Download to read offline
Uploaded byOutpost24
Outpost24 webinar: Risk-based approach to security assessments
The document presents a risk-based approach to cyber security assessments, emphasizing the need to prioritize and manage risks effectively. It discusses various vulnerabilities across infrastructure, applications, and data, advocating for a comprehensive evaluation that aligns with business objectives. The document concludes with the importance of ongoing assessments and maintaining a minimized attack surface to enhance overall security posture.
More Related Content
Similar to Outpost24 webinar: Risk-based approach to security assessments
![[Bucharest] Attack is easy, let's talk defence](https://cdn.slidesharecdn.com/ss_thumbnails/attackiseasyletstalkdefencev3-151026104559-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
Outpost24 webinar: Risk-based approach to security assessments
- 1. Putting Security inContext A risk-based approach to security assessments Bob Egner, CMO be@outpost24.com 1
- 2. 2 Helping customers improvesecurity posture since 2001 Over 2,000 customers in all regions of the world Really good at breaking technology
- 3. Today’s topic 3 Reality checkfor security Risk based approach to cyber security assessments Takeaways
- 4.
- 5.
- 6.
- 7.
- 8. 8 What is important? Whatis real? What is dangerous? Can we use this information to prioritize? Context Photo: https://news.iu.edu/stories/2018/03/iu/releases/21-joint-cyber-security-operations-center-launches.html
- 9. Reality check forsecurity
- 10. Security balance 10 Increased cyberattacks Cloud workloads Faster development cycles Mobile device proliferation More privacy rules across larger data sets Limited budget Under-staffed teams Missing skill sets Distributed IT responsibility Mismatched expectations
- 11. Align with business 11 Gapsresult from • Technical knowledge • Misunderstood objectives • Exclusion from planning • Practical view of pace • Different opinions of risk
- 12. Empower security 12 • Focuson risks that are likely to occur • Manage risks that have the greatest impact • Address risks that disrupt the business • Work on things that provide benefit Gartner: Answer three questions to move from overwhelmed to empowered, Jeffrey Wheatman, 20-Sep-2018
- 13. Security assessments driveactivity 13 Normal process • Identify what you own • Assess where it is weak • Focus on risk reduction Shift the focus away from • Latest headline • Zero-day • Easy to fix Measure and shrink the attack surface… and maintain it at the smallest level
- 14.
- 15. Full stack cybersecurity assessment Business value • increases with each layer of the stack Assessments • Made at each layer • Infrastructure can be owned (legacy) or rented (cloud) • Application security testing differs for home-built apps, externally built apps, and COTS customization • Data assessments focus on access rights • User assessments focus on behaviors Networks Applications Data User Devices Business Value
- 16. NIST Cyber SecurityFramework 16 Identify • What you own • How it supports your business • Regulatory requirements • Where it is weak • How you will remediate or compensate
- 17. Assessment Tools 17 Source: Momentum Cyber September12, 2018 Identify technical severity • Infrastructure • Cloud • Applications But not risk!
- 18. Risk calculation 18 Simple risk= f( likelihood, impact) • Not directly calculated from test result Likelihood • Combine test results with threat intelligence feed Impact • Combines business criticality with business impact Very Low (1) Low (2) Medium (3) High (4) Very High (5) Very Low (1) Low (2) Medium (3) High (4) Very High (5) Impact Likelihood
- 19. What about ? 19 Commonframework to compare vulnerabilities • Applications • Infrastructure • Data State of the art • Still somewhat blunt
- 20. What about ? 20 Commonframework to compare vulnerabilities • Applications • Infrastructure • Data State of the art • Still somewhat blunt May not reflect active exploitation Does not reflect business impact
- 21. Assessment life cycle 21 Security assessment Security Ops Business CMDB Enrichasset catalog with criticality Enrich finding with threat intel Prioritized remediation Low frequency updates • Business impact of all assets Coordinated update maps to pace of change • Recurring assessments • Risk-based prioritization • Management reporting Risk-based management reports
- 22. Assessment life cycle 22 Security assessment Security Ops Business CMDB Enrichasset catalog with criticality Enrich finding with threat intel Prioritized remediation Low frequency updates • Business impact of all assets Coordinated update maps to pace of change • Recurring assessments • Risk-based prioritization • Management reporting Benefits • Aligns with business • Objective prioritization • Common language for all stakeholders Risk-based management reports
- 23. NIST Cyber SecurityFramework 23 Risk Assessment • Testing tools • Infrastructure vulnerability assessment • Cloud security posture management • Application security testing Results typically show technical severity
- 24. Infrastructure assessments 24 Vulnerabilities eventuallyexploited • ~12.5% • Consistent with security research results Patch the regularly exploited vulnerabilities to make the biggest security improvement Gartner: Implement a risk-based approach to vulnerability management, Prateek Bhjanka, Craig Lawson, 21-Aug-2018
- 25. Cloud assessments 25 Traditional infrastructure assessment +workload analytics Container assessment + workload analytics
- 26. Application assessments 26 OWASP Top10 • Mostly ranked medium severity • Make up about 40% of all vulnerabilities • Highly application dependent • Easy to exploit and common attack for large data exfiltration OWASP risk model • www.owasp.org Risk Rating Methodology
- 27. Additional tools 27 Security analytics •Microsoft PowerBI • Elastic Stack • Splunk Risk assessment • Kenna Security Outpost24.com/blog
- 28.
- 29. 29 Takeaways Work on thethings that provide benefit • Focus on risks that are likely to occur • Manage risks that have the greatest impact • Address risks that disrupt the business Assess the full stack at a pace that matches frequency of change
- 30. Q & AThanks! Bob Egner, CMO be@outpost24.com
Editor's Notes
- #13 This simple approach can help CISOs avoid common mistakes, such as: Treating theoretical risks that are highly unlikely to occur Managing risks that would have negligible impact on business goals Addressing risks to the point that business stakeholders can’t achieve their objectives Allocating resources in the wrong way, in other words, working on things that don't provide appropriate benefit
- #16 Most security practitioners know about vulnerability assessment (looking for CVEs and misconfigured ports) - But how does that change when you delegate some trust to your cloud provider? Most security practitioners know about penetration testing - But applications are being released faster, and continue to be the richest targets for data breaches Where is your data stored, and who has access to it? Who are your users, and what systems and data do they have access to?
- #18 The cyber-security landscape continues to get more complex it’s confusing array of claims and “possible” benefits There is a lot of overlap across segments, with vendors in one segment claiming benefits from another Which results in customers feeling uncertain about what they should do, where they should spend
- #19 Impact is probably the hardest part Comes from the business Survey / interview of system owner Maybe Recovery precedence gives you clues
- #25 MS08-067 – conficker worm MS10-061 – print spooler MS14-068 – privilege escalation MS17-010 - Eternal Blue CVE-2014-6271 – Shellshock
- #26 Workloads = applications + security + data + OS
- #28 Can help you analyze, visualize