Detecting Threats - How to Think Like an Attacker
•
1 like•1,171 views
This document summarizes a cyber risk workshop on detecting threats by thinking like a cyber attacker. The workshop was held on October 28th 2014 in Hong Kong and presented by Albert Hui, a principal consultant with extensive cybersecurity experience and certifications. The workshop covered cyber attackers' motivations, methods, and potential damage, as well as countermeasures for detecting cyber attacks. It emphasized having layered security defenses, security event correlation, threat intelligence, logging, and incident response capabilities.
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Similar to Detecting Threats - How to Think Like an Attacker
Similar to Detecting Threats - How to Think Like an Attacker (20)
More from Albert Hui
More from Albert Hui (13)
Recently uploaded
Recently uploaded (20)
Detecting Threats - How to Think Like an Attacker
- 1. Cyber Risk Workshop October 28th 2014 @ Hong Kong DETECTING THREATS HOW TO THINK LIKE A CYBER ATTACKER Albert Hui GREM, GCFA, GCFE, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISC Principal Consultant
- 2. WHO AM I? Albert Hui GREM, GCFA, GCFE, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISC Principal Consultant albert@securityronin.com • Spoken at Black Hat, High Tech Crime Investigation Association (Asia Pacific Conference), and Economist Corporate Network. • Risk Consultant for Banks, Government and Critical Infrastructures. • SANS GIAC Advisory Board Member. • Former HKUST lecturer.
- 3. AGENDA Cyber Attackers’ • Motivations (Why do they hack you?) • Methods (How do they break in?) • Damage Potentials (What can they do to you?) Countermeasures • How to detect cyber attacks?
- 5. PRIMARY MOTIVATIONS Secular Sacred ego money ideology (e.g. hacktivists) revenge (e.g. former employees) industrial curiosity espionage war and terrorism (e.g. state-sponsored hackers)
- 6. OPPORTUNISTIC ATTACK TREND: HACKER SUPPLY CHAIN Anon Payment Hacker Tools / Bulletproof Hosting Monetization Implications • Sophisticated attacks now available to non-experts • Lower breakeven point for attacks • More “worthwhile” targets
- 7. TARGETED ATTACK TREND: CYBER WARFARE AND APT Implications • More attack budgets • 0-day attacks • Threat level corresponds to strategic value
- 9. CYBER KILL CHAIN Recon Weaponize Deliver Exploit Install C2 Action
- 10. ATTACK ROUTES Outside-In (e.g. SQLi, XSS, CSRF) Inside-Out (e.g. web malware, trojaned pdf) Indirect Home Office FW, IPS, etc. AV, HIPS, etc.
- 11. CYBER ATTACKERS’ DAMAGE POTENTIALS
- 12. COMMON EXPLOITATIONS Steal Stuff • Intellectual property theft • Steal money • Monetize the loot for credit card fraud, spam, DDoS etc. Wreak Havoc • Break system (e.g. via DDoS) • Cause system malfunction • Delete business data and ransom Consequential Damages • Legal and regulatory consequences • Reputational damage • Loss of license
- 14. PHILOSOPHY Defender’s Dilemma • Must secure all possible vulnerabilities Intruder’s Dilemma • Must evade all detections Reason’s Swiss Cheese Model Picture from NICPLD
- 15. ESSENTIALS FOR DETECTING CYBER ATTACKS • Layered defense-in-depth • Redundant security (e.g. two different brands of FWs) • Security event correlation (e.g. SIEM) • Trustworthy logging • Up-to-date threat intelligence • Security awareness and reporting channel • Incident response capability (e.g. CSIRT)