inside Look At The WannaCry Ransomware Outbreak
CrowdStrike
 
Via forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linuxVia forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linux
viaForensics
 
pbc_devsecops_eastereggs.2022oct06.jt.pptx
pbc_devsecops_eastereggs.2022oct06.jt.pptxpbc_devsecops_eastereggs.2022oct06.jt.pptx
pbc_devsecops_eastereggs.2022oct06.jt.pptx
Julie Tsai
 
CONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin NystromCONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin Nystrom
PROIDEA
 
Securing your web apps before they hurt the organization
Securing your web apps before they hurt the organizationSecuring your web apps before they hurt the organization
Securing your web apps before they hurt the organization
Antonio Fontes
 
Preventing In-Browser Malicious Code Execution
Preventing In-Browser Malicious Code ExecutionPreventing In-Browser Malicious Code Execution
Preventing In-Browser Malicious Code Execution
Stefano Di Paola
 
Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...
Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...
Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...
Sven Krasser
 
Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...
Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...
Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...
DATAVERSITY
 
Preventing Hybrid Cloud Environments from Being Breached
Preventing Hybrid Cloud Environments from Being BreachedPreventing Hybrid Cloud Environments from Being Breached
Preventing Hybrid Cloud Environments from Being Breached
FlawCheck
 
⛳️ Votre API passe-t-elle le contrôle technique ?
⛳️ Votre API passe-t-elle le contrôle technique ?⛳️ Votre API passe-t-elle le contrôle technique ?
⛳️ Votre API passe-t-elle le contrôle technique ?
François-Guillaume Ribreau
 
Farewell to the Security Sandwich
Farewell to the Security SandwichFarewell to the Security Sandwich
Farewell to the Security Sandwich
Thoughtworks
 
How to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrikeHow to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrike
CrowdStrike
 

Similar to BSides San Diego 2017 - Sophisticuffs: The rumble over adversary sophistication (20)

A Sober Look at Machine Learning
A Sober Look at Machine LearningA Sober Look at Machine Learning
A Sober Look at Machine Learning
 
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
CrowdStrike CrowdCast: Is Ransomware Morphing Beyond The Ability Of Standard ...
 
Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...
Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...
Sergey A. Razin Ph.D., Chief Technology Officer, SIOS Technology at MLconf SE...
 
Evolving Cybersecurity Threats
Evolving Cybersecurity Threats Evolving Cybersecurity Threats
Evolving Cybersecurity Threats
 
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated IndustriesCASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries
 
How to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrikeHow to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrike
 
Reading the Security Tea Leaves
Reading the Security Tea LeavesReading the Security Tea Leaves
Reading the Security Tea Leaves
 
Identity Relationship Management - The Right Approach for a Complex Digital W...
Identity Relationship Management - The Right Approach for a Complex Digital W...Identity Relationship Management - The Right Approach for a Complex Digital W...
Identity Relationship Management - The Right Approach for a Complex Digital W...
 
An Inside Look At The WannaCry Ransomware Outbreak
An Inside Look At The WannaCry Ransomware OutbreakAn Inside Look At The WannaCry Ransomware Outbreak
An Inside Look At The WannaCry Ransomware Outbreak
 
Via forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linuxVia forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linux
 
pbc_devsecops_eastereggs.2022oct06.jt.pptx
pbc_devsecops_eastereggs.2022oct06.jt.pptxpbc_devsecops_eastereggs.2022oct06.jt.pptx
pbc_devsecops_eastereggs.2022oct06.jt.pptx
 
CONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin NystromCONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin Nystrom
 
Securing your web apps before they hurt the organization
Securing your web apps before they hurt the organizationSecuring your web apps before they hurt the organization
Securing your web apps before they hurt the organization
 
Preventing In-Browser Malicious Code Execution
Preventing In-Browser Malicious Code ExecutionPreventing In-Browser Malicious Code Execution
Preventing In-Browser Malicious Code Execution
 
Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...
Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...
Straight Talk on Machine Learning -- What the Marketing Department Doesn’t Wa...
 
Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...
Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...
Smart Data Webinar: Deep QA (Question/Answer) - Lessons From Watson and Jeopa...
 
Preventing Hybrid Cloud Environments from Being Breached
Preventing Hybrid Cloud Environments from Being BreachedPreventing Hybrid Cloud Environments from Being Breached
Preventing Hybrid Cloud Environments from Being Breached
 
⛳️ Votre API passe-t-elle le contrôle technique ?
⛳️ Votre API passe-t-elle le contrôle technique ?⛳️ Votre API passe-t-elle le contrôle technique ?
⛳️ Votre API passe-t-elle le contrôle technique ?
 
Farewell to the Security Sandwich
Farewell to the Security SandwichFarewell to the Security Sandwich
Farewell to the Security Sandwich
 
How to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrikeHow to Replace Your Legacy Antivirus Solution with CrowdStrike
How to Replace Your Legacy Antivirus Solution with CrowdStrike
 

Recently uploaded

GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Tomaz Bratanic
 
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
Neo4j
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
panagenda
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
Alpen-Adria-Universität
 
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup SlidesProgramming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
Zilliz
 
Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
tolgahangng
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Safe Software
 
Infrastructure Challenges in Scaling RAG with Custom AI models
Infrastructure Challenges in Scaling RAG with Custom AI modelsInfrastructure Challenges in Scaling RAG with Custom AI models
Infrastructure Challenges in Scaling RAG with Custom AI models
Zilliz
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
danishmna97
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
Safe Software
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Malak Abu Hammad
 
How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
Daiki Mogmet Ito
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
Neo4j
 
Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
Aftab Hussain
 
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
DianaGray10
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Neo4j
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
Uni Systems S.M.S.A.
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
SOFTTECHHUB
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
Zilliz
 
Climate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing DaysClimate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing Days
Kari Kakkonen
 

Recently uploaded (20)

GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
 
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
 
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup SlidesProgramming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
 
Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
 
Infrastructure Challenges in Scaling RAG with Custom AI models
Infrastructure Challenges in Scaling RAG with Custom AI modelsInfrastructure Challenges in Scaling RAG with Custom AI models
Infrastructure Challenges in Scaling RAG with Custom AI models
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
 
How to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For FlutterHow to use Firebase Data Connect For Flutter
How to use Firebase Data Connect For Flutter
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
 
Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
 
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
 
Climate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing DaysClimate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing Days
 

BSides San Diego 2017 - Sophisticuffs: The rumble over adversary sophistication

  • 1. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICUFFS: THE RUMBLE OVER ADVERSARY SOPHISTICATION PAUL JARAMILLO
  • 2. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. PAUL JARAMILLO Twitter @DFIR_Janitor Biography Currently: Principal Consultant @CrowdStrike Previously: § Fortune 500 Energy § Fortune 100 Manufacturing § Fortune 10 Conglomerate § Dept. of Energy § Fortune 100 Telecommunications Focused on Incident Response & Digital Forensics
  • 3. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. State of Affairs Sophistication vs Effectiveness Sophisticated Actor vs Attack Measurements of Sophistication Adversaries of Infamy Recommendations
  • 4. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. STATE OF AFFAIRS § Breachapalooza continues § Struggles to implement common critical controls § Continued resource misallocation on buzzwords & knee jerks § Massive inequality between InfoSec have’s and have nots § Dwell time improving § Board awareness & engagement vastly increasing § Defending failures with “Sophisticated”
  • 5. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. STATE OF AFFAIRS § You had me at “Sophisticated” Attack :-/ § Password dump, guessing, reuse § Phishing § Fake login portal § Common tools, exploits (mimikatz, wiper, etc) § Ancient vulnerabilities (JBoss, Cold Fusion, MS08-067, Wordpress, etc) § Ransomware Image Credit: reddit.com
  • 6. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATION VS EFFECTIVENESS § Why does sophistication matter so much to the arm chair incident responder? § We know it matters to security vendors J § Should it matter to the impacted org? § Tight correlation with chances for successful defense § “Commercially reasonable effort” scapegoat § Supports better resource allocation Image Credit: imgur.com
  • 7. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATION VS EFFECTIVENESS
  • 8. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATED ACTOR VS ATTACK Rule #1 - Sophisticated Actor != Sophisticated Attack Sophisticated Actor = [Basic Attack … Sophisticated Attack] Image credit: xkcd.com
  • 9. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. SOPHISTICATED ACTOR VS ATTACK Rule #2 - Sophisticated Actor != Zero Days Sophisticated Actor = [Code Reuse, Custom Malware, Custom Tools, Zero Days, Etc] On APT - “We personally do not believe in the advanced part of the acronym, unless the threats involve specific zero-day exploits” ORLY?
  • 10. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. MEASUREMENTS OF THREAT ACTOR SOPHISTICATION § Attack Precision § Cross-platform Capabilities § Targeting § OPSEC § Resilience § Stealth
  • 11. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - ATTACK PRECISION Ability of Threat Actor to closely align their planned attacks with an organization's given vulnerabilities, including overall efficiency § WEAK(1) – Spray & pray, exploit kits, Apache exploits against IIS, etc § BASIC(4) – Brute force, observable mistakes such as CLI typos, accidental AV & IDS detection § STRONG(7) – Skillful targeting of people, authentication & directory services § FIERCE(10) – Demonstrated mastery of unique business process, timing, and/or closed technologies
  • 12. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - CROSS PLATFORM CAPABILITIES Ability of Threat Actor to operate in a full spectrum of diverse technologies § WEAK(1) – PHP websites, cracked MS Windows § BASIC(4) – MS Windows client & servers, web servers § STRONG(7) – OSX, Linux, Unix, Android, IoT(?) § FIERCE(10) – Embedded computing, firmware, telecommunications & network gear, and other closed systems
  • 13. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - TARGETING Ability of Threat Actor to successfully compromise well-defended “hard” targets, as compared to ”soft” targets § WEAK(1) – Grandma, individual credit cards & banking, software licenses § BASIC(4) – Corporate brands, political causes, corporate wire fraud § STRONG(7) – Data theft, destruction or modification with grave damage to organization or national security implication § FIERCE(10) – Critical systems or processes (kinetic damage, financial catastrophe)
  • 14. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - OPSEC Ability of Threat Actor to avoid providing their adversaries with any useful information about them § WEAK(1) – Bragging that you did it, claiming responsibility § BASIC(4) – Observable tool marks, traceable personas § STRONG(7) – Breadcrumbs, diversified tools & infrastructure § FIERCE(10) – Frame someone else, clandestine, covert
  • 15. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - RESILIENCE Ability of a Threat Actor to maintain access in an organization’s environment § WEAK(1) – AV solves your problem § BASIC(4) – Indicator blocks, reimages, and password changes solves your problem § STRONG(7) – Complex remediation, requiring 3rd party assistance § FIERCE(10) – Source code compromise, Supply chain compromise, Human implant
  • 16. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ACTORS - STEALTH Ability of Threat Actor to avoid detection § WEAK(1) – Mass scanning, large phishing campaigns § BASIC(4) – “Smash & grab” aka immediate action on objectives § STRONG(7) – Less than 1 year average dwell time § FIERCE(10) – Greater than 1 year average dwell time with continued activity
  • 17. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Anonymous - 18 (2006 to Present, 2010 Operation Payback, 2011 HBGary) § Attack Precision (4) § Cross Platform Capability (4) § Targeting (4) § OPSEC (4) § Resilience (1) § Stealth (1) Image Credit: ArsTechnica
  • 18. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Carbanak/Carbon Spider - 35 (2013 to Present, Swift attacks, Hotel chains, Retail, etc) § Attack Precision (10) § Cross Platform Capability (7) § Targeting (4^) § OPSEC (4) § Resilience (4) § Stealth (4) Image Credit: Buzzfeed
  • 19. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Silent Chollima/DarkSeoul - 36 (2009 to Present, South Korea, Sony, etc) § Attack Precision (7) § Cross Platform Capability (4) § Targeting (7) § OPSEC (4) § Resilience (7) § Stealth (7) Image Credit: KnowYourMeme
  • 20. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Axiom/Aurora Panda/APT17 - 51 (2009 to Present, Google, Adobe, Bit9, etc) § Attack Precision (10) § Cross Platform Capability (7) § Targeting (10) § OPSEC (7) § Resilience (7) § Stealth (10) Image Credit: people-you-knew.tumblr.com
  • 21. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY Equation Group - 60 (1996 to Present, Stuxnet, Flame, Grayfish) § Attack Precision (10) § Cross Platform Capability (10) § Targeting (10) § OPSEC (10) § Resilience (10) § Stealth (10) Image Credit: Kaspersky
  • 22. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. ADVERSARIES OF INFAMY
  • 23. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. RECOMMENDATIONS § Before calling out an organization § Could you detect it? Prevent it? Image Credit: quickmeme.com
  • 24. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. RECOMMENDATIONS Become a better defender and threat intelligence consumer 1. Collect & analyze all indicators, TTPs, and associated context around your own incidents using Kill Chain model 2. Complete your own organizational threat profile 3. Collect & analyze available data around threat actors targeting your organization using the ACTOR model 4. Proactively provide messaging around high visibility threats & risks 5. Align organizational priority around your biggest threats (e.g. new controls, threat hunting, M&A, people, etc)
  • 25. 2016 CROWDSTRIKE, INC. ALL RIGHTS RESERVED. QUESTIONS? Image Credit: memecrunch.com