The document discusses practical security architecture and dwell time. It notes that prevention strategies will fail and the longer an attack goes undetected, the worse the consequences. It recommends focusing on reducing dwell time by quickly detecting attacks, containing the spread, identifying the source, and eradicating vulnerabilities. The document outlines approaches to protect systems through controls like email/web filtering, firewalls, authentication, and patching. It also discusses ways to detect attacks through log consolidation, security analytics, and deception technologies. Response and recovery plans like incident response, backups, and continuity plans are also covered.

1. PRACTICAL SECURITY
ARCHITECTURE
WAYNE TUFEK
15TH – 16TH OF FEBRUARY 2019
SACON
BANGALORE

2. 2
Sensitivity: Confidential
DWELL TIME
Time of initial
compromise
Eradication of
vulnerability
Identification
of incident
Containment
Time to Identification
Dwell Time
Exposure Time
T0 T1 T2 T3T-1
Time
vulnerability
appears
Time to containmentTime to Compromise

3. 3
Sensitivity: Confidential
DWELL TIME
• Prevention based strategies will fail
• Time to detect and time to respond metrics are irrelevant
• The more time an attacker has in your environment the more
likely they will action on their objectives
• The longer it takes to detect an attack, the worse the
consequences
• Detect the attack
• Prevent the attack spreading
• Identify the source of the attack
• Dwell time and lateral movement are co-dependent

4. 4
Sensitivity: Confidential
DWELL TIME STATISTICS
Source: Mandiant M-Trends 2018

5. 5
Sensitivity: Confidential
PROTECT
• Email filtering
• Web filtering
• Firewalls and network segmentation
• Anti-malware
• Whitelisting
• Secure configuration and builds
• Multifactor authentication
• Third party risk management
• Vulnerability management (inc patching)
• Privileged access management
• Security awareness
• Physical security
• Secure software development practices

6. 6
Sensitivity: Confidential
DETECT
• Log consolidation
• Security analytics
• Alert fatigue
• Deception technologies
• East-West visibility

7. 7
Sensitivity: Confidential
RESPOND
• Incident response process
• Data breach notification process

8. 8
Sensitivity: Confidential
RECOVER
• Backups
• Disaster recovery plan
• Business continuity plan
• Distribute IT
• Code Spaces

9. 9
Sensitivity: Confidential
DECEPTION
• Current security systems generate a lot of alerts, many of them
false positives
• Alert over load
• Evolution of the honey pot
• Deception technologies are defined by the use of decoys
and/or tricks designed to thwart, or throw off an attacker,
disrupt an attacker's automation tools, delay an attacker's
activities or detect an attack
• Almost zero false positive solution

10. 10
Sensitivity: Confidential
EXERCISE

11. 11
Sensitivity: Confidential
QUESTIONS?
Questions

12. 12
Sensitivity: Confidential
PA S S I O N • I N T E G R I T Y • E X P E R I E N C E • R E S U LT S