Infosec 2014: Tech Talk - Non-Disruptive Vulnerability Discovery

•

1 like•555 views

This document discusses Skybox Security's risk analytics capabilities for cyber security. It highlights common use cases like firewall compliance, configuration management, vulnerability discovery, risk assessment, and continuous monitoring. It also outlines Skybox's threat, vulnerability and risk management model and how it prioritizes vulnerabilities using factors like attack vectors, exposure analysis, and vulnerability profiling. Finally, it summarizes how Skybox's risk control capabilities can augment vulnerability scanners to improve discovery, analysis, and remediation reporting across an enterprise.

Technology

Alastair Williams
Technical Director, EMEA
Risk Analytics for Cyber Security

© 2013 Skybox Security Inc. 2
Common Use Cases for Skybox
Enabled by Risk Analytics
 Firewall
Compliance
 Configuration
management
 Change
management
 Network visibility
 Vulnerability
discovery
 Risk assessment
 Prioritization
 Remediation
planning
 Continuous
Monitoring
 Security
Intelligence
 Attack prevention
 Risk reports
Cyber Threat
Management
Network
Security
Management
Vulnerability
Management

© 2013 Skybox Security Inc. 3
Threat, Vulnerability & Risk Management –
Skybox Model
ThreatsConfig data and
routing tables VulnerabilitiesLayer 3
Devices Assets

© 2013 Skybox Security Inc. 4
PrioritiseDiscover
Up-to-date, less
disruption
Analyse
Remediate
and Track
 Scanless
vulnerability
detection
 Import all 3rd party
VA scanners
 Threat intelligence
 Vulnerability Profiling
 Asset Classifications
 Vulnerability context
 Attack simulation
 Network context
 Threat Origins
 Risk exposures
 Geo or technology
 Attack vectors
 Heat maps
Find areas of
greatest impact
Reduce risk
exposure
Manage effectively
over time
Vulnerability and Threat Management
with Skybox
 Remediation
planning
 Ticketing and
workflow
 Dashboards and
reporting

© 2013 Skybox Security Inc. 10
Traditional Discovery Method: Active Scan
Skybox
Analytics
• Potential load to the network
• Issues with network firewalls and
host firewalls
• Sensitive areas with no permission
to scan
• Scans are too long so “round
robin” approach is required

© 2013 Skybox Security Inc. 11
Next Generation: Vulnerability Discovery
Microsoft
Vulnerabilities
Daily
Sync
Products
Microsoft
Missing
Patches
Patches
Invention:
Use rule-driven approach
for translating product
banners into standard
CPE format
Example:
Microsoft Corporation | Microsoft SQL Server 2005 (64bit) | 9.4.5000.00
=>
cpe:2.3:a:microsoft:sql_server::2005:sp4:::::x64:
=>
CVE-xxxx-xxxx
Non-Microsoft
Vulnerabilities

© 2013 Skybox Security Inc. 12
Risk Control - Objective Vulnerability
Analysis
 Identify relevant vulnerabilities
 Analyse Infrastructure Vulnerabilities
– Consider Vulnerability Density
– Consider Vulnerability Age
 Identify Exposed Vulnerabilities
– Asses Business Impact
– Consider Deeper Exposures
 Identify the critical few %
 Prioritise Remediation to maximise risk reduction

© 2013 Skybox Security Inc. 13
Vulnerability Profiling
Unique Technology Advantage
Prioritize Vulnerabilities by Multiple Factors
Attack Vectors
Virtual pen test
Target concentrations of
vulnerabilities to meet SLA’s
Target attack vectors against
critical assets
Exposure Analysis
Target specific attack vectors
MS Security
Bulletins
Business Units
Technical
Groups
Vulnerability Hot
Spots

© 2013 Skybox Security Inc. 14
Skybox Attack Simulation

© 2013 Skybox Security Inc. 21
Summary
 Augment your scanner with Risk Control to get better
discovery – analysis and remediation reporting.
 Discover vulnerabilities across your entire enterprise –
especially in places you currently don’t scan
 Discover vulnerabilities within days of announcement,
not weeks or months

The document discusses Risk Control's vulnerability detection capabilities. It can deduce vulnerabilities without scanning by leveraging existing repositories, providing faster discovery across all systems including those that are difficult to scan. It augments traditional vulnerability scanning by continuously updating vulnerability data and detecting vulnerabilities across operating systems, network devices, applications, and client-side software.

VMRay intro video

Chad Loeven

VMRay Analyzer is a hypervisor-based threat detection solution that provides best-in-class analysis of malware and targeted attacks. It utilizes full hypervisor integration to allow for high performance, scalable analysis that is resistant to detection and evasion techniques. VMRay's approach leverages the hypervisor to monitor all activity within virtual machines and detect advanced persistent threats and targeted attacks that other tools may miss.

Security Implications of the Cloud - CSS ATX 2017

Alert Logic

The document discusses the security implications of cloud computing. It notes that web application attacks are now the number one source of data breaches, but less than 5% of data center security budgets are spent on application security. It also summarizes that the risks are moving up the application stack as attacks can happen at every layer. Defending applications and workloads in the cloud is complex due to a wide range of attacks, rapidly changing code introducing vulnerabilities, and a shortage of cloud security expertise. Perimeter security tools also fail to protect the larger cloud attack surface that now includes web and mobile applications.

Realities of Security in the Cloud

Alert Logic

The document discusses security challenges in cloud computing and provides an overview of Alert Logic's security solutions. It begins by noting that security is a challenge that has changed with the cloud model introducing shared responsibility. It then provides examples of security services Alert Logic offers across various areas like access management, patching, monitoring, and network threat detection. The document uses an example attack scenario to illustrate how an attacker may perform reconnaissance, exploit vulnerabilities like path traversal and remote file inclusion, extract data through SQL injection, establish command and control through a webshell, and the visibility different parts of Alert Logic's solution would provide at each stage. It argues integrated solutions covering assets, vulnerabilities, network, and application layers are needed for full threat visibility and coverage.

The Intersection of Security & DevOps

Alert Logic

1. As developers have become the driving force behind cloud adoption, there is a need to realign security practices with DevOps workflows and priorities. 2. A blueprint approach to cloud security involves enumerating cloud assets, threat modeling for common workloads, and integrating controls across the full technology stack. 3. With a blueprint model and automated security tools integrated into the development pipeline, security can provide coverage throughout the software development lifecycle without slowing innovation or agility.

Webcast Series #1: Continuous Security and Compliance Monitoring for Global I...

Qualys

This document discusses the need for continuous security and compliance monitoring of global IT assets due to the decreasing time between vulnerability exposure and attack. It notes that WannaCry exploited vulnerabilities within 100 days on average, while exploits now occur within 30 days. The document recommends moving from periodic assessments to continuous monitoring using lightweight cloud agents that can assess both on-premise and remote assets like cloud servers and user endpoints. Qualys products provide continuous discovery, vulnerability management, and compliance through a single agent and platform.

Outpost24 webinar: Security Analytics: what's in a risk score

Outpost24

Qualys Corporate Brochure

Qualys

This document discusses security in the cloud and describes Alert Logic's approach to cloud security. It provides an example attack scenario on a classic 3-tier web application and assesses Alert Logic's capabilities in detecting each step of the attack. These include reconnaissance, entry/data exfiltration, command and control, and establishing a persistent foothold. The document outlines how Alert Logic provides asset visibility, network inspection, deep HTTP inspection, and integrated security experts to provide deep threat visibility and coverage across the infrastructure.

Reality Check: Security in the Cloud

Alert Logic

This document discusses security in the cloud and recommends best practices. It notes that while AWS provides many security tools, customers are still responsible for 95% of security failures due to human error. It then outlines various attack types like SQL injection and remote code execution that target web applications. The document recommends leveraging machine learning and multiple detection techniques to identify multi-stage attacks. It emphasizes the need to secure the entire attack surface, including on-premises environments, and highlights services like Alert Logic that provide 24/7 monitoring, analytics, and security experts to help detect and respond to threats.

#ALSummit: Live Cyber Hack Demonstration

Alert Logic

#ALSummit: Architecting Security into your AWS Environment

Alert Logic

AWS Security Best Practices for Effective Threat Detection & Response

AlienVault

In this SlideShare, we’ll share the AWS Security Best Practices for securing AWS environments, as well as some of the trends our research has shown with regard to attacks on those environments. We'll also introduce the key capabilities needed for a modern threat detection & incident response program customized for AWS, and other AWS Security Best Practices including: -Asset Discovery - creating an inventory of running instances -Vulnerability Assessment - conducting scans to assess exposure to attack, and prioritize risks -Change Management - detect changes in your AWS environment and insecure network access control configurations -S3 & ELB Access Log Monitoring - Monitor access logs of hosted content and data directed at your instance -CloudTrail Monitoring and Alerting - Monitor the CloudTrail service for abnormal behavior -Windows Event Monitoring - Analyze system level behavior to detect advanced threats With more IT environments moving data and applications to AWS, the motivation for hackers to target AWS environments is also increasing. We believe these AWS Security Best Practices will be a valuable addition to every security practitioner’s playbook. We'll finish up with a demo of NEW AlienVault USM for AWS, which delivers all of the above capabilities, plus log management & event correlation to help you detect threats quickly and comply with regulatory requirements.

Outpost24 Webinar - Creating a sustainable application security program to dr...

Outpost24

Outpost24 webinar: cloud providers ate hosting companies' lunch, what's next?...

Outpost24

AWS, Azure and Google Cloud have disrupted the traditional infrastructure market. After realizing that security is a major roadblock to cloud adoption, they are putting money and effort to built-in security features. But hybrid setups remain a challenge for companies and there is a learning curve for security teams to be proficient on cloud. Find out how to choose the best toolset to secure your data in the cloud.

Outpost24 webinar - Mastering the art of multicloud security

Outpost24

Shared Security Responsibility in the AWS Public Cloud

Alert Logic

The document discusses security in the AWS public cloud and Alert Logic solutions that are engineered for AWS. It summarizes that in AWS, security is shared between AWS and the customer. Alert Logic provides web security, log management, and threat detection solutions that integrate with AWS and are designed to scale automatically with AWS resources. The solutions provide security monitoring, compliance coverage, and are managed by Alert Logic security analysts.

Advanced Threat Defense Intel Security

xband

McAfee Advanced Threat Defense is a comprehensive solution that uses dynamic analysis, static code analysis, and machine learning to detect advanced malware. It analyzes malware behavior in real-time using emulation and deploys centrally to provide high detection accuracy and lower costs compared to other solutions. The solution integrates with other McAfee products to form a coordinated defense that rapidly shares threat intelligence across the enterprise to immediately block threats.

Qualys Brochure for CISOs

Qualys

The document describes Qualys Cloud Platform, which provides unified security and compliance capabilities across IT assets through a single platform. It allows users to track global IT assets, continuously assess security and compliance posture through customizable dashboards and alerts, and instantly identify vulnerabilities or compromised assets without scanning. The platform aims to consolidate security and compliance solutions and reduce related costs.

Css sf azure_8-9-17-stories_from_the_soc_paul fletcher_al

Alert Logic

The document discusses security operations at a center and describes various web application attacks they encounter. It summarizes a WordPress XMLRPC attack on an athletic apparel company and how the attack was initially detected. It then explains how the attackers used SQL injection to exfiltrate data from the compromised website. Finally, it discusses how Alert Logic detects these types of threats across their customers' applications and networks.

Creating Correlation Rules in AlienVault

AlienVault

This document discusses correlation in security monitoring. Correlation involves relating different security-related events together to produce more useful information and detect threats. It works by applying correlation rules to incoming events to increase their priority and risk level if they match specified criteria. This helps reduce noise and manual monitoring while automating security. Complex correlation allows matching events across multiple levels and timeframes. Correlation directives can be used to detect common attacks and map events to compliance objectives.

Security Implications of the Cloud

Alert Logic

The document discusses security implications of cloud computing and web application attacks. It notes that web application attacks are now the leading cause of data breaches, but less than 5% of security budgets are spent on application security. There is a wide range of attacks targeting different layers of the application stack. Defending applications and workloads in the cloud is complex due to rapidly changing code, vulnerabilities in third-party tools, and a shortage of cloud security expertise. Perimeter security tools are insufficient for protecting the diverse cloud attack surface. The document also provides an example of a textile company that suffered a data exfiltration attack through vulnerabilities in their PHP login system, costing them $1.8 million.

Esteban Próspero

ClusterCba

1) The complexity of corporate IT is growing daily, with an 81% increase in mobile data traffic in 2013 and only 50% of data needing protection currently protected. Advanced attacks have a high material impact, costing companies billions annually. 2) McAfee's Connected Security Platform allows threat intelligence to be shared in milliseconds between endpoints, gateways and other security products to immediately protect organizations as threats are revealed. 3) The platform includes the Threat Intelligence Exchange, Enterprise Security Manager, and Data Exchange Layer to provide real-time visibility, adaptive security, and integrated protection and response across an organization.

#ALSummit: Cyber Resiliency: Surviving the Breach

Alert Logic

- The document discusses strategies for both before and after a security breach occurs. - Before a breach, the key recommendations are to adopt resilient design patterns like limiting credential reuse, isolating applications, and continuously snapshotting configurations. Critical logs should also be collected and stored immutably outside the environment. - After a breach is discovered, the document advises cutting connections but also considers briefly observing the attacker first to understand the full scope. Isolating compromised infrastructure and practicing incident response drills are also suggested.

Improve threat detection with hids and alien vault usm

AlienVault

Host-based intrusion dection systems (HIDS) work by monitoring activity that is occurring internally on a host. HIDS look for unusual or nefarious activity by examining logs created by the operating system, looking for changes made to key system files, tracking installed software, and sometimes examining the network connections a host makes. AlienVault USM integrates HIDS with other key security controls to help you get the most out of HIDS, including: Analyzing system behavior and configuration status to track user access and activity Detecting system compromise, modification of critical configuration files (e.g. registry settings, /etc/passwd), common rootkits, and rogue processes Correlating HIDS data with known IP reputation, vulnerability scans and more Logging and reporting for PCI compliance

Security Implications of the Cloud - CSS Dallas Azure

Alert Logic

The document summarizes the security implications of cloud computing. It notes that web application attacks are now the number one source of data breaches, but less than 5% of security budgets are spent on application security. It discusses how risks are moving up the application stack as vulnerabilities can be introduced through code changes and dependencies. Defending web applications and workloads in the cloud is complex due to a wide range of attacks at every layer of the stack and a shortage of security expertise. It then provides an example of a data exfiltration attack against a retail company where an attacker exploited known PHP flaws to access critical systems and steal data over 4 months without detection.

Realities of Security in the Cloud

Alert Logic

This document discusses security challenges in the cloud and Alert Logic's approach to addressing them. It begins by outlining various security services needed in the cloud like monitoring, scanning, and access management. It then describes a hypothetical attack scenario against a web application to illustrate how an attacker may progress from reconnaissance to gaining a persistent foothold. It evaluates what security tools would provide visibility into each stage of the attack. The document concludes by describing Alert Logic's integrated security model which combines infrastructure and application threat visibility, security analytics, and human experts to detect threats across cloud, hosted, and on-premises environments.

New USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever

AlienVault

AlienVault Unified Security Management™ (USM) integrates SIEM/event correlation with built-in tools for intrusion detection, asset discovery, vulnerability assessment and behavioral monitoring to give you a unified, real-time view of threats in your environment. NEW v5.0 (available 4/20) makes it faster and easier than ever to get the insights you need, starting on Day 1. Join us for a live demo to see how new USM v5.0 makes it easier than ever to accomplish these key tasks: Discover all IP-enabled assets on your network Identify vulnerabilities like unpatched software or insecure configurations Detect network scans and malware like botnets, trojans & rootkits Speed incident response with built-in remediation guidance for every alert Generate accurate compliance reports for PCI DSS, HIPAA and more

Is Your Vulnerability Management Program Keeping Pace With Risks?

Infosec 2014: Tech Talk - Non-Disruptive Vulnerability Discovery

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Infosec 2014: Tech Talk - Non-Disruptive Vulnerability Discovery

Similar to Infosec 2014: Tech Talk - Non-Disruptive Vulnerability Discovery (20)

More from Skybox Security

More from Skybox Security (20)

Recently uploaded

Recently uploaded (20)

Infosec 2014: Tech Talk - Non-Disruptive Vulnerability Discovery