Download as PDF, PPTX
![About Joshua Corman @joshcorman
• Director of Security Intelligence for Akamai Technologies
• Former Research Director, Enterprise Security [The 451 Group]
• Former Principal Security Strategist [IBM ISS]
• Industry:
• Expert Faculty: The Institute for Applied Network Security (IANS)
• 2009 NetworkWorld Top 10 Tech People to Know
• Co-Founder of “Rugged Software” www.ruggedsoftware.org
• BLOG: www.cognitivedissidents.com
• Things I’ve been researching:
• Compliance vs Security
• Disruptive Security for Disruptive Innovations
• Chaotic Actors
• Espionage
• Security Metrics
Akamai Confidential Powering a Better Internet ©2011 Akamai](https://image.slidesharecdn.com/cormananonymouscsachicago20120712-13442790022671-phpapp02-120806135829-phpapp02/85/Corman-Anonymous-Csa-Chicago-20120712-2-320.jpg)
![Anonymous* Unmasked? [*Alleged]
Akamai Confidential Powering a Better Internet ©2011 Akamai](https://image.slidesharecdn.com/cormananonymouscsachicago20120712-13442790022671-phpapp02-120806135829-phpapp02/85/Corman-Anonymous-Csa-Chicago-20120712-18-320.jpg)
![Privacy in the Information Age [Q3 2015 version]](https://cdn.slidesharecdn.com/ss_thumbnails/privacyintheinformationagev3-150913203647-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
Corman Anonymous Csa Chicago 20120712
- 1. RISE OF THECHAOTIC ACTOR: ADAPTING TO THE AGE OF ANONYMOUS Joshua Corman CSA Chicago Chapter Meeting Director of Security Intelligence July 11th, 2012 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 2. About Joshua Corman@joshcorman • Director of Security Intelligence for Akamai Technologies • Former Research Director, Enterprise Security [The 451 Group] • Former Principal Security Strategist [IBM ISS] • Industry: • Expert Faculty: The Institute for Applied Network Security (IANS) • 2009 NetworkWorld Top 10 Tech People to Know • Co-Founder of “Rugged Software” www.ruggedsoftware.org • BLOG: www.cognitivedissidents.com • Things I’ve been researching: • Compliance vs Security • Disruptive Security for Disruptive Innovations • Chaotic Actors • Espionage • Security Metrics Akamai Confidential Powering a Better Internet ©2011 Akamai
- 3. Consequences: Value &Replaceability http://blog.cognitivedissidents.com/2011/10/24/a-replaceability-continuum/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 4. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 5. Adaptive Persistent Adversaries AkamaiConfidential Powering a Better Internet ©2011 Akamai
- 6. 6 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 7. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 8. 20 Slides x 20 Seconds (6 min 40 sec) Joshua Corman @joshcorman Research Director Enterprise Security RSA 2011 PechaKucha Happy Hour http://www.youtube.com/watch?v=JQEBYxp_vKs Akamai Confidential Powering a Better Internet ©2011 Akamai
- 9. Understanding Anonymous: The Rise of the Chaotic Actor Joshua Corman @joshcorman Director of Security Intelligence Akamai Technologies 2011 FlashTalks powered by PechaKucha Akamai Confidential Powering a Better Internet ©2011 Akamai
- 10. 10 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 11. 11 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 12. Paradox Slide/Deliberate Disinformation AkamaiConfidential Powering a Better Internet ©2011 Akamai
- 13. http://www.csoonline.com/article/682511/the-rise-of-the-chaotic-actor-understanding-anonymous-and-ourselves Akamai Confidential Powering a Better Internet ©2011 Akamai
- 14. Some men justwant to see the world burn… 14 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 15. Lots & Lotsof Anonymous Sects 15 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 16. Your Headline Here(in Title Caps) 16 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 17. You Choose YourOwn Level of Involvement 17 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 18. Anonymous* Unmasked? [*Alleged] AkamaiConfidential Powering a Better Internet ©2011 Akamai
- 19. You Choose YourOwn Level of Involvement 19 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 20. You Choose YourOwn Level of Involvement 20 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 21. Escalation? 21 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 22. Anomalous Anonymous? 22 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 23. False Flags: AdaptivePersistent Adversaries “Anonymous is God’s gift to the Chinese” – CISO Akamai Confidential Powering a Better Internet ©2011 Akamai
- 24. Cyber-Neo-McCarthyism I amnot now… …nor have I ever been… …a member of Anonymous. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 25. Building a BetterAnonymous… 25 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 26. Building a BetterAnonymous… 26 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 27. The easy answers Suggested Background 27 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 28. Joshua Corman @joshcorman http://blog.cognitivedissidents.com/2011/12/20/building-a-better-anonymous-series-part-0/ 28 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 29. PANEL: Whoever FightsMonsters… Akamai Confidential Powering a Better Internet ©2011 Akamai
- 30. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 31. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 32. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 33. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 34. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 35. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 36. 1914 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 37. With Great Power? "When you don't have centralized leadership, it doesn't matter what most will do, it matters what one of them will do," Corman said. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 38. Control and Chaos ”World War 3.0” by Michael Joseph Gross Vanity Fair - May 2012 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 39. Does not onecause the other? ”World War 3.0” by Michael Joseph Gross Vanity Fair - May 2012 “It’s a Trap” on shirt.woot.com Akamai Confidential Powering a Better Internet ©2011 Akamai
- 40. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 41. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 42. Crossroads Akamai Confidential Powering a Better Internet ©2011 Akamai
- 43. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 44. Chaotic Chaotic Chaotic Good Good Good Free Moral Legislation Speech Outrage Watchdog Anonymous Identity/Meme Leave “General Population” MalSec? LulzSec Chaotic Chaotic Good? or Evil Evil? Akamai Confidential Powering a Better Internet ©2011 Akamai
- 45. “If you believesomething…” Akamai Confidential Powering a Better Internet ©2011 Akamai
- 46. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 47. Finger on thePulse Akamai Confidential Powering a Better Internet ©2011 Akamai
- 48. Back to Anonymous2020 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 49. The Future ofAnonymous Akamai Confidential Powering a Better Internet ©2011 Akamai
- 50. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 51. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 52. A Modern Pantheonof Adversary Classes Actors Organized Script States Competitors Terrorists Hacktivists Insiders Auditors Crime Kiddies Motivations Financial Industrial Military Ideological Political Prestige Impacts Reputational Personal Confidentiality Integrity Availability Targets Intellectual Cyber Core Business Credit Card #s Web Properties PII / Identity Property Infrastructure Processes Akamai Confidential Powering a Better Internet ©2011 Akamai
- 53. Script Kiddies Skiddie Prestige/Profit Confidentially, Reputation CCN/Fungible Akamai Confidential Powering a Better Internet ©2011 Akamai
- 54. Organized Crime Organized Crime Profit Confidentially, Reputation CCN/Fungible Akamai Confidential Powering a Better Internet ©2011 Akamai
- 55. Espionage: Adaptive PersistentAdversaries State/Espionage Industrial/Military Confidentially, Reputation Intellectual Property Trade Secrets Infrastructure Akamai Confidential Powering a Better Internet ©2011 Akamai
- 56. Hactivists Chaotic Actors Chaotic Hactivist Ideological and/or LULZ Availability Reputation Personal Web Properties Personal/Family Exposure Akamai Confidential Powering a Better Internet ©2011 Akamai
- 57. Auditors Auditor QSA Profit Distraction Fines Credit Card #s Akamai Confidential Powering a Better Internet ©2011 Akamai
- 58. Compare and ContrastThreat Actors Casual State QSA Chaotic Actor Org Crime Attacker APT/APA Reputation, IP, Trade CCNs Dirty Laundry Secrets, Asset Focus CCNs CCNs… Banking DDoS/Availabi National Fungible $ lity Security Data Timeframe Annual Anytime Flash Mobs Continuous Long Cons Target NA LOW HIGH LOW HIGH Stickiness Probability 100% MED ? HIGH ? “Impact” Annual $ 1 and done Relentless Varies Varies Akamai Confidential Powering a Better Internet ©2011 Akamai
- 59. Attacker Power -HD Moore’s Law Moore’s Law: Compute power doubles every 18 months HDMoore’s Law: Casual Attacker Strength grows at the rate of MetaSploit Akamai Confidential Powering a Better Internet ©2011 Akamai
- 60. HDMoore’s Law 100 90 80 Success Rate (%) 70 Adversary Classes 60 Espionage Organized Crime 50 APT/APA Chaotic Actors 40 Organized Crime Casual Attacker Anon/Lulz Auditor/Assessor 30 Casual 20 QSA 10 x 1 2 3 4 5 6 7 8 9 10 11 12 Defender “SecureOns” http://blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 61. HDMoore’s Law (continued) HDMoore’s Law 100 90 80 Success Rate (%) 70 Adversary Classes 60 Espionage Organized Crime 50 APT/APA Chaotic Actors 40 Organized Crime Casual Attacker Anon/Lulz Auditor/Assessor 30 Casual 20 QSA 10 x 1 2 3 4 5 6 7 8 9 10 11 12 Defender “SecureOns” http://blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 62. HDMoore’s Law (continued) HDMoore’s Law 100 90 80 Success Rate (%) 70 Adversary Classes 60 Espionage Organized Crime 50 APT/APA Chaotic Actors 40 Organized Crime Casual Attacker Anon/Lulz Auditor/Assessor 30 Casual 20 QSA 10 x 1 2 3 4 5 6 7 8 9 10 11 12 Defender “SecureOns” http://blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 63. HDMoore’s Law (continued) HDMoore’s Law 100 90 80 Success Rate (%) 70 Adversary Classes 60 Espionage Organized Crime 50 APT/APA Chaotic Actors 40 Organized Crime Casual Attacker Anon/Lulz Auditor/Assessor 30 Casual 20 QSA 10 x 1 2 3 4 5 6 7 8 9 10 11 12 Defender “SecureOns” http://blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 64. HDMoore’s Law (continued) HDMoore’s Law 100 90 80 Success Rate (%) 70 Adversary Classes 60 Espionage Organized Crime 50 APT/APA Chaotic Actors 40 Organized Crime Casual Attacker Anon/Lulz Auditor/Assessor 30 Casual 20 QSA 10 x 1 2 3 4 5 6 7 8 9 10 11 12 Defender “SecureOns” http://blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 65. HDMoore’s Law (continued) HDMoore’s Law 100 90 80 Success Rate (%) 70 Adversary Classes 60 Espionage Organized Crime 50 APT/APA Chaotic Actors 40 Organized Crime Casual Attacker Anon/Lulz Auditor/Assessor 30 Casual 20 QSA 10 x 1 2 3 4 5 6 7 8 9 10 11 12 Defender “SecureOns” http://blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 66. 2011: Attacks Density(4Realz DBIR Style) “Only 55 of the 630 possible events have a value greater than 0…90% of the threat space was not in play at all” Akamai Confidential Powering a Better Internet ©2011 Akamai
- 67. 2012: Attacks Density(4Realz DBIR Style) “Only 22 of the 315 possible events have a value greater than 0…93.1% of the threat space was not in play at all” Akamai Confidential Powering a Better Internet ©2011 Akamai
- 68. It’s all aboutZombies Akamai Confidential Powering a Better Internet ©2011 Akamai
- 69. Survival Guide/Pyramid www.ruggedsoftware.org Defensible Infrastructure Akamai Confidential Powering a Better Internet ©2011 Akamai
- 70. Survival Guide/Pyramid Operational Discipline Defensible Infrastructure Akamai Confidential Powering a Better Internet ©2011 Akamai
- 71. Survival Guide/Pyramid Situational Awareness Operational Discipline Defensible Infrastructure Akamai Confidential Powering a Better Internet ©2011 Akamai
- 72. Survival Guide/Pyramid Countermeasures Situational Awareness Operational Discipline Defensible Infrastructure Akamai Confidential Powering a Better Internet ©2011 Akamai
- 73. Case Study: ZombieKiller of the Week LanCope BigFix (IBM) Countermeasures NetWitness (RSA) Fidelis XPS Situational Awareness HBGary FireEye Operational Discipline ArcSight (HP) Defensible Infrastructure A real use case of 'better security' in the face of adaptive adversarieshttp://www.the451group.com/report_view/report_view.php?entity_id=66991 Akamai Confidential Powering a Better Internet ©2011 Akamai
- 74. Who are youplaying against? Akamai Confidential Powering a Better Internet ©2011 Akamai
- 75. Innovation Opportunities? Start witha blank slate! Operationalizing the Basics More/Varied “Eyes & Ears” Increased agility Obtain/share adversary centric intel Big Data & A.I. (more than hype) Simulate adversary-driven scenarios Akamai Confidential Powering a Better Internet ©2011 Akamai
- 76. Akamai Confidential Powering a Better Internet ©2011 Akamai
- 77. Thank You &Contact Mar @ sudux.com @krypt3ia “anonymous” contributors “unspecified” contributors @attritionorg @JoshCorman http://blog.cognitivedissidents.com/2011/12/20/building-a-better-anonymous-series-part-0/ Akamai Confidential Powering a Better Internet ©2011 Akamai
- 78. THANK YOU… Joshua Corman Director of Security Intelligence http://blog.cognitivedissidents.com/ Akamai Confidential Powering a Better Internet ©2011 Akamai