Uploaded bySaumil Shah
Redefining Defense - HITB2017AMS Keynote
The document presents a talk by Saumil Shah at HITB 2017, discussing the evolution of cybersecurity attacks and defenses from 2001 to 2017. It emphasizes the need for proactive security measures and a shift from reactive strategies, highlighting the importance of metrics and creative defenses in modern information security. Shah outlines seven axioms of security aimed at improving the effectiveness of security defenses and addressing the challenges posed by evolving threats.
More Related Content
Similar to Redefining Defense - HITB2017AMS Keynote
Redefining Defense - HITB2017AMS Keynote
- 1. #HITB2017AMSNETSQUARE SAUMIL SHAH CEO, NETSQUARE @therealsaumil #HITB2017AMS
- 2.
- 3.
- 4. #HITB2017AMSNETSQUARE About Me Saumil Shah CEO,Net Square @therealsaumil hacker, trainer, speaker, photographer, rebel educating, entertaining and exasperating audiences since 1999
- 5. #HITB2017AMSNETSQUARE The Evolution ofAttacks: 2001-17
- 6. #HITB2017AMSNETSQUARE Servers Applications Desktops BrowsersPockets Populations The Evolution of Targets: 2001-17
- 7. #HITB2017AMSNETSQUARE ...Defense: 2001-17 Firewalls IDS/IPS Antivirus WAF DLP, EPS DEP, ASLR Sandbox One-wayAttacks FragRouter Obfuscation Char Encoding DNS Exfil ROP, Infoleak Jailbreak Different.... but Same Same
- 8. #HITB2017AMSNETSQUARE Example: ROWHAMMER By Dsimichttps://commons.wikimedia.org/w/index.php?curid=38868341
- 9. #HITB2017AMSNETSQUARE IMAJS STEGO- DECODER JAVASCRIPT TARGET BROWSER POLYGLOT PIXEL ENCODER EXPLOIT CODE IMAGE ENCODED IMAGE Example:STEGOSPLOIT http://stegosploit.info
- 10.
- 11. #HITB2017AMSNETSQUARE wherein buildings revealnear- infinite interiors, capable of being traversed through all manner of non-architectural means http://www.bldgblog.com/2010/01/nakatomi-space/ Nakatomi Space
- 12.
- 13. #HITB2017AMSNETSQUARE Exploit Development -2002 Individual effort. 1 week dev time. 3-6 months shelf life. Hundreds of public domain exploits. "We did it for the LOLs."
- 14.
- 15. #HITB2017AMSNETSQUARE The evolution ofa new species Credit @halvarflake SafeSEH DEP ASLR CFG Isolated Heap NOZZLE /GS SEHOP RelRO
- 16. #HITB2017AMSNETSQUARE The MitiGator raisesthe bar... ...until it sees no more exploits Credit @halvarflake
- 17. #HITB2017AMSNETSQUARE A long timeago in a galaxy far, far away... MICROSOFT STRIKES BACK
- 18.
- 19. #HITB2017AMSNETSQUARE 2005: Ciscogate –Michael Lynn https://www.schneier.com/blog/archives/2005/07/cisco_harasses.html
- 20.
- 21. #HITB2017AMSNETSQUARE Exploit Development -2012 2-12 month dev time. 24h to 10d shelf life. Public domain exploits = zero. Cost,value of exploits has significantly risen. • COMMERCIALIZED • WEAPONIZED • POLITICIZED
- 22. #HITB2017AMSNETSQUARE The defenders tried tobuy back their bugs...
- 23. #HITB2017AMSNETSQUARE Bug Bounties: highstakes game Chris Evans – Pwnium: Element 1337
- 24. #HITB2017AMSNETSQUARE Bug Bounties tried tofill a REACTIVE need.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30. #HITB2017AMSNETSQUARE Security = "RISKREDUCTION" Rules Signatures Updates Machine Learning
- 31.
- 32. #HITB2017AMSNETSQUARE Existing defense measures do notmatch attacker tactics.
- 33.
- 34.
- 35. #HITB2017AMSNETSQUARE In 2001... CIO CIO INFOTECH= BUSINESS ENABLER CISO INFOSEC = RISK REDUCTION $$$ C.Y.A.
- 36. #HITB2017AMSNETSQUARE Dear CISO, Whoare Scarier ATTACKERS or AUDITORS?
- 37. #HITB2017AMSNETSQUARE It is timewe ...not by building firewalls...
- 38.
- 39. #HITB2017AMSNETSQUARE Intelligence Driven Defense FromREACTIVE to PROACTIVE
- 40. #HITB2017AMSNETSQUARE Defense doesn't mean Risk Reduction SevenAxioms of Security: 1
- 41. #HITB2017AMSNETSQUARE The CISO's job is DEFENSE SevenAxioms of Security: 1
- 42. #HITB2017AMSNETSQUARE Compliance is NOTthe CISO's job "Not my circus, Not my monkeys" http://rafeeqrehman.com/2016/10/07/announcing-ciso-mindmap-2016/ 90% TIME SPENT ON COMPLIANCE!
- 43. #HITB2017AMSNETSQUARE In 2017... CISO CISOINFOSEC = DEFENSE CCO CHIEF COMPLIANCE OFFICER DEFEND AGAINST ATTACKERS DEFEND AGAINST AUDITORS
- 44.
- 45. #HITB2017AMSNETSQUARE Collect Everything! • SecurityData Warehouse: first step towards proactive security. • Retention is CHEAPER than Deletion. • Importance of HISTORICAL DATA increases exponentially with time.
- 46. #HITB2017AMSNETSQUARE Sources of SecurityIntelligence?
- 47. #HITB2017AMSNETSQUARE "The Universe tells you everythingyou need to know about it, as long as you are prepared to watch, to listen, to smell, in short to OBSERVE." Sources of Security Intelligence
- 48. #HITB2017AMSNETSQUARE Get CREATIVE, GetORGANIC ORGANIC SECURITY = Grow It Yourself!
- 49. #HITB2017AMSNETSQUARE Schrödinger's Hack: Systems existin both SECURE and HACKED states at the same time. Seven Axioms of Security: 3
- 50.
- 51. #HITB2017AMSNETSQUARE Forgone conclusion: "My SystemIs SECURE" Test Strategy that will lead you this conclusion • Wait for a new production build. • Don't test on production only UAT. • Perform Non-intrusive testing. • X,Y,Z,.. are all out of Scope. • Test during off-peak hours only.
- 52. #HITB2017AMSNETSQUARE Can't MEASURE? Can't Use. SevenAxioms of Security: 4
- 53. #HITB2017AMSNETSQUARE Why Keep Metrics? • To show you are succeeding – Corollary: to show you are failing • To justify your existence and/or budget • To argue for change • For fun! Marcus Ranum Security Metrics: The Quest For Meaning IT Defense 2016, Mainz
- 54. #HITB2017AMSNETSQUARE How to EstablishMetrics • Look at your process and make a list of what is quantifiable • Ask yourself what quantities you are interested in – Once things are quantified they go up, or down – which is about the only convenient thing of metrics: they don't go sideways, too • Which is a "good" direction: up or down? • Do you know what constitutes a significant movement? • Measure and iterate Marcus Ranum Security Metrics: The Quest For Meaning IT Defense 2016, Mainz
- 55. #HITB2017AMSNETSQUARE Alberto Brandolini@ziobrando (The Bullshit Asymmetry)
- 56. #HITB2017AMSNETSQUARE Why Metrics Win • Often information security becomes what I call a "battle of two narratives" – Your opponent has the advantage of lying: – "moving this to the cloud will save us $500,000/year!" – To defend your narrative you need facts (from metrics) and credible extrapolations (based on metrics) or your opponent controls the narrative! * * Plan B is to respond with lies of your own Marcus Ranum Security Metrics: The Quest For Meaning IT Defense 2016, Mainz
- 57. #HITB2017AMSNETSQUARE Users: One Size Fits NONE! SevenAxioms of Security: 5
- 58. #HITB2017AMSNETSQUARE The user's goingto pick dancing pigs over security every time. Bruce Schneier
- 59. #HITB2017AMSNETSQUARE Technology in thehands of users @needadebitcard
- 60.
- 61. #HITB2017AMSNETSQUARE numberofusers infosec maturity HOPELESS UNINFORMEDPROACTIVE ROCK STARS Identify your target users... Always going to be an enigma. If properly guided, these users are willing to improve their usage habits. The next Rock Star users. Leave them alone, and possibly learn from them.
- 62. #HITB2017AMSNETSQUARE ...and improve theirmaturitynumberofusers infosec maturity HOPELESS UNINFORMED PROACTIVE ROCK STARS
- 63. #HITB2017AMSNETSQUARE The Best Defense isa CREATIVE Defense. Seven Axioms of Security: 6
- 64. #HITB2017AMSNETSQUARE A Creative Defense isan UNEXPECTED Defense. Seven Axioms of Security: 6
- 65.
- 66. #HITB2017AMSNETSQUARE Make Defense VISIBLE, Make Defense COUNT. SevenAxioms of Security: 7
- 67. #HITB2017AMSNETSQUARE Visible Defense • Improvethe User Maturity Curve. • Reduce Blue Team's Response Time. • Money Saved = Money Earned Consistent Reduction in Frauds. • Produce Creative Defense Tools. • Attract Smarter Talent in Infosec. • Weekly fitness check...
- 68. #HITB2017AMSNETSQUARE ASSET INVENTORY REAL-TIME VISIBILITY OF EVENTS DETECT UNAUTHORIZEDACTIVITY CLASSIFY UNAUTHORIZED ACTIVITY ATTACKER CAPABILITY DETECT INTRUSIONS UNCOVER ATTACKERS TRACK ATTACKERS DEFEND & RECOVER ...The CISO Strength Test https://github.com/swannman/ircapabilities
- 69. #HITB2017AMSNETSQUARE Is your Infosec teamdoing something creative every day?
- 70.