Downloaded 30 times
![© 2014 Lancope, Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 18
DDoS Source
---
[tcp|udp|icmp] Flood
Slow Connection Flood
Packet Flood
High Total Traffic
TCP Resets
Scanning / Brute Force
---
Address Scan [tcp|udp]
Stealth Scan [tcp|udp]
ICMP Port Unreachable
Talks to Phantoms (6.6)
Brute Force Login (6.6)
Mail
---
Spam Source
High Volume Email
Mail Reject](https://image.slidesharecdn.com/detectingthreats-alookattheverizondbirandstealthwatch-151030132009-lva1-app6892/75/Detecting-Threats-A-Look-at-the-Verizon-DBIR-and-StealthWatch-18-2048.jpg)
![© 2014 Lancope, Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 21
Detect and stop lateral
movement inside the network
Address Scan [tcp|udp]
Stealth Scan [tcp|udp]
ICMP Port Unreachable
Talks to Phantoms (6.6)
Brute Force Login (6.6)](https://image.slidesharecdn.com/detectingthreats-alookattheverizondbirandstealthwatch-151030132009-lva1-app6892/75/Detecting-Threats-A-Look-at-the-Verizon-DBIR-and-StealthWatch-21-2048.jpg)
Uploaded byLancope, Inc.
Detecting Threats: A Look at the Verizon DBIR and StealthWatch
The document discusses threat detection through Lancope's Stealthwatch in relation to insights from the Verizon Data Breach Investigations Report (DBIR). It highlights the common types of data breaches, emphasizing that the majority of incidents involve human factors and includes breaches due to point-of-sale intrusions, cyber-espionage, and insider misuse. Additionally, it advocates for continuous monitoring of network traffic to enhance threat detection and response capabilities.
More Related Content
Similar to Detecting Threats: A Look at the Verizon DBIR and StealthWatch
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Detecting Threats: A Look at the Verizon DBIR and StealthWatch
- 1. © 2014 Lancope,Inc. All rights reserved. Detecting Threats Lancope, Inc. A Look at the Verizon DBIR and StealthWatch
- 2. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. A Look into a case- study of case- studies 2
- 3. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Defenders are too slow, too often 3
- 4. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. So why do we have this problem? 4
- 5. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Once Upon a Time DMZ VPN Internal Network Internet
- 6. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Then Came Mobile Computing DMZ VPN Internal Network Internet
- 7. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Telemetry 7 Drilling into a single flow provides a plethora of information
- 8. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Let the Network be Your sensor Internal visibility from core to access to edge 8 010 101 001 011 010 101 001 011 010 101 001 011 010 101 001 011 Laptop Tablet Phone Desktop / VDI WLAN LAN On Premise Public Internet Public Cloud Router / Switch Achieve pervasive, scalable network visibility into all traffic to monitor all network activities 24/7/365 Turn the network into an active sensor grid to detect potentially malicious activities in real-time Transform network data into actionable, context-aware intelligence to analyze and make fast, effective decisions regarding threat activity Take advantage of in-depth situational awareness to continuously analyze and respond to threats before, during, and after a security incident StealthWatch and Your Network
- 9. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Two Halves of the Puzzle Real Time Detection & Incident Response 9
- 10. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Security Algorithms describe traffic or behavior in a way that allows StealthWatch to constantly be on the lookout 10
- 11. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Back to the Data Breach report… 11
- 12. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Incident Classification Patterns 12 “…the common denominator across the top four patterns— accounting for nearly 90% of all incidents is people”
- 13. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Incident Classification Patterns (cont.) Data looks slightly different when confirmed data breaches are involved 13
- 14. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Point-of-sale (POS) Intrusions • Represents 28.5% of all confirmed data breaches in the report • Most affected industries: • Accommodation • Entertainment • Retail industries • Larger breaches tend to involve multi-step attack with some secondary system being compromised before attacking the POS system • It’s a problem for big and small 14
- 15. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 15 Suspect Data Hoarding Suspect Data Loss Credit card data has to be exfiltrated to be any good to attackers
- 16. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 16 Multi-stage attacks have precursors Long Flow/Beaconing Address Scan/Stealth Scan ICMP Port Unreachable Talks to Phantoms (6.6) Brute Force Login (6.6)
- 17. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Crimeware • Malware infections that are not associated with more specialized classification patterns • Represents 18.8% of all confirmed data breaches in the report • Most commonly used to: • Establish command-and-control capability • Launch DoS attacks • Most frequent targets: • Bank records • User credentials 17
- 18. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 18 DDoS Source --- [tcp|udp|icmp] Flood Slow Connection Flood Packet Flood High Total Traffic TCP Resets Scanning / Brute Force --- Address Scan [tcp|udp] Stealth Scan [tcp|udp] ICMP Port Unreachable Talks to Phantoms (6.6) Brute Force Login (6.6) Mail --- Spam Source High Volume Email Mail Reject
- 19. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Cyber-espionage • Attribution is difficult; only one-third of cyber-espionage cases had any kind of attacker attribution • Represents 18% of all confirmed data breaches in the report • Most targeted industries: • Manufacturing • Government • Information Services • Often involved social engineering and advanced, versatile malware • Most targeted data: • Organization secrets • Credentials 19
- 20. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 20 Monitor outbound traffic for suspicious connections and signs of infiltration In order to know what is abnormal, you need to know what normal traffic looks like Traffic Totals Flow Counts Packet-type Counts Index Values
- 21. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 21 Detect and stop lateral movement inside the network Address Scan [tcp|udp] Stealth Scan [tcp|udp] ICMP Port Unreachable Talks to Phantoms (6.6) Brute Force Login (6.6)
- 22. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Insider Misuse • Trusted insiders who have already been given network access, but betray that trust maliciously or through negligence • Represents 10.6% of all confirmed data breaches in the report • 37.6% of insider misuse cases are perpetrated by end users • Primary motivators: • Financial gain • Convenience 22
- 23. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 23 Know your data and who has access to it Suspect Data Hoarding Target Data Hoarding
- 24. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. 24 Detect data exfiltration Suspect Data Loss
- 25. © 2014 Lancope,Inc. All rights reserved.© 2014 Lancope, Inc. All rights reserved. Thanks for watching! Questions and Answers 25
Editor's Notes
- #3 Demonstrate usefulness of algorithms as a whole, relevance of ours Not based on 6.6 alone, SE training on Friday Introduce DBIR Most well regarded annual report Incident data from FBI, other CERTs Break everything up by market vertical, definitely worth a read Look at big picture instead of one or two incidents Show what need drives our existing algorithms
- #4 If you are not familiar with it, this graph illustrates the percentage of compromises and detections that were completed in “days or less.” Clearly, discovery is far below compromise, but we can help with that!
- #11 Combine human strengths and computers
- #12 Combine human strengths and computers
- #15 Nearly 30 percent of confirmed data breaches. This responsible for some of the largest breaches in the news involving major retailers. Lots of money was lost because of POS intrusions.
- #16 Suspect Data Loss good for POS, should be little other inside -> outside for noise SDH for scenarios where data was collected first
- #17 Attackers generally have the advantage Luxury of being able to fail over and over again But defenders have ‘home field advantage.’ Defenders built environment, attackers have to navigate it Recon outside might not be a huge deal, inside it matters
- #18 The first category we’ll go into is Crimeware. Non-APT, non-POST Malware About 20% of confirmed breaches Listed ‘key finding’ is DDoS, Spam, etc
- #19 Not slow and low Outgoing DDoS is valuable Brute force SSH and RDP Spam Email Things an experienced security team would want to monitor Algorithm lets us watch every host all the time rather than require an analyst to do it
- #20 Cyber espionage is the state actor, APT bucket. Proper attribution is really difficult. Different target industries than other attack patterns. Instead of Financial Services and Retail, Manufacturing and Government organizations are the most common targets. In addition, different types of data is stolen than other attack types. Organization secrets, credentials, and internal and system data is most commonly targeted. Often include social engineering and advanced malware.
- #21 Find normal and watch it Super clued in might know averages for certain subnets, but this is hard for humans We’re tracking a bunch of types of stats for every individual host Some concrete, some not
- #22 Attackers generally have the advantage Luxury of being able to fail over and over again But defenders have ‘home field advantage.’ Defenders built environment, attackers have to navigate it Recon outside might not be a huge deal, inside it matters
- #23 Insider and privilege misuse, or insider threat About 10% of confirmed breaches Valuable for us, internal visibility a lot of tools don’t have
- #24 First, know your data and who has access to it. Part of this is account and access audit, but also know where your data is and building control to detect misuse. I’m not going to tell you that we’re the best option to track the movement of one PDF, but when it’s a bit more volume we’re there.
- #25 Watch for data exfiltration With insider, often don’t have ability to look for exploitation Using proper credentials Instead, watch for data leaving