Powering Prevention: Lessons Learned from Building a Global Security Response Team
•
1 like•1,126 views
The document discusses lessons learned from building a global security response team. It emphasizes stakeholder engagement, strategic hiring to acquire key skills and expertise, prioritizing mission and culture over metrics, using communication and collaboration tools to reduce duplication and expand coverage, balancing research and operational response, and maximizing automation. The team identified 250 million+ attacks, helped over 31,000 customers, conducted over 10,000 engagements, and identified more than 600 threats in under 12 months.
Recommended
More Related Content
What's hot
What's hot (13)
Viewers also liked
Viewers also liked (10)
Similar to Powering Prevention: Lessons Learned from Building a Global Security Response Team
Similar to Powering Prevention: Lessons Learned from Building a Global Security Response Team (20)
Recently uploaded
Recently uploaded (20)
Powering Prevention: Lessons Learned from Building a Global Security Response Team
- 1. Powering Prevention Lessons Learned from Building a Global Security Response Team Christopher Clark – Director, GSRT
- 2. Powering Prevention Lessons Learned from Building a Global Security Response Team Christopher Clark – Director, GSRT
- 3. Many Brilliant People, Many Small Silos Rapid organic growth in products and customers Effort duplication, inconsistencies, and internal focus
- 4. Connect the dots and deliver holistic prevention Proactively detect and respond to threat evolutions Develop countermeasures, reporting, and technical solutions
- 5. Faster, Better, and Globally Impactful Define Mission, Build Processes, Hire Team and Internalize Response in <12 months 250m+ Attacks, 31k+ Customers, 10k+ Engagements, 600+ Threats Identified
- 6. Agenda Building a Global Security Response Team Stakeholder Empowerment Strategic Hiring Mission over Metrics Communication & Collaboration
- 9. Proactively Engage Everyone Seek out, Sit down (in person), and LISTEN Understand the current reality and pain points Access stakeholder resources and capabilities Plan for unknown unknowns (then double it!)
- 10. Education is the MOST important job Skip the details, tell the story Be a trusted resource and teach up, down, left and right
- 11. Know the “NO” Monster Leverage expertise to prioritize security resource expenditure Identify fires before they start and protect the team
- 12. Strategic Hiring
- 13. Strategic Talent Capture Start at the core and identify key functional areas Acquire and empower proven leaders
- 14. Functional Teams with Matrixed Deliverables 88 Vulnerability and Exploit Unit Provide Actionable Vulnerability and Exploit Intelligence. Coverage for delivery Methods and Hack / Post Exploitation tools. Tools and Technology Develop and Enhance Collection, Analysis, and Detection Capabilities, as well as DevOps support for existing tools. Threat Analysis Unit First line of triage, Conducting Analysis of Adversaries, Campaigns, and TTPs Malware and Countermeasures Unit Provide Actionable Malcode Analysis and Deployable Countermeasures
- 15. Security Operations Malware Analysis Scripting and Development Penetration Testing Identify and Ensure Critical Skillsets Improved communication and operational efficacy Eliminate single points of failure Career progression and cross training
- 16. Team Member Critical Skillset Continuum Threat Researcher Security Operations 80 % Malware Analysis 50 % Scripting & Development 40 % Malware Researcher Vulnerability and Exploit Researcher Automation Engineer Penetration Testing 40 % Security Operations 40 % Malware Analysis 80 % Scripting & Development 40 % Penetration Testing 20 % Security Operations 50 % Malware Analysis 40 % Scripting & Development 40 % Penetration Testing 80 % Security Operations 30 % Malware Analysis 30 % Scripting & Development 90 % Penetration Testing 30 %
- 17. Regional Threat Expertise Cultural and Linguistic Knowledge Improved Response Speed and Quality
- 19. Metrics are an indicator, not the goal Progress is achieved through failure Culture is the key
- 20. PASSION: believe in the mission and what you can do
- 21. CAPACITY: learn. share. ask for help
- 22. INNOVATION: rules are a finite construct
- 23. AGILITY: change is constant, be multi-disciplinary
- 24. HUMILITY: ego-less execution - Bryson Bort, CEO
- 26. Great Communication is required for Great Security “Remote by default” ensures expansion, flexibility, and data retention Trust is formed in person and grows through transparency
- 27. Remove (or Connect) Data and Operational Silos Normalize processes and remove effort duplication Transparent and accessible data and deliverables
- 28. Vertical and Horizontal Status Reports Deliver regular status reports on both research and response goals Ensure broad delivery to all team members and stakeholders
- 30. Encourage Research and Response from All Diversity of experience drives new approaches Innovation is born from operations
- 31. Research and Response Mix 80% 20% Response Research 60% 40% Response Research 40% 60% Response Research 20% 80% Response Research Junior Researcher Researcher Senior Researcher Principal Researcher
- 32. Response must be efficient, Research must be impactful Publications (Reports or Code), Presentations, or Products
- 33. Security Innovation is Distilled Threat Intelligence Prevention is driven by heuristics refined through research Targeted research is made possible by intelligent response
- 35. Automation is critical to efficacy and scale POC by researchers, maturation and upkeep by automation engineers “Do it three times? Automate it!”
- 36. Enable and Liberate Researchers Centralize response tool stack and maximize data density Ensure complete auditable transparency
- 37. Develop Integrations and Orchestration Connecting existing detection, analysis, workflow and collaboration platforms
- 38. Powering Prevention - Review Building a Global Security Response Team Stakeholder Enablement Actively engage with all stakeholders, understand their needs. Educate non-security teams, and protect your resources. Strategic Hiring Identify required talent and proactively recruit it. Ensure all team members possess key skills. Mission Over Metrics Culture is the most important part of the team, never compromise on fit and ensure Metrics are a guide not a target. Communication & Collaboration Leverage technology to expand coverage, improve efficacy, and reduce effort duplication. Research & Response Ensure staff is focused on short and long term research projects as well as operational triage. Automation! Dedicate resources to automating processes and tools once they have been proven.
Editor's Notes
- WORDS ABOUT SILOS AND PANW BEFORE GSRT, multiple orgs/groups/tools and support/sales teams etc.
- Destilled version of Mission (will relate similarities to all CIRTS (product/state/fortune500) Global Security Response Team Mission: Serve as the frontline for PANW customers and proactively respond to global security events. Directly support and empower TAC, CE, SE, and PM teams. Respond with platform wide countermeasures, threat analysis reporting, and technical solutions. Develop and mature threat intelligence products and AutoFocus content. Expand globally providing regional threat expertise, multi-lingual support, and 24/7 hour response capabilities.
- Do it better, faster and with more impact than previously accomplished. (12 months, 31,000 customers, Millions of files, etc) 300-400 Mission Critical Manual Analysis Tasks Weekly (2911 in Q3) 10-20 Deep Dive Malware and Exploit reports Weekly 100+ Yara Rules Developed for Detection 100+ WF Behaviors and IPS Signatures from ITW Threats 600+ AutoFocus Heuristic Malware Family Tags aiding TAC/CE/SE 3000+ Security Reports and 300,000+ IOC’s databases for TAC/CE/SE/PM reference. Direct Collaboration and Communication channels created with front line PANW support exponentially decreasing communications overhead and time to resolution for FP/FN cases.
- Seek out, Sit Down, ( In Person ), and LISTEN Understand “Now” and ask how you can help, Know your resources and per-task LOE before committing to ANYTHING
- Teach up, down, left and right. Be the trusted SME for security operations and response. Skip the details, tell the story.
- Use your knowledge to prioritize resource expenditure to protect _______ (the world?) Stewardship of resources No is a starting point.
- Zero Unemployment Recruiters are worthless (Zero Sourcing!) Identify the organizations who do (or have done) what you do. Hire the best (or pay the price) top down and empower them to build.
- Ensures elasticity of function (scale for increased or decreased volume) Ensures career path and challenges Fosters cross team collaboration (Required to complete research tasks) Allows 100% accountability for operational response/triage responsibilities
- Regional Threat Expertise Linguistics and cultural advantages Quicker Response by following the sun Regional Leads Responsible for Operational Deliverables, without HR/Mgmt concerns
- All blacks, haka – best rugby team. “no d***heads” rule - which stresses the team ethic above talented but erratic individuals - and insists on humility and calmness under pressure from its star players. “A focus on continual improvement, the creation of a continual learning environment, and a willingness to spill blood for the jersey was at the core of All Black culture.”
- Remote by default allows for expansion, flexibility, retention (….and extreme gains in coverage for free) Slack + Jira + Bitbucket + Zoom + Custom Dev
- Open and connect existing silos Do not allow the formation of further barriers to knowledge Normalize and remove effort duplication (exponential efficacy gains!, don’t tell finance)
- Deliver regular status reports both up AND across the organization, to every possible stakeholder and team member.
- Discuss Research & Response ---> Product innovation -> Research and response feedback loop.
- MOST critical team! Automation comes AFTER successful process implementation. Humans are rare and very expensive. Rapid prototyping by analysts escalation to tools team for SDLC ”Do it three times? Automate It!” DevOps & Code Review
- Centralization of toolstack and infra Removes code maintaince and support Allows researchers to focus on operational needs Removes effort duplication
- FooS tools, Scripts, and COTS/SAAS system API’s Absolutely critical to scale operations team Enables 20 people to drive global content, coverage, and threat intel platform + Publications!!