Cyber warfare update 2016
•Download as PPTX, PDF•
3 likes•135 views
The document discusses cybersecurity defense and threats facing various industries. It outlines key inflection points like Stuxnet and Target breach. New threats include hacking for hire and risks from the growing Internet of Things ecosystem. The presenter advocates for expanding threat models to include supply chain risks, network segmentation, vulnerability management, and red team testing to protect against modern attacks. Participants are asked to share recent attacks in their industries.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cyber warfare update 2016
Similar to Cyber warfare update 2016 (20)
Recently uploaded
Recently uploaded (20)
Cyber warfare update 2016
- 1. IOActive, Inc. Copyright ©2015. All Rights Reserved. Cybersecurity Defense Update SecureWorld -Seattle Kevin J. Murphy, CISSP, CISM, CGEIT Vice President Operations Kevin.murphy@ioactive.com November 10, 2016
- 2. IOActive, Inc. Copyright ©2015. All Rights Reserved. Agenda A very interactive discussion – We learn from each other! “Let’s look at our attack surface a little differently.” • Welcome & Room Introductions • Cybersecurity Inflection Points • The Threat Actors • How to protect your enterprise • Room Discussion
- 3. IOActive, Inc. Copyright ©2015. All Rights Reserved. Who is in the room? • Healthcare • Energy • Telecom • Financial • Manufacturing • Government • Retail • IT Vendors • Others?
- 4. IOActive, Inc. Copyright ©2015. All Rights Reserved. Game Changing Attack Inflection Points • APT – Nation State espionage / attacks • Stuxnet – Embedded and SCADA systems • Heartbleed – 3rd party software and network appliances • TARGET – HVAC vendor account compromise • San Bernardino Shooting – BYOD Chip memory hacking “What will the next one be?”
- 5. IOActive, Inc. Copyright ©2015. All Rights Reserved. New Threat Actors - Hacking for hire
- 6. IOActive, Inc. Copyright ©2015. All Rights Reserved. Hacking for hire
- 7. IOActive, Inc. Copyright ©2015. All Rights Reserved. Technology Evolves. Security Must Evolve. • The Internet Of Things (IOT) is a game changer. • The products and services being built and used by our customers are changing to meet this new market. • We need to work together to help secure the ecosystem to allow IOT to be successful.
- 8. IOActive, Inc. Copyright ©2015. All Rights Reserved. IOT Products = Any Connected Device Your New Endpoints: • Refrigerators, Washers • Home & Building Power meters • Thermostats, HVAC, Cameras • TVs, Smartphones, iPads • Cars, Trains, Buses • Smart Cities 8
- 9. IOActive, Inc. Copyright ©2015. All Rights Reserved. Your new endpoints: Chip to Code Biometrics And more… Cloud ArchitectureSystem on chipOS Apps Device Network
- 10. IOActive, Inc. Copyright ©2015. All Rights Reserved. IOT End-to-End Attack Vectors
- 11. IOActive, Inc. Copyright ©2015. All Rights Reserved. The Evolution of Security Pen Testing • Includes: • Scanning Electron Microscopes (SEMs) • Focused Ion Beams (FIBs) • Ion Etcher • Confocal optical imaging equipment • Specifically equipped garage for vehicle research • Labs drive research and perform security analysis for our customers: • Embedded devices (OEM, Internet of Things (IoT), industrial, transportation, medical, and more) • Low-level device firmware and drivers • Semiconductors 11
- 12. IOActive, Inc. Copyright ©2015. All Rights Reserved. Chip level Imaging down to 2 microns
- 13. IOActive, Inc. Copyright ©2015. All Rights Reserved. How to Protect your Enterprise • Threat Models: View the complete new attack surface in your threat models - Silicon to applications and supply chain • Supply Chain: Require your supply chain vendors to disclose what security testing they have conducted and the results • Segment your network with firewalls and enclaves
- 14. IOActive, Inc. Copyright ©2015. All Rights Reserved. How to Protect your Enterprise • Monitor your network and your hosts with real-time alerting and a well planned incident response plan • Vulnerability mgmt. e.g. Qualys for all your system components. Keep your security patching up-to-date • Red Team /Pen Test. Use combo of internal and external skills. Don’t always use the same people
- 15. IOActive, Inc. Copyright ©2015. All Rights Reserved. Resources to help you: http://csrc.nist.gov/
- 16. IOActive, Inc. Copyright ©2015. All Rights Reserved. Learning From Peers Please share some of the attacks that your industry has been seeing.
Editor's Notes
- Often when security firms say they “do mobile security”, they typically mean just the mobile apps. In our case, we handle everything from chip to code – everything from the processors, to embedded systems, the device itself, the apps, the network, the storage – and everything in between.