Predictive Security in the 3rd Platform Era
•
1 like•946 views
Presentazione di Giancarlo Vercellino, Research & Consulting Manager di IDC Italia, tenuta all'IDC Conference Predictive Security in the 3rd Platform Era di Milano, l'11 marzo 2015
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Predictive Security in the 3rd Platform Era
Similar to Predictive Security in the 3rd Platform Era (20)
More from IDC Italy
More from IDC Italy (20)
Recently uploaded
Recently uploaded (20)
Predictive Security in the 3rd Platform Era
- 1. Nuovi scenari della sicurezza IT nell’era della Terza Piattaforma Milano, 11 Marzo 2015
- 2. Perché abbiamo bisogno di una nuova sicurezza IT © IDC Visit us at IDC.com and follow us on Twitter: @IDC 2
- 3. IT Security - Priorità tecnica & di business O R G A N I Z A T I O N A L R E S T R U C T U R I N G O R M & A A C T I V I T I E S E N E R G Y E F F I C I E N C Y / G R E E N / S U S T A I N A B I L I T Y M U L T I C H A N N E L D E L I V E R Y S T R A T E G Y M A R K E T I N G E F F E C T I V E N E S S I M P R O V E M E N T S U P P L Y C H A I N / P R O C U R E M E N T E F F I C I E N C Y P R O D U C T O R S E R V I C E I N N O V A T I O N I T O R G A N I Z A T I O N C O N T R I B U T I O N T O B U S I N E S S G O A L S C U S T O M E R C A R E E N H A N C E M E N T R E D U C I N G O P E R A T I O N A L C O S T S S A L E S P E R F O R M A N C E I M P R O V E M E N T R E G U L A T O R Y C O M P L I A N C E S E N S I T I V E D A T A P R O T E C T I O N WESTERN EUROPE BUSINESS PRIORITIES Source: IDC European Vertical Markets Survey, 2014 (n = 1,588) 3 Could you rate the following business initiatives in terms of how much they are leading your company's business agenda for the next 12 months? (1 = "not at all important" and 5 = "most important")?
- 4. Una rassegna inesauribile © IDC Visit us at IDC.com and follow us on Twitter: @IDC 4 Sony Picture Entertainment (The Interview, 40GB vs 100TB, Guardian of Peace, North Korea?) Infrastrutture compromesse (Factoring Attack on Rsa- Export Keys Vulnerability, Equation Group) Social Arena (Snapchat/iCloud/Twitter, beware what you share, reputation is a perishable asset) Belgacom (Regin malware, European Parliament, GCHQ/NSA)
- 5. Nuovi attaccanti, nuove strategie 5
- 6. Lo scenario dei rischi emergenti © IDC Visit us at IDC.com and follow us on Twitter: @IDC 6 Governative agency Industrial espionage, organized crime Hacktivism Common People Complexity ofattacks Frequency of attacks Influence-oriented Resource-oriented Frequency < 1/10 Frequency > 1/5
- 7. Assedio dei sistemi Statistiche dall’Italia 7 casual attack ≈ 60% APT ≈ 10% relevant impact < 5% (IDC Italia, segmento grandi imprese)
- 8. La frequenza degli attacchi © IDC Visit us at IDC.com and follow us on Twitter: @IDC 8 MalwareZero-day ExploitZero-day Malwarepolimorfico Malwarecifrato Botnet Socialengineering Finance Manufacturing Commerce Services Government (IDC Italy, Enterprise Segment) Alta frequenza Bassa frequenza
- 9. Il rischio di esposizione sta aumentando Time to discovery less than one day }Mobile, Social, Cloud add complexity and increase exposure to vulnerabilities Time to compromise less than one day
- 10. (In)sicurezza: sensibilità diverse © IDC Visit us at IDC.com and follow us on Twitter: @IDC 10 GOVER NMENT MANUFACTU RING FINANCE GOVERNME NT SERVICE MANUFA CTURING GOVERN MENT COMMER CE SERVI CE FINAN CE Perdita dati personali/ finanziari Perdita proprietà intellettuale Danno alla reputazione Costo ripristino sistemi Multe delle autorità pubbliche
- 11. Downtime dei sistemi Statistiche dall’Italia 11 Commercio ≈ 10% Industria ≈ 6% PA ≈ 5% Non sa! ≈ 30% (IDC Italia, segmento PMI imprese)
- 12. 12 Chi è responsabile della sicurezza IT? Dipartimento IT generale ≈ 60% Gruppo Sicurezza ≈ 30% Servizio gestito ≈ 10%
- 13. Not behind my firewall 13
- 14. Necessità di espandere le risorse © IDC Visit us at IDC.com and follow us on Twitter: @IDC 14 0.0% 10.0% 20.0% 30.0% I N S U F F I C I E N Z A D E L B U D G E T D E D I C A T O A L L A S I C U R E Z Z A I T M A N C A N Z A D I C O N F O R M I T À D E I D I P E N D E N T I A L L E P O L I C Y S U L L A S I C U R E Z Z A M A N C A N Z A D I U N A S T R A T E G I A D E L L A S I C U R E Z Z A E D I P O L I C Y A D E G U A T E P R E S S I O N E C R E S C E N T E D I A T T A C C H I S E M P R E P I Ù S O F I S T I C A T I I N A D E G U A T E Z Z A E R A P I D A O B S O L E S C E N Z A D E L L E S O L U Z I O N I D I I T S E C U R I T Y D I F F I C O L T À N E L G A R A N T I R E A L L A S I C U R E Z Z A U N S U P P O R T O 2 4 X 7 C A R E N Z A D I P E R S O N A L E Q U A L I F I C A T O S U I T E M A D E L L A S I C U R E Z Z A I T P R E S S I O N E C R E S C E N T E D E L R E G O L A T O R E P U B B L I C O QUALI SONO LE PRINCIPALI CRITICITÀ DI SICUREZZA IT DELLA SUA AZIENDA? (IDC Italy, 2015, n=110, Mid-large Enterprise)
- 15. Investimenti di base © IDC Visit us at IDC.com and follow us on Twitter: @IDC 15 0.0% 10.0% 20.0% 30.0% 40.0% B U S I N E S S C O N T I N U I T Y & D I S A S T E R R E C O V E R Y S T R U M E N T I D I S I C U R E Z Z A T R A D I Z I O N A L E S E R V I Z I D I S I C U R E Z Z A I N T E L L I G E N T E S E R V I Z I D I S I C U R E Z Z A G E S T I T I PRIORITÀ DI INVESTIMENTO NEL 2016
- 16. Iterative intelligence: imparare dagli attacchi © IDC Visit us at IDC.com and follow us on Twitter: @IDC 16 Un anno di log in una MNC: 60-100M di eventi analizzati Dopo analisi dei sistemi: 50-90k tentativi di attacco Dopo analisi di intelligence: 70-100 incidenti Da un approccio reattivo a un approccio proattivo, integrando capacità algoritmica con intelligenza umana
- 17. Competenze sempre più sofisticate © IDC Visit us at IDC.com and follow us on Twitter: @IDC 17 New Skills Advanced Skills Basic Skills • Malware analysis • Data mining & analysis • Machine learning • Project mgmt • Security Standard Implementation • Hacking Practices • Network Administration • Scripting/ programming • Software Vulnerabilities
- 18. © IDC Visit us at IDC.com and follow us on Twitter: @IDC 18 The rise of Security Market
- 19. 19 IDC FutureScape Perspective on Security IDC’s CIO Agenda Top 10 Decision Imperatives on IT Security ORGANIZATIONALIMPACT TIME (MONTHS) TO MAINSTREAM Note: The size of the bubble indicates complexity/cost to address. Source: IDC, 2014 Asingle department orabusinessunit Multiple departments orbusinessunitsCompanywide 0-12 12-24 24+ 6 7 4 10 Legend: 1. Risk-based budgeting 2. Biometric ID 3. Threat Intelligence 4. Data Encryption 5. Security SaaS 6. User Management 7. Hardening Endpoints 8. Security as a feature 9. Software Security 10. Executive Visibility 3 5 1 9 8 2
- 20. Data Privacy, Compliance, Regulations © IDC Visit us at IDC.com and follow us on Twitter: @IDC 20 New (draft) regulations, cornerstones: • Data transfers to non-EU countries. Request to the National Data Protection Authority and to the single individual. • Sanctions. Increased 100-fold to "up to €100 million or up to 5% of annual worldwide turnover, whichever is greater" • Right to erasure. Data controllers should also forward the request • Explicit consent. Customer engagement needs to be centered on their "opting in“ • Profiling. Profiling would only be allowed subject to a person’s consent • Data Protection Officer. Public institutions, companies processing the data of more than 5,000 people in a year
- 21. Concludendo Il Web da nuova frontiera (a volte anche Far West …) a strumento di controllo (una distopia a metà strada tra Orwell e Huxley) La Sicurezza non è un prodotto (la tecnologia non basta), ma una percezione (un processo intersoggettivo) Trade-off: tempo medio di risposta vs. security budget rate © IDC Visit us at IDC.com and follow us on Twitter: @IDC 21
- 22. © IDC Visit us at IDC.com and follow us on Twitter: @IDC 22 Thank you IDC Italia Viale Monza 14 20127 Milano Tel: +39 02 28457339 gvercellino@idc.com Giancarlo Vercellino Research & Consulting Manager IDC Italy www.idc.com
Editor's Notes
- TBD: Tutto in inglese Dati tendenziali Considerazioni/ recommendations/ best practices Conoscere le statistiche normali della propria rete Ragionare sempre per scenari di rischio, moltiplicare i contingency plan Per i rischi normali allocare il budget rispetto a una stima del valore medio del rischio, per i rischi eccezionali investire quanto necessario per preservare sopravvivenza dell’operatività
- Business Priorities
- Advanced Persisten Threat: Stuxnet Processo, non singolo strumento Eterogeneità dei mezzi, singolarità dell’obiettivo, persistenza. Gli attaccanti hanno investito. I tradizionali strumenti basati su software signature non sono più funzionali
- Common people: (intangible assets, knowledge workers, mobility culture) Cybercrime: (Black Markets, Virus Toolkits, Marketing & Advertising) Hacktivism: (Public Opinion, Social Pressure, Underdog Culture) Governative: (NSA/ GCHQ/ PLA Unit 61398/ SEA, surveillance state, political power) Despecializzazione nelle aziende, crescente specializzazione di altre aziende. Industrializzazione nella produzione di malware (G01 PACK EXPLOIT KIT, BLACKHOLE, SAKURA, STYX, COOL EXPLOIT KIT). Aziende che fanno marketing & advertising. Il web occasione per lo sviluppo di nuovi mercati (VUPEN Security, ReVuln, Endgame Systems, Exodus Intelligence, and Netragard). Insiders: (Bradley Manning, Wikileaks), (Edward Snowden, Prism). Movie&Music dall’industria dell’entertainment. (Kim Dotcom, nato Kim Schmitz, è un imprenditore e informatico tedesco fondatore ed ex proprietario di Megaupload ed attuale proprietario di Mega e Baboom) Anonymous: Church of Scientology—the Anonymous collective became increasingly associated with collaborative hacktivism on a number of issues internationally. Individuals claiming to align themselves with Anonymous undertook protests and other actions (including direct action) in retaliation against anti-digital piracy campaigns by motion picture and recording industry trade associations. Later targets of Anonymous hacktivism included government agencies of the US, Israel, Tunisia, Uganda, and others; child pornography sites; copyright protection agencies; theWestboro Baptist Church; and corporations such as PayPal, MasterCard, Visa, and Sony Sforzo di categorizzazione Frequenze distinte Obiettivi molto diversi. La guerra non è che la continuazione della politica con altri mezzi (Clausewitz). Internet la continuazione della guerra con altri mezzi.
- 1. Scoperta, TTC, TTD. Top five vulnerabilities 19 days of exposure, 4 day to patch (oracle java e micrsoft internet explorer). In media però passano mesi/anni. In addition, NSS labs found that an average of 151 days passed from the time when the programs purchased a vulnerability from a researcher and the affected vendor released a patch. Shellshock Vulnerability Went Undetected for 25 Years 2. Descrizione grafico e frequenze. (Data breach investigation report 2014). 3. Cybercriminals will buy so-called zero-day vulnerabilities in the black market, while government agencies and corporations purchase them from brokers and exploit clearinghouses, such as VUPEN Security, ReVuln, Endgame Systems, Exodus Intelligence, and Netragard. The six vendors collectively can provide at least 100 exploits per year to subscribers, Frei said. According to a February 2010 price list, Endgame sold 25 zero-day exploits a year for $2.5 million. In July, Netragard founder Adriel Desautels told The New York Times that the average vulnerability sells from around $35,000 to $160,000.
- Aree proporzionali alle percentuali dei rispondenti per settore
- IDC ricerche in Italia Razionalizzazione delle risorse e headcount cut. Prevale ancora la tendenza a gruppi generalisti MSP e gruppi specializzati in meno del 10% dei casi nel segmento enterprise, Le PMI fino a 30% ma perché danno fuori tutta la gestione dell’IT (Nel segmento sotto 500 addetti partner esterni in circa il 30% dei casi, con percentuali descrescenti al crescere della dimensione aziendale).
- Nel 2013, il mercato mondiale delle soluzioni per la sicurezza IT ha infatti rallentato la sua corsa, fermando la crescita al 3,6% per un valore di 30,6 miliardi di dollari. Sospinta però dall’introduzione di prodotti specificamente disegnati per rispondere alle nuove minacce emerse con la consumerizzazione, la mobility e il cloud computing, la crescita è tornata a farsi più sostenuta nel corso del 2014, chiuso secondo i dati preliminari di IDC a 32,6 miliardi di dollari di valore, ovvero con un incremento del 6,7%. E il 2015 promette di mantenere questo ritmo, con le ultime analisi di IDC che proiettano il mercato mondiale dell’IT security a un valore di 34,9 miliardi di dollari entro la fine dell’anno. Crescite: 2014, 6,7% - 2015, 7% - 2016, 7,4% Predictions: uno su quattro analytics for intelligence, 3 su quattro customized reports Security: $34.881,20M STAP The specialized threat analysis and protection (STAP) market is a competitive market drawing revenue from the following logical markets of IDC's security taxonomy: Web, messaging, endpoint, network, and security and vulnerability management (forensics). Products within this market must use a predominantly signature-less technology (i.e., sandboxing, emulation, big data analytics, containerization) to detect malicious activity. These solutions can be based at the network level, on the endpoint, or both, and scan both inbound and outbound traffic for anomalies including botnet and command and control traffic. This market also includes products that allow for the reverse engineering and forensic analysis of discovered malware. Virtual sandboxing/emulation and behavioral analysis are increasingly being deployed to detect advanced malware. With signatures not able to detect a neverseen- before file, determining how the file will behave becomes increasingly important. Suspicious files can be sent to a virtual environment that mirrors that of the organization (or some segment of the organization), and activity is analyzed to determine if registry keys are being modified, processes being are changed, or communication with suspicious servers is being attempted. Alternatively, the file can be sent to a general cloud environment where similar analysis is performed. Finally, network traffic can be monitored for anomalous behavior, such as communications with command and control servers or with other resources on, or segments of the network that are outside the bounds of normal activity. Virtual containerization/isolation addresses the threat of advanced attacks from the endpoint. Solutions that follow this framework essentially forgo trying to prevent malware from breaching the organization but work to prevent malicious files from having access to an Internet connection or the system resources of an infected machine. Specific applications or tasks can be virtually segmented from the rest of the machine, assuring that malware is not able to spread or "phone home," rendering it benign. Advanced system scanning also focuses on the endpoint, but rather than segmenting resources, lightweight agents examine system behavior for signs of malicious activity. This can be done by watching the operating system for registry modifications, questionable processes, or other signs, or by analyzing the actual physical memory for malicious activity. These solutions need to remain lightweight so as not to impact performance and retain a stealthy posture on the device so attackers believe they are not being monitored
- There are two sides to the data privacy challenge : firstly, legislation For the first time in many years, the European Commission (EU) is re-evaluating the European Union’s (EU) data protection regulations. While technology has moved on, the current regs have remained stagnant and woefully inadequate to protect an individual’s and an organization’s data. Stakeholders are voicing their opinions and concerns regarding current and proposed regs related to data protection and privacy, including individual end-users and businesses.
- Psicologo dell’organizzazione 2. Negoziare sui rischi accettabili/ sistemici e i rischi inaccettabili/ critici 3. Investire per incrementare la capacità di risposta nelle finestre di esposizione ai rischi (contingency plan diventano procedure normali)