A few years ago Alex Hutton coined the term Security Mendoza Line. It was in reference to Mario Mendoza the baseball player often used as a baseline for how well a player must hit in order to stay in the major leagues and not be demoted. Keeping up with the attacks automated within Metasploit can often serve as that baseline within information security. More recently, Josh Corman defined HD Moore's Law as "Casual Attacker power grows at the rate of Metasploit". In other words, that baseline is moving and we are not keeping up. In a hyped industry where much of the talk remains around Advanced Persistent Threats it's the baseline that we continue to miss as proven out in reports like Verizon's Data Breach Investigation Report. Looking at the most common breaches they are most likely to be targets of opportunity where the defenders have let the basics slip through the cracks. In this talk, we will cover why paying attention to HD Moore's Law is important and how to stay on top of this changing threat measurement. We'll offer real world examples on how an organization can identify where they stand against the Security Mendoza Line and how they can alert and defend against falling below the baseline. Content will cover not only identified threats through Metasploit modules but through the myriad of exploit sources available across the internet.

1. Hitting Above The Security Mendoza Line
Ed Bellis, CEO Risk I/O

2. Nice To Meet You
About Me
CoFounder Risk I/O
Former CISO Orbitz
Contributing Author
Beautiful Security
CSO Magazine/Online Writer
InfoSec Island Blogger
About Risk I/O
Data-Driven Vulnerability Management as a Service
DataWeek 2012 Top Security Innovator
3 Startups to Watch - Information Week
16 Hot Startups - eWeek

3. About Mario
Played for Pirates,
Rangers & Mariners
Played MLB for 9 Seasons
Lifetime Batting Avg: .214,
4HR, 101 RBI
Failed to bat .200 5 times

4. The Security Mendoza Line
Wouldn’t it be nice if we had something that
helped us divide who we considered
“Amateur” and who we considered
“Professional”?
Enter The Security
Mendoza Line Alex Hutton came up with original concept of
the Security Mendoza Line
http://riskmanagementinsight.com/riskanalysis/?p=294

5. HD Moore’s Law
Josh Corman expands
the Security Mendoza Line
“Compute power grows at the rate
of doubling about every 2 years”
“Casual attacker power grows at
the rate of Metasploit”

6. A Difficult Task
Nearly 2K MSF Exploits 2000
Exploit Development
1500
ExploitDB > 18K Exploits 1000
500
>10% Known Exploits 0
2010
MSF Modules
2012

7. Release Early Release Often

8. Point Click Pwn

9. A Data Driven
Approach

10. Out Scripting the Kiddies
Fighting Automation
with Automation
Netflix/
SimianArmy
Github
Avg: .200

11. Context Matters
Attack
Path data
analysis
Avg: .220

12. Context Matters
Mitigating Controls
Firewalls / ACLs
IPS
WAF
MFA
Other
Avg: .240

13. Context Matters
Honeypot, WAF & IDS data
logs! logs! logs!
Measuring Likelihood
Avg: .260

14. Broader Context
Targets of Opportunity?
My(vuln posture X other
threat activity) / (other
vuln posture X other
threat activity)
Avg: .280

15. Beyond Info Sharing
Model Sharing
ALL Star!
Avg: .300

16. A Quick Side Note
CVE Trending Analysis
Gunnar’s Debt Clock

17. Q&A
follow us
the blog
http://blog.risk.io/
twitter
@ebellis And one more thing....
@riskio We’re Hiring! https://www.risk.io/jobs