Intelligence-Led Security: Powering the Future of Cyber Defense
•
1 like•196 views
A new class of intelligence-led security is powering the future of cyber-defense, driven by deeper and broader visibility into the attacker ecosystem. This session will look at how intelligence is influencing the development of security products/services and how defenses will benefit from the integration of data from across IT/security operations with insights on the evolving threat landscape. (Source: RSA Conference USA 2017)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Intelligence-Led Security: Powering the Future of Cyber Defense
Similar to Intelligence-Led Security: Powering the Future of Cyber Defense (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Intelligence-Led Security: Powering the Future of Cyber Defense
- 1. SESSION ID:SESSION ID: #RSAC Marshall Heilman Intelligence-Led Security: Powering the Future of Cyber Defense SPO3-R03 VP, Executive Director for IR and Red Team Operations Mandiant
- 2. #RSAC Whoami 2 Exec Dir Incident Response and Red Team Operations Mandiant investigator Grief counselor ;) 10+ years at Mandiant/FireEye Former military red team operator U.S. Marine
- 3. #RSAC State of the Hack 3
- 4. #RSAC [lack of] compromise detection 4 47% INTERNAL DISCOVERY OF BREACH 53% EXTERNAL NOTIFICATION OF BREACH
- 5. #RSAC Why attackers are winning 5 146 DAYS Median days for compromise to discovery 320 days 56 days External Notification Internal Discovery 3 days Average number of days for a competent red team to gain domain administrator credentials Lets dispell with a popular myth: Networks are complicated thus an attacker couldn’t possibly understand your environment quicky
- 6. #RSAC State of the art security 6 HAD ANTI-VIRUS HAD A FIREWALL BREACH VICTIMS 100%
- 7. #RSAC Why is intelligence important? 7
- 8. #RSAC Intelligence 8 Is Actionable Contextual Timely (be the first to know!) Helpful Is Not A panacea Created equal (2% vs. 98% problem) Solely data
- 10. 10 Blurring conflict boundaries - lack of repercussion
- 11. 11 Threats are everywhere (!FUD)
- 12. #RSAC Operationalizing security is complex 12 SECURITY VENDOR MANAGEMENT DETECTION EFFICACY INCREASING COMPLEXITY OF THREATS INCREASING CONSEQUENCES RAPID EVOLUTION OF IT INCONSISTENT INTERNATIONAL POLICY $ TOO MANY ALERTS TALENT SHORTAGE
- 13. #RSAC The SOC Reality 13 Security Operations Center PEOPLE PROCESS TECHNOLOGY • Multiple roles • Lack of Business understanding • Threat and risk focus • Sourcing and retention • Operational chaos • Lack of automation • Crisis management • Communications • Expanding attack surface • Reliance on SIEM • Lack of actionable inteligence • Too many tools
- 14. #RSAC How would you detect this hot mess? 14
- 15. #RSAC What is a security professional to do? 15
- 16. #RSAC Change in mindset 16 Compromise ready environment Intelligence drives everything Alert to fix in minutes Proactive hunting
- 17. #RSAC Evaluate your security program 17 Initial Compromise Establish Foothold Escalate Privileges Internal Recon Complete Mission Move Laterally Maintain Presence • Backdoor variants • VPN subversion • Sleeper malware • Net use commands • Reverse shell access • Social engineering • External compromise • Custom malware • C2 • App exploitation • Credential theft • Password cracking • “Pass-the-hash” • Critical system recon • System, active directory & user enumeration • Staging servers • Data consolidation • Data theft Prevent INITIAL COMPROMISE ESTABLISH FOOTHOLD ESCALATE PRIVILEGES INTERNAL RECON MOVE LATERALLY X X X X Detect Respond MAINTAIN PRESENCE COMPLETE MISSION X
- 18. #RSAC Focus only on the most impactful events 18 Alarms (Thousands to Millions) Events (Many Thousands) Machine-Prioritized Events (Thousands/Hundreds) Human-Prioritized Alerts (Hundreds/Tens) Alarm Aggregation (Summarization) Event Correlation Machine-Based Event Prioritization Manual Event Prioritization
- 19. #RSAC Security built on incorrect premises… 19 SELF-PWN There is no one else to blame.
- 20. #RSAC Applying intelligence to your security program 20 Define the value of your critical assets Evaluate the actionable intelligence in your security program Evaluate your ability to prevent, detect, and respond to a threat actor
- 21. #RSAC Intelligence-led security goals 21 • Prioritize the event queue • Reduce noise • Inform the analyst • Drive operations • Expedite response and mitigation • Improve communications • Influence strategy ContextThreat Intelligence