Csa UK agm 2019 - Chris J Hodson - Visibility in the cloud
•Download as PPTX, PDF•
0 likes•288 views
Chris Hodson
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Csa UK agm 2019 - Chris J Hodson - Visibility in the cloud
Similar to Csa UK agm 2019 - Chris J Hodson - Visibility in the cloud (20)
More from Cloud Security Alliance, UK chapter
More from Cloud Security Alliance, UK chapter (11)
Recently uploaded
Recently uploaded (20)
Csa UK agm 2019 - Chris J Hodson - Visibility in the cloud
- 1. Visibility and Control in the Cloud Achieving Security Equivalency
- 2. Chris Hodson | CISO, EMEA >whois @ChrisHInfosec
- 3. Organisational Perceptions of Cloud Contemporary Technology Paradigms
- 4. ©2019 Tanium. All rights reserved. 4 The CIO & CISO View “Bridging the Resilience Gap” • Two phased study released early 2019 • Aim to understand exactly how organizations are addressing technology-based disruption, • Phase 1 – Involved over 4,000 business decision-makers working in the to understand the barriers to achieving resilience against disruption. • Phase 2 - Explored the IT security and operational trade-offs that more than 500 CIOs and CISOs face when it comes to protecting their business from a growing number of cyber threats and other disruptions. Both phases of our study clearly show that a new approach is needed! See: https://www.tanium.com/resources/endpoint-management-for-security-and-business-resilience/
- 5. of respondents reported ‘poor visibility of entry points’ was a significant challenge to true business resilience Data provided: Tanium Resilience Gap Research Barriers to Business Resilience 24% Encryption Cloud Services Reliance on CMDB
- 6. ©2018 Tanium. All rights reserved. 6 Hub and Spoke Fragile Infrastructure and Agents Slow Response Times – Days to Weeks HQMOBILE BRANCHIOT Direct to Internet
- 7. ©2019 Tanium. All rights reserved. 7 Proven on the world's largest and most complex networks. FIREWALL Tanium Architecture Faster and more reliable than legacy platforms Scale without massive hardware investments Reduces reliance on congested WAN links Connect off-network machines (cloud, roaming) Single agent for all compute endpoints CLIENTS
- 8. Photos by Unknown Author are licensed under CC BY-SA-NC of respondents stated ‘growing organisational complexity’ as the biggest barrier to achieving business resilience Data provided: Tanium Resilience Gap Research 34%
- 9. ©2019 Tanium. All rights reserved. 9 By Bartledan (talk), based on a file by User:Foofy - Public Domain, https://commons.wikimedia.org/w/index.php?curid=6907222
- 10. ©2019 Tanium. All rights reserved. 10 Round
- 11. Demystifying the Risks of Cloud Computing An Academic Study
- 12. Clouds are like roads - they facilitate getting to your destination… Chris Hodson (Me), CIO Summit, Dublin, 2016 “ ”
- 13. ©2018 Tanium. All rights reserved. 13 Cybersecurity Risk Equation – Back to Basics Cybersecurity System/Data Owner
- 14. ©2018 Tanium. All rights reserved. 14 Actors, Events and Impact Cloud Computing
- 15. ©2018 Tanium. All rights reserved. 15 Cloud ‘Risks’ Understanding the Landscape
- 16. ©2018 Tanium. All rights reserved. 16 Cloud Threat and Vulnerability Categories Really?
- 17. ©2018 Tanium. All rights reserved. 17 Cloud or Multitenancy?
- 18. ©2018 Tanium. All rights reserved. 18 Could this happen to us? Qualifying Cloud Threat Scenarios
- 19. ©2018 Tanium. All rights reserved. 19 Threat Profiling Multitenancy Exploitation | Phishing and Credential Theft | Windows Vulnerability Exploitation
- 20. Are all staff adequately trained in security awareness? How do we provide value to the DevOps community? How do I obtain visibility of public cloud consumption? How do I obtain visibility of all my endpoints? How quickly can we apply a break-glass patch or hunt for an indicator of compromise? What is the latest regulation we need to adhere to? How do I get my business units to care about their data in the cloud?
- 21. Talk Takeaways Pragmatic Cloud Guidance
- 22. Vivek Kundra, Former Federal CIO of the United States of America “Cloud computing is often far more secure than traditional computing, because companies like Google and Amazon can attract and retain cyber-security personnel of a higher quality than many governmental agencies”
- 23. ©2018 Tanium. All rights reserved. 23 https://blogs.msdn.microsoft.com/cclayton/2011/06/07/standard-cloud-taxonomies-and- windows-azure/ Know your Cloud!
- 24. ©2018 Tanium. All rights reserved. 24
- 25. ©2018 Tanium. All rights reserved. 25
- 26. ©2018 Tanium. All rights reserved. 26 Cyber Risk Management A Good Practice Handbook for Professionals “Cyber Risk Management clearly explains the importance of implementing a cyber security strategy and provides practical guidance for those responsible for managing threat events, vulnerabilities and controls, including malware, data leakage, insider threat and Denial-of-Service. Examples and cases 'from the field', including the Yahoo and Facebook breaches, add context throughout and emphasise the importance of communicating security and risk effectively, while implementation review checklists bring together key points at the end of each chapter. Cyber Risk Management analyses the innate human factors around risk and how they affect cyber awareness and employee training, along with the need to assess the risks posed by third parties. Including an introduction to threat modelling, this book presents a data-centric approach to cyber risk management based on business impact assessments, data classification, data flow modelling and assessing return on investment. It covers pressing developments in artificial intelligence, machine learning, big data and cloud mobility, and includes advice on responding to risks which are applicable for the environment and not just based on media sensationalism.”
- 27. Thank you Go make something awesome.
Editor's Notes
- CISO, EMEA at Tanium Board Member @ IISP CompTIA Cybersecurity Committee Awful golfer, writer, father to three daughters – as such, the golf is a distant memory!
- “An enterprise has resilience when it can maintain continuous operability of technology and data security in the face of inevitable change and disruption.”
- I talk regularly abou the quest for visibility in an organsation -
- Legacy network para
- People will ask ‘so why is Tanium different’ We stick this slide up and say ‘rather than go into the weeds, we’re going to show you in a moment’ link to other versions of our architecture: https://docs.google.com/presentation/d/15a22T2WmGkW46PZFLF7d7Hxekt_eTnmaEBDUCFc2Dgk/edit#slide=id.g512710d244_1_0
- Pivot now to some of the outputs from the resilience gap study. How is your company looking at the complexity of today, but also tomorrow? Mentioned earlier that technology is driving change in business processes but as processes become more reliant on technology, we introduce more technical vulnerability into the supply chain. technology is moving at breakneck speed and it is important that the threats of tomorrow and today are considered as the security function serves the business. Look at this stat from our study, 34% of respondents cited growing complexity as a barrier to business resilience. Big Data, IoT, Blockchain and cloud – these techs are all all having profound impact on the way businesses operate. When I first started in tech - IT ran the show! - machines, apps, data This leaves the CISO with a plethora of recurring questions – transition to next slide.
- Or Docker containers, Google Big Query. Look at the security tools too.
- SaaS, IaaS, PaaS. No two implementations are created equally. We have vendors who ‘take security seriously’, we have very public examples of others who don’t. We cannot say ‘cloud is either security in insecure’ – requirements differ depending on the criticality of a system and the data being stored or processed. In the same way that a single speed limit for all roads would be inappropriate, a standard set of controls for all cloud solutions is not feasible. Road analogy – 70 mile an hour on a country lane would be foolhardy but enforcing a ’safe’ country lane speed limit on a motorway would be equally dangerous. Context is critical.
- This equation holds as true today as it ever has. Data and system owners report to board executives – Finance, HR, People, etc
- IP correlation to AWS Resource Groups – Ristenpart study – 9% of time - also need internet to be accepting unsolicited Pings from unknown locations. Free with AWS __________________________ For a VM escape or rogue hypervisor exploit, the attacker will need to ensure that she is resident on the same physical hardware as the victim machine although “just a few dollars invested in launching VMs can result in a 40% chance of placing a malicious VM on the same physical server as your target “Identical Dom 0 IP Addresses Small IP Packet Round Trip Times (RTTs) Numerically close IP addresses Brute force machine creation, _________________________ VM Escape attack – needs a vulnerability in a hypervisor – PoC code has been released for the Xen hypervison – VENOM vulnerability I _______________________ Install a kernel driver in the guest OS Find and initialise hardware virtualisation support Load the malicious hypervisor code into memory from the driver Create a new VM to place the host operating system inside Bind the new VM to the rootkit’s hypervisor Launch the new VM – this will switch the host into guest mode. _______________________ Side Channel – measure Cache usage, etc. Keystroke timing attacks. _____________________ DDoS Amazon or GCP – good luck! ____________________ We them compare with Social Engineering or exploiting an unpatched workstation – way greater number of vulns
- Let’s look at some resilience Business data – we cannot have resilience if we don’t know what needs to be resilient DevOps – resilience – traditional project models allow for security due dilliegence, Agile, Scrum and DevSecOps…less so. Visibility – how do we know what services are business units are consuming? Wherer are they putting data? Reslience impossible if we cannot measure. Visibility of endpoints – one of biggest challenges I see focuses on breadth of coverage. Companies are comfortable that they have ‘appropriate controls’ on the endpoints they know about, but there is often little confidence that they have an accurate picture of all endpoints on their network. How quickly can you deploy a patch or hunt for a particular threat indicator? How is this being measured? Latest regulation – GDPR, CCPA or Austrilian data privacy regulations. PCI-DSS, HIPPA Are all your staff adequately trained? What is ‘awareness’ amyway? I think we have some challenges inside and outside of cybersecurity on this one…
- Certainly when considering