Designed largely for management, this presentation discusses common vulnerabilities, cyber security attack trends, and how to hamper, thwart and contain malicious attacks. Included is data from the latest vulnerability trend research, cyber security threat data, and a variety of methods for staying safe, detecting a compromise, and handling a compromise. The goal of this presentation is to give management information and help "start a conversation" within small businesses between management and IT staff to ensure the security of organization data.

1. Daniel Owens
How to Hamper, Thwart,
and Contain a
Malicious Attack
Through Best Practices
Private Founder’s Webinar
IT Security Specialist

2. 2
✧ Vulnerability Trends
✧ Common Attacks and Trends
✧ Detecting and Handling Intrusions
Agenda
Legal Disclaimer: This information is for educational
purposes only & not intended to detail all
requirements, vulnerabilities, and security measures
necessary.

3. 3
Vulnerability Trends

4. COTS Vulnerability Trends
Source: VulDB

5. COTS Vulnerability Trends
Source: VulDB

6. COTS Vulnerability Trends
Source: CYTENNA

7. OWASP Top Ten of 2017
Source: OWASP

8. Other Related Resources
1. MITRE Common Weakness
Enumeration (CWE)
a. SANS/MITRE Top 25 Most
Dangerous Software Errors
2. MITRE Common Vulnerabilities and
Exposures (CVE)
3. National Institute of Standards and
Technology (NIST) National
Vulnerability Database (NVD)
4. Security Focus
5. VulDB

9. Attack Trends

10. Email Attack Trends
Source: SymantecSource: Symantec

11. Source: Symantec

12. Source: Symantec

14. Email Attack Trends
Source: SymantecSource: Symantec

15. Email Attack Trends
Source: SymantecSource: Symantec

16. Remote Attack Trends
Source: SymantecSource: Symantec

17. Malware Trends
Source: SymantecSource: Symantec

18. Other Related Resources
1. Symantec Monthly Threat Report
2. Symantec Internet Security Threat
Report (ISTR)
3. McAfee Labs Threats Reports
4. Microsoft Security Intelligence Report
5. Cisco Cybersecurity Reports
6. Akamai State of the Internet Report
7. WatchGuard Technology Internet
Security Insights

19. Detecting and Handling
Incidents

20. 8 Keys to (Hampering and) Detecting an Incident
(in no particular order)
● Anti-malware software
○ On all workstations, servers, and mobile devices
● Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
○ In front of each network segment, at a minimum
● Firewalls
○ On all workstations, servers, and in front of each network segment
○ Must be “default-deny”
○ Stateful packet inspection (SPI) is important
● Proper logging
○ On all systems (e.g. mobile devices, network devices, servers, workstations)
○ Ensure logs are reviewed daily
○ Important systems should have weekly and monthly log reports
● Proper events notifications
○ On all systems (e.g. mobile devices, network devices, servers, workstations)
○ Alert staff when there is something important, only or something that might indicate an attack
or compromise
● Vulnerability scanners
○ Run against everything at least monthly
● Third party audits and penetration tests
○ Performed at least annually
● Educating all users

21. Signs of a Compromise
● Ransom notes
○ In your email
○ In documents on the computer
○ In popups on the computer or on boot
● Slow computer or network
○ Especially if it seems like the computer is doing a lot of work, even when it shouldn’t be
● Odd popups from your antimalware
○ Especially if it starts saying that malware is found or that the antimalware solution keeps
getting turned off
● Mouse moves on its own
● Things are typed that you aren’t typing
● Screen blinks
● Screen flips
● Unexpected software is installed on your computer
● Your friends/coworkers/family say that you are sending them spam
● You are called by your ISP about recent malicious activity coming from your network
● Passwords aren’t working or are changed
● Random popups appear on your computer
● Your default/home changes on your browsers (or other browser preferences change)
● Web searches or requests are redirected
○ Especially if to odd sites

22. What to do When Compromised
Isolate
Isolate the affected
system from
everything else,
disconnecting it from
the network
Image
If desired take a
snapshot of the
system, its volatile
memory, and then
shutdown and “image”
(make a copy of) the
harddrive
Investigate
Examine the newly
created “images” to
see:
1. What
2. When
3. How
4. Where
5. Why
6. Who
You may even find that
your backups are
infected.
Online
Bring the system back
online and monitor it
and similar systems
carefully to ensure that
it isn’t reinfected.
Also, change all
passwords that may
have been stored on
the system
Rebuild
Using the last known
good backups, restore
the system. If the
compromise was
because of a
vulnerability, fix or
mitigate the
vulnerability.

23. Additional Resources
1. Center for Internet Security (CIS) benchmarks,
controls, and best practises
2. National Institute for Standards and Technology
(NIST) IT security publications
3. Information Assurance Support Environment’s
(IASE) Defense Information Systems Agency
(DISA) Security Technical Implementation Guides
(STIG)
4. National Security Agency (NSA) IT security
publications
5. Microsoft’s Security Guidance Blog

24. Questions?