Post-mortem of a data breach

•

1 like•1,200 views

How data breaches happen? What are their business implications? Learn more how to react when an incident does happen and how to get back to business as quickly as possible afterwards. Article URL: https://business.f-secure.com/webinar-post-mortem-of-a-data-breach

POST-MORTEMOF
ADATABREACH
Janne Kauhanen @jkauhanen
Jani Kallio @janikallionet
F-Secure Cyber Security Services

SERVICEPROVIDER”CORPX”
 Listed on several international
stock exchanges
 Provides application services,
e.g. to financial sector
 Never thought they could be
targeted – ”we’re just a regular
company”
3

SITUATIONONEMORNINGINSEPT2015
 ”7GB of data was sent from one
financial department employees PC
to IP-address xxx.xxx.xxx.xxx.”
 F-Secure Labs confirmed the address
as a known data exfiltration server,
used in a recently activated campaign
4

5
Watering
hole
Command
& Control
Data
Exfiltration
RECON

6
Watering
hole
Command
& Control
Data
Exfiltration
EXPLOITATION

7
Watering
hole
Command
& Control
Data
Exfiltration
ATTACKKIT
DELIVERY

8
Watering
hole
Command
& Control
Data
Exfiltration
LATERAL
MOVEMENT

9
Watering
hole
Command
& Control
Data
Exfiltration
DATA
COLLECTION

10
Watering
hole
Command
& Control
Data
Exfiltration
DATA
EXFILTRATION

WHATWASTHEBUSINESSIMPACT
ON”CORPX”?
11
Jani Kallio
F-Secure Cyber Security Services
Professional Services, Management Consulting

SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE
Stakeholderfocus&attention
Resourcedemand
Time
IT anomaly

Stakeholderfocus&attention
Resourcedemand
Time
IT
anomaly
Discovery, IRT-
team involved
Escalation to
MIM
Stakeholder
notification
according the
process
SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

Stakeholderfocus&attention
Resourcedemand
Time
Client’s FSA’s
information
request
Legal (external), and
internal Sec
resources tied to
find answers
A client demands
explanation;
Who, why, how,
scope, remediation?
-> KAMs try to
manage
National Data Privacy
Ombundsman requests
information
SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

Stakeholderfocus&attention
Resourcedemand
Time
COMMS department
demands info to
prepare statements in
advance
External PR
company
involved
1st forensics report:
The breach larger than
expected
SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

Stakeholderfocus&attention
Resourcedemand
Time
CEO: prepare a
statement to BoD
Escalation to the
Management Team
IRT+MIM+CMT
organization in
place
SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

Stakeholderfocus&attention
Resourcedemand
Time
Closed
accounts
hinder internal
operations
Client’s tender
process freezed
CMT decision:
To isolate a
suspected
system.
Reporting to
client’s FSA
Several units
require
instructions
from CMT
SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

Stakeholderfocus&attention
Resourcedemand
Time
Improvement
program
scoping Today
Risk
assessments
Major Security
Improvement
program
initiated
SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

 Succesfull business makes you a potential target
 This case was a textbook example
 Although prepared, the level of business disruption
came as a surprise
 You have firedrills – why not cyberdrills ?
© F-Secure Confidential
SUMMARY

SWITCH ON
FREEDOM
© F-Secure Confidential

This session provides an overview of the Dell EMC XtremIO all-flash, scale-out array and its design objectives. The architecture will be discussed and compared to other flash arrays in the market with the goal of helping the audience understand the unique architectural differentiation and highlight some new and exciting customer use cases that create business agility and demonstrate XtremIO’s transformative value. We will challenge your assumptions about storage infrastructure.

Apresentação splunk completa

Sidnir Vieira

Imagine que você precisa de uma ferramenta para consolidar logs de várias máquinas servidoras em uma só e, através de uma interface prática, analisar os problemas que vêm acontecendo relacionados com a compra de um produto em sua plataforma de e-commerce. Ou mesmo, imagine ter vários servidores Linux/Unix/Windows remotos, sendo necessário consolidar todos os logs dos ativos de TI para investigação de erros ou até ameaças de segurança. A possibilidade de investigar problemas e responder a eventos que impactam o funcionamento do seu ambiente fazem do Splunk uma plataforma de Big Data ideal para análise de toda a sua infraestrutura de TI. O Splunk é uma plataforma para BIG DATA e tem ajudado muito no Monitoramento de TI, Aplicações, Segurança & Compliance, Web Intelligence e Business Analytics, Cloud, temos s clientes como o Terra, UOL, Tivit, ALOG, GVT, Bolsa de Valores, TELEPERFORMANCE, Ticket, etc

Industroyer: biggest threat to industrial control systems since Stuxnet by An...

CODE BLUE

Industroyer is the first ever malware specifically designed to attack power grids. This unique and extremely dangerous malware framework was involved in the December 2016 blackout in Ukraine. What sets Industroyer apart from other malware targeting infrastructure, such as BlackEnergy (a.k.a. SandWorm), is its ability to control switches and circuit breakers directly via 4 different industrial communication protocols. In addition to explaining why Industroyer can be considered the biggest threat to industrial control systems since the infamous Stuxnet worm, we will take a look at the 2016 power outage in the context of the other numerous cyberattacks against Ukrainian critical infrastructure in the recent years. As the protocols and hardware targeted by Industroyer are employed in power supply infrastructure, transportation control systems, and other critical infrastructure systems, like water and gas, worldwide, the malware can be re-purposed to target vital services in other countries. This discovery should serve as a wake-up call for those responsible for security of these critical systems. Anton Cherepanov Anton Cherepanov is currently working at ESET as Senior Malware Researcher; his responsibilities include the analysis of complex threats. He has done extensive research on cyber-attacks in Ukraine. His research was presented on numerous conferences, including Virus Bulletin, CARO Workshop, PHDays, and ZeroNights. His interests focus on reverse engineering and malware analysis automation. Róbert Lipovský Róbert Lipovský is Senior Malware Researcher in ESET’s Security Research Laboratory, with 10 years’ experience with malware research. He is responsible for malware intelligence and analysis and leads the Malware Research team in ESET’s HQ in Bratislava. He is a regular speaker at security conferences, including Black Hat, Virus Bulletin, and CARO. He runs a reverse engineering course at the Slovak University of Technology, his alma mater and the Comenius University. When not bound to a keyboard, he enjoys sports, playing guitar and flying an airplane.

Cloud Computing for Business - The Road to IT-as-a-Service

James Urquhart

This document discusses the transition from infrastructure-centric IT operations to service-centric operations driven by cloud computing. It explains that cloud computing asks IT to deliver computing resources as a set of services rather than managing individual servers, networks, and storage. This new model of service operations is comprised of application operations, service operations, and infrastructure operations. Application operations focus on consuming services through tools like multi-cloud management. Service operations identify and deliver key services with supporting capabilities. Infrastructure operations provide the common foundation through APIs and automation.

OFFICE 365 SECURITY

Sylvain Martinez

Splunk for IT Operations Breakout Session

Splunk

This document discusses how Splunk provides new visibility and analytics for IT operations. It notes that IT environments are becoming increasingly complex with more servers, applications, virtualization, and cloud services. Splunk offers a platform for operational intelligence that can consolidate machine data from various sources and provide search, monitoring, and analytics capabilities. It also discusses how Splunk apps can provide deep insights into specific technology areas.

Splunk Webinar Best Practices für Incident Investigation

Georg Knon

The document discusses best practices for incident investigation using Splunk, including collecting data from various sources like network traffic, endpoints, user activity, and threat intelligence. Effective investigation requires visibility into who and what communicated on the network, running processes, file system changes, and privileged access on endpoints. The goal is to quickly scope infections and disrupt breaches by understanding attack intent, lateral movement, and exfiltration through correlation of different data sources.

Ransomware, trojans, and keyloggers are increasingly targeting SMBs—and traditional, reactive security solutions are not cutting it. Malware not only puts your customers at risk but also hurts your bottom line through hours wasted cleaning up infected machines. But how do you protect customers that may not understand the risks or the value of layered security? The answer lies in leveraging increased visibility and value reporting to improve your bottom line and become your customer's virtual CIO and CISO. Join OpenDNS Sr. Product Manager Dima Kumets and guest speaker Jim Lancaster of MSPmentor 100 company Sagiss to learn about: -Combining protection and containment to lower costs -Improving renewal rates through value reporting -Leveraging OpenDNS's new integration with ConnectWise to be the Virtual CIO -Monitoring real-time network activity as a sellable service

Splunk Enterpise for Information Security Hands-On

Splunk

Splunk is the ultimate tool for the InfoSec hunter. In this unique session, we’ll dive straight into the Splunk search interface, and interact with wire data harvested from various interesting and hostile environments, as well as some web access logs. We’ll show how you can use Splunk Enterprise with a few free Splunk applications to hunt for attack patterns. We’ll also demonstrate some ways to add context to your data in order to reduce false positives and more quickly respond to information. Bring your laptop – you’ll need a web browser to access our demo systems!

Webinar - Order out of Chaos: Avoiding the Migration Migraine

Peak Hosting

When your business has outgrown your current managed hosting provider, the logical thing is to search for something better. Change can be difficult and chaotic, but it doesn’t have to be. This webinar focuses on best practices for making your migration from the cloud as pain free as possible, including a discussion on what you need to know and ask of your migration provider to ensure it goes smoothly. As an example of this, we will outline Peak Hosting’s migration process, as well as discuss one of our customer migrations and why they chose to undertake it.

CQRS and Event Sourcing: A DevOps perspective

Maria Gomez

This document discusses challenges of deploying, monitoring, and debugging systems using CQRS and event sourcing from a DevOps perspective. It describes using a blue/green deployment approach, implementing consistent and usable logging, monitoring key metrics and data streams, and employing distributed tracing to identify the origin of requests in order to quickly debug problems. The overall goal is to build scalable, resilient, and automated systems while facilitating operational tasks through iterative improvements to tools and processes.

Developing a successful big data business strategy

Sebastian Darrington

The document discusses developing a successful big data business strategy. It describes organizations moving towards more data, real-time operations, analytics insights, and personalization. It also outlines a maturity model for how organizations integrate data and analytics into their business models. Finally, it discusses challenges such as selecting the wrong use cases, management resistance, and lack of skills that can cause big data projects to fail.

Hands-On Security Breakout Session- Disrupting the Kill Chain

Splunk

Splunk software allows security teams to collect, store, and analyze machine data from various sources to detect threats across the cyber kill chain. This includes reconnaissance, exploitation, and actions on objectives. The presentation demonstrates how to use Splunk to investigate a security incident involving a compromised system communicating with a botnet. The investigation leverages threat intelligence, endpoint data, and process information to trace the adversary's activities, confirm malicious behavior, and work towards a root cause.

All Apps Are Not Created Equal

ServerCentral

The document discusses business continuity and disaster recovery strategies for applications. It notes that many small and medium businesses lack recovery plans for outages or data loss. Downtime costs businesses on average over $800,000 per event. The document evaluates recovery point objectives and recommended solutions for various common applications like email, file servers, CRM systems. It outlines key questions to consider regarding backup, replication and disaster recovery as a service options to build business resilience.

Hands-On Security Breakout Session- Disrupting the Kill Chain

Splunk

This document summarizes a security investigation using Splunk software to disrupt the cyber kill chain. The investigation began by detecting threat intelligence related events across multiple data sources for a specific IP address. Further investigation revealed DNS queries, proxy activity, and suspicious processes on an endpoint. Pivoting to the endpoint data identified a Zeus malware process communicating outbound. Working backwards through process lineage identified an exploited vulnerable application and a weaponized PDF file delivered via email phishing. A search of web logs found the file was obtained from a website via a brute force attack. The root cause was determined to be a targeted spear phishing email containing an exploit.

Hands-On Security Breakout Session- Disrupting the Kill Chain

Splunk

The document discusses a security investigation demo using Splunk software to disrupt the cyber kill chain. It begins with detecting threat intelligence related events across multiple data sources for a specific IP address. Further investigation using endpoint data from Microsoft Sysmon reveals network connections and process information. This traces the suspicious activity back through parent processes to identify a vulnerable PDF reader application exploited by opening a weaponized file delivered via email phishing. Additional context from web logs shows the file was obtained through a brute force attack on the company's website. The investigation is then able to connect events across various data sources to fully map out the adversary's actions.

Workstream Hosting Service Overview

webhostingguy

Workstream provides a secure hosting service for their HR applications that is compliant with SOX and SAS70 standards. Their service includes daily backups, firewall protection, redundant servers and networks, and a business continuity plan through SunGard that allows rapid recovery in the event of a disaster. Customers benefit from Workstream managing all the security, maintenance, and infrastructure needs so they do not have to acquire or run their own systems.

Splunk for Security Workshop

Splunk

The document discusses disrupting cyber attacks using Splunk software. It provides an overview of Splunk's security capabilities such as monitoring known and unknown threats, security investigations, and fraud detection. It then demonstrates how to investigate a hypothetical security incident at a company called Buttercup Games. The investigation uses Splunk to trace an attack from initial website exploitation and phishing email through endpoint infection back to the root cause of a user opening a weaponized PDF file. The investigation illustrates how Splunk can disrupt the cyber kill chain by connecting threat indicators from multiple data sources to rapidly uncover attack details and attributes.

Splunk for Security - Hands-On

Splunk

Join our Security Expert and learn how to use the Splunk App for Enterprise Security (ES) in a live, hands-on session. We'll take a tour through Splunk's award-winning security offering to understand some of the unique capabilities in the product. Then, we'll use ES to work an incident and disrupt an adversary's Kill Chain by finding the Actions on Intent, Exploitation Methods, and Reconnaissance Tactics used against a simulated organization. Data investigated will include threat list intelligence feeds, endpoint activity logs, e-mail logs, and web access logs. This session is a must for all security experts! Please bring your laptop as this is a hands-on session.

Supporting Enterprise System Rollouts with Splunk

Erin Sweeney

At Cricket Communications, Splunk started as a way to correlate all of our data into one view to help our operations team keep processes humming. Then we gave secured access to our developers, now they’re addicted. In fact, Splunk is critical in helping us speedup deployment of new systems (like our recent multi-million dollar billing system implementation). Learn how we use Splunk to display key metrics for the business, track overall system health, track transactions, optimize license usage, and support capacity planning.

FullDay Faeder on Friday

Adam Faeder

FullDay on Fridays Feb. 3, 2017

Adam Faeder

Splunk conf2014 - Getting Deeper Insights into your Virtualization and Storag...

Splunk

Virtualization and storage technologies go hand-in-hand. If performing poorly, they can have a serious impact on your applications' performance and users' experience. This presentation shows how Splunk can help you get unified visibility into your VMware environment and NetApp storage systems. Learn how to utilize Splunk Enterprise to correlate storage machine data with virtualization, operating systems and data from technology tiers for quicker time to resolution, optimal performance planning and unified view of KPIs across your entire enterprise.

Advancing Open Software Defined Storage

Red_Hat_Storage

Importance of software-defined storage Agile enterprises run on agile storage What’s new in Red Hat Storage Server 3 • Petabyte scale capacity • Enhanced data protection • Advanced monitoring and logging In this event, you'll learn how Red Hat Storage Server 3 enables: • Unlimited scalability for maximum business agility. • Data security where you need it – on-premise or in the cloud. • Elastic capacity and performance to best align to shifting demands • Business insights through in-place analytics for Hadoop workloads.

2019 Performance Monitoring and Management Trends and Insights

OpsRamp

Join 451 Research's Senior Analyst Nancy Gohring and OpsRamp's Vice President of Marketing Darren Cunningham as they discuss the latest trends in IT monitoring and management. This interactive webinar will review the latest research and feature a live Q&A on what's hot, what's new, and what's next in this dynamic and distributed market. Sponsored by OpsRamp, this webinar will also provide an overview of OpsRamp's service-centric AIOps platform and how OpsRamp customers are controlling the chaos with a new approach to IT operations as a service. To learn more, visit https://www.opsramp.com/about-opsramp... Also, follow us on social media channels to learn about product highlights, news, announcements, events, conferences and more - Twitter - https://www.twitter.com/OpsRamp LinkedIn - https://www.linkedin.com/company/opsramp Facebook - https://www.facebook.com/OpsRampHQ/

Hands on Security - Disrupting the Kill Chain Breakout Session

Splunk

The document discusses a security investigation using Splunk software to trace a cyber attack across multiple data sources. The investigation began by identifying communications from an internal IP address to known threats. Examining endpoint data revealed a suspicious svchost.exe process communicating outbound, which was traced back through parent processes to a vulnerable PDF reader opened by an employee. Web logs showed the attacker gained access to a sensitive file via a brute force attack on the company website. By connecting activities across threat intelligence, endpoint, email, web and other sources, the root cause was determined to be a targeted spear phishing email containing a weaponized PDF file.

Openshift v3-a-revolucao-dos-containers-3

Ricardo Martinelli de Oliveira

OpenShift V3 is a container-based platform that uses Docker and Kubernetes to deploy and manage containers. It allows for various deployment types including rolling deployments and blue-green deployments. OpenShift V3 provides a number of services for developing, deploying and managing applications, and integrates with DevOps practices like CI/CD. It utilizes containerization, microservices and a PaaS model to provide a way for organizations to build and run scalable applications.

How do you predict the threat landscape?

F-Secure Corporation

Got hacked? It’s too late to run now!

F-Secure Corporation

Online Threats and Malware Trends in India 2012-2014. Summary: - The top malware infection in India is still Botnet related. - Hackers own your PC’s and use them for spamming, DDOS or other malicious activity to make money. - Banking related malware has been consistently topping the chart in India. - Ramnit malware steals bank user names and passwords. - The malware spreads through USB removable drives. - PC’s in India are moving away from Windows XP. - We have also observed the decline in Downadup/Conficker infection over the past 3 years in India.

Best business protection for windows

F-Secure Corporation

Six things to take into account when choosing cloud solutions

F-Secure Corporation

The document discusses the benefits of cloud computing for businesses. Key benefits include paying for cloud services through operational expenditures (Opex) rather than capital expenditures (Capex), which provides more flexibility and lower upfront costs. Additionally, cloud services allow data to be securely stored in virtual locations in datacenters and accessed from anywhere, rather than requiring expensive on-site data storage. The document also outlines best practices for securely using cloud services, such as implementing basic security measures and policies, carefully choosing cloud solutions based on needs and risks, and ensuring proper protection, management and flexibility.

Small and midsize business security is big business

F-Secure Corporation

Small and midsize companies (<250 employees) drive global economy, accounting for 99% of all global enterprises and two thirds of employment. There are currently over 203 million SMBs worldwide. It’s a business with a huge potential. Digital attacks targeted at the smaller end of business are also on the rise, and the need for small business protection s is imminent. Largely under- or unprotected, they are the digital villain’s dream. Together with our partner network, F-Secure stands in the vanguard and leads the front to safe business and business confidentiality.

大きなビジネスを生み出す中小中堅企業

F-Secure Corporation

Why should you care about government surveillance?

F-Secure Corporation

Arbeta var du vill- eBook om modern mobilitet

F-Secure Corporation

Digitaliseringens påverkan gör att vårt sätt att arbeta genomgår en förändring. Det som en gång var en värld av kontorsmoduler och stationära datorer, är nu ett nätverk av mobila enheter – smartphones, surfplattor och laptops. I takt med att privat- och yrkesliv i allt större takt flyter ihop, kommer det bara att återstå en tunn suddig skiljelinje mellan yrkesroll och konsument. Anställda i små och medelstora företag använder samma enheter både privat som i jobbet. Jobbet är en aktivitet, och inte en plats man går till. Oberoende av plats, och inte längre begränsat till kontoret, kommer arbetsplatsen att omfatta kundbesök, caféer, seminarier, flygplan, hotell och sträcka sig utanför den traditionella kontorstiden. Vi går från 9–5 till en 24/7-kultur. Att möjliggöra flexibla arbetssätt är ett fundament för det moderna affärslivet. Den nya världen för med sig både nya möjligheter och hot. När företaget sprider ut sig över världen och nås från massor av olika enheter från en ständigt föränderlig arbetsstyrka, exponeras företagens information för en allt större mängd hot så som digileaks, nätfiske, datastöld, förstörelse och bedrägerier. Vidtar du det nödvändiga säkerhetsåtgärderna för att hålla ditt företag säkert?

Psb mobile security

F-Secure Corporation

F-Secure Mobile Security provides protection for Android devices from viruses, spyware, theft and fraudulent websites. It allows remote locking, wiping and locating of devices as well as filtering of unwanted calls and messages. F-Secure received an award from AV-TEST for their excellent performance in Android mobile antivirus tests. The solution allows centralized management of security across devices through one portal.

More from F-Secure Corporation (20)

How do you predict the threat landscape?

Got hacked? It’s too late to run now!

The Real Costs of SIEM vs. Managed Security Service

Security A to Z: Glossary of the most important terms

Les attaques menées depuis la France dans le cyber espace

Cyber security webinar 6 - How to build systems that resist attacks?

Defending Servers - Cyber security webinar part 3

Defending Workstations - Cyber security webinar part 2

Cyber security webinar part 1 - Threat Landscape

F secure Radar vulnerability scanning and management

F-Secure Policy Manager - onsite security management with superior control

The State of the Net in India

Best business protection for windows

Six things to take into account when choosing cloud solutions

Small and midsize business security is big business

大きなビジネスを生み出す中小中堅企業

Why should you care about government surveillance?

Arbeta var du vill- eBook om modern mobilitet

Psb mobile security

Recently uploaded

J-Spring 2024 - Going serverless with Quarkus, GraalVM native images and AWS ...

Bert Jan Schrijver

SQL Accounting Software Brochure Malaysia

GohKiangHock

Using Query Store in Azure PostgreSQL to Understand Query Performance

Grant Fritchey

UI5con 2024 - Bring Your Own Design System

Peter Muessig

How do you combine the OpenUI5/SAPUI5 programming model with a design system that makes its controls available as Web Components? Since OpenUI5/SAPUI5 1.120, the framework supports the integration of any Web Components. This makes it possible, for example, to natively embed own Web Components of your design system which are created with Stencil. The integration embeds the Web Components in a way that they can be used naturally in XMLViews, like with standard UI5 controls, and can be bound with data binding. Learn how you can also make use of the Web Components base class in OpenUI5/SAPUI5 to also integrate your Web Components and get inspired by the solution to generate a custom UI5 library providing the Web Components control wrappers for the native ones.

How Can Hiring A Mobile App Development Company Help Your Business Grow?

ToXSL Technologies

GreenCode-A-VSCode-Plugin--Dario-Jurisic

Green Software Development

Oracle Database 19c New Features for DBAs and Developers.pptx

Remote DBA Services

Modelling Up - DDDEurope 2024 - Amsterdam

Alberto Brandolini

Fundamentals of Programming and Language Processors

Rakesh Kumar R

8 Best Automated Android App Testing Tool and Framework in 2024.pdf

kalichargn70th171

Project Management: The Role of Project Dashboards.pdf

Karya Keeper

Project management is a crucial aspect of any organization, ensuring that projects are completed efficiently and effectively. One of the key tools used in project management is the project dashboard, which provides a comprehensive view of project progress and performance. In this article, we will explore the role of project dashboards in project management, highlighting their key features and benefits.

Measures in SQL (SIGMOD 2024, Santiago, Chile)

Julian Hyde

SQL has attained widespread adoption, but Business Intelligence tools still use their own higher level languages based upon a multidimensional paradigm. Composable calculations are what is missing from SQL, and we propose a new kind of column, called a measure, that attaches a calculation to a table. Like regular tables, tables with measures are composable and closed when used in queries. SQL-with-measures has the power, conciseness and reusability of multidimensional languages but retains SQL semantics. Measure invocations can be expanded in place to simple, clear SQL. To define the evaluation semantics for measures, we introduce context-sensitive expressions (a way to evaluate multidimensional expressions that is consistent with existing SQL semantics), a concept called evaluation context, and several operations for setting and modifying the evaluation context. A talk at SIGMOD, June 9–15, 2024, Santiago, Chile Authors: Julian Hyde (Google) and John Fremlin (Google) https://doi.org/10.1145/3626246.3653374

Mobile App Development Company In Noida | Drona Infotech

Drona Infotech

All you need to know about Spring Boot and GraalVM

Alina Yurenko

Energy consumption of Database Management - Florina Jonuzi

Green Software Development

Microservice Teams - How the cloud changes the way we work

Sven Peters

A lot of technical challenges and complexity come with building a cloud-native and distributed architecture. The way we develop backend software has fundamentally changed in the last ten years. Managing a microservices architecture demands a lot of us to ensure observability and operational resiliency. But did you also change the way you run your development teams? Sven will talk about Atlassian’s journey from a monolith to a multi-tenanted architecture and how it affected the way the engineering teams work. You will learn how we shifted to service ownership, moved to more autonomous teams (and its challenges), and established platform and enablement teams.

Artificia Intellicence and XPath Extension Functions

Octavian Nadolu

What next after learning python programming basics

Rakesh Kumar R

一比一原版(USF毕业证)旧金山大学毕业证如何办理

dakas1

USF硕士毕业证成绩单【微信95270640】一比一伪造旧金山大学文凭@假冒USF毕业证成绩单+Q微信95270640办理USF学位证书@仿造USF毕业文凭证书@购买旧金山大学毕业证成绩单USF真实使馆认证/真实留信认证回国人员证明 #一整套旧金山大学文凭证件办理#—包含旧金山大学旧金山大学本科毕业证成绩单学历认证|使馆认证|归国人员证明|教育部认证|留信网认证永远存档教育部学历学位认证查询办理国外文凭国外学历学位认证#我们提供全套办理服务。一整套留学文凭证件服务：一：旧金山大学旧金山大学本科毕业证成绩单毕业证 #成绩单等全套材料从防伪到印刷水印底纹到钢印烫金二：真实使馆认证（留学人员回国证明）使馆存档三：真实教育部认证教育部存档教育部留服网站永久可查四：留信认证留学生信息网站永久可查国外毕业证学位证成绩单办理方法： 1客户提供办理旧金山大学旧金山大学本科毕业证成绩单信息：姓名生日专业学位毕业时间等（如信息不确定可以咨询顾问：我们有专业老师帮你查询）； 2开始安排制作毕业证成绩单电子图； 3毕业证成绩单电子版做好以后发送给您确认； 4毕业证成绩单电子版您确认信息无误之后安排制作成品； 5成品做好拍照或者视频给您确认； 6快递给客户（国内顺丰国外DHLUPS等快读邮寄）。教育部文凭学历认证认证的用途：如果您计划在国内发展那么办理国内教育部认证是必不可少的。事业性用人单位如银行国企公务员在您应聘时都会需要您提供这个认证。其他私营 #外企企业无需提供！办理教育部认证所需资料众多且烦琐所有材料您都必须提供原件我们凭借丰富的经验帮您快速整合材料让您少走弯路。实体公司专业为您服务如有需要请联系我: 微信95270640奈一次次令他失望山娃今年岁上五年级识得很多字从走出小屋开始山娃就知道父亲的家和工地共有一个很动听的名字——天河工地的底层空空荡荡很宽阔很凉爽在地上铺上报纸和水泥袋父亲和工人们中午全睡在地上地面坑坑洼洼山娃曾多次绊倒过也曾有长铁钉穿透凉鞋刺在脚板上但山娃不怕工地上也常有五六个从乡下来的小学生他们的父母亲也是高楼上的建筑工人小伙伴来自不同省份都操着带有浓重口音的普通话可不知为啥山娃不仅很快与他们熟识了

Liberarsi dai framework con i Web Component.pptx

Massimo Artizzu

In Italian Presentazione sulle feature e l'utilizzo dei Web Component nell sviluppo di pagine e applicazioni web. Racconto delle ragioni storiche dell'avvento dei Web Component. Evidenziazione dei vantaggi e delle sfide poste, indicazione delle best practices, con particolare accento sulla possibilità di usare web component per facilitare la migrazione delle proprie applicazioni verso nuovi stack tecnologici.

Recently uploaded (20)

J-Spring 2024 - Going serverless with Quarkus, GraalVM native images and AWS ...

SQL Accounting Software Brochure Malaysia

Using Query Store in Azure PostgreSQL to Understand Query Performance

UI5con 2024 - Bring Your Own Design System

How Can Hiring A Mobile App Development Company Help Your Business Grow?

GreenCode-A-VSCode-Plugin--Dario-Jurisic

Oracle Database 19c New Features for DBAs and Developers.pptx

Modelling Up - DDDEurope 2024 - Amsterdam

Fundamentals of Programming and Language Processors

8 Best Automated Android App Testing Tool and Framework in 2024.pdf

Project Management: The Role of Project Dashboards.pdf

Measures in SQL (SIGMOD 2024, Santiago, Chile)

Mobile App Development Company In Noida | Drona Infotech

All you need to know about Spring Boot and GraalVM

Energy consumption of Database Management - Florina Jonuzi

Microservice Teams - How the cloud changes the way we work

Artificia Intellicence and XPath Extension Functions

What next after learning python programming basics

一比一原版(USF毕业证)旧金山大学毕业证如何办理

Liberarsi dai framework con i Web Component.pptx

Post-mortem of a data breach

1. POST-MORTEMOF ADATABREACH Janne Kauhanen @jkauhanen Jani Kallio @janikallionet F-Secure Cyber Security Services

2. 2 100+ASSIGNMENTS/ 3YEARS

3. SERVICEPROVIDER”CORPX”  Listed on several international stock exchanges  Provides application services, e.g. to financial sector  Never thought they could be targeted – ”we’re just a regular company” 3

4. SITUATIONONEMORNINGINSEPT2015  ”7GB of data was sent from one financial department employees PC to IP-address xxx.xxx.xxx.xxx.”  F-Secure Labs confirmed the address as a known data exfiltration server, used in a recently activated campaign 4

5. 5 Watering hole Command & Control Data Exfiltration RECON

6. 6 Watering hole Command & Control Data Exfiltration EXPLOITATION

7. 7 Watering hole Command & Control Data Exfiltration ATTACKKIT DELIVERY

8. 8 Watering hole Command & Control Data Exfiltration LATERAL MOVEMENT

9. 9 Watering hole Command & Control Data Exfiltration DATA COLLECTION

10. 10 Watering hole Command & Control Data Exfiltration DATA EXFILTRATION

11. WHATWASTHEBUSINESSIMPACT ON”CORPX”? 11 Jani Kallio F-Secure Cyber Security Services Professional Services, Management Consulting

12. SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE Stakeholderfocus&attention Resourcedemand Discovery Long-term implications - Loss of revenue - Stock price effect - Brand & Reputation damage - Regulatory fines - Contractual fines - Costs incurred in remediation - 3rd party legal liability Incident Response - IT Forensics - Legal & Regulatory review External areas - Public Relations - Notification management - Stakeholder Communication - Remedial Service Provision Time Short-term implications - Loss of efficiency & delivery - Internal reporting mayhem - Management’s focus on incident, not on business - Costs incurred in response - Customer interface overload

13. SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE Stakeholderfocus&attention Resourcedemand Time IT anomaly

14. Stakeholderfocus&attention Resourcedemand Time IT anomaly Discovery, IRT- team involved Escalation to MIM Stakeholder notification according the process SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

15. Stakeholderfocus&attention Resourcedemand Time Client’s FSA’s information request Legal (external), and internal Sec resources tied to find answers A client demands explanation; Who, why, how, scope, remediation? -> KAMs try to manage National Data Privacy Ombundsman requests information SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

16. Stakeholderfocus&attention Resourcedemand Time COMMS department demands info to prepare statements in advance External PR company involved 1st forensics report: The breach larger than expected SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

17. Stakeholderfocus&attention Resourcedemand Time CEO: prepare a statement to BoD Escalation to the Management Team IRT+MIM+CMT organization in place SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

18. Stakeholderfocus&attention Resourcedemand Time Closed accounts hinder internal operations Client’s tender process freezed CMT decision: To isolate a suspected system. Reporting to client’s FSA Several units require instructions from CMT SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

19. Stakeholderfocus&attention Resourcedemand Time Improvement program scoping Today Risk assessments Major Security Improvement program initiated SIMPLIFIEDCYBERBREACH’SBUSINESSIMPACT TIMELINE

20.  Succesfull business makes you a potential target  This case was a textbook example  Although prepared, the level of business disruption came as a surprise  You have firedrills – why not cyberdrills ? © F-Secure Confidential SUMMARY

Post-mortem of a data breach

Recommended

Recommended

More Related Content

Similar to Post-mortem of a data breach

Similar to Post-mortem of a data breach (20)

More from F-Secure Corporation

More from F-Secure Corporation (20)

Recently uploaded

Recently uploaded (20)

Post-mortem of a data breach