There is no security (and it feels just fine)
•Download as PPTX, PDF•
2 likes•742 views
This document discusses security issues and failures across different domains including web commerce, industrial control systems, consumers, and software. It notes that all software has bugs, some of which will have security impacts. It concludes that product owners prioritize functionality over security and investors do not highly value security. The document recommends steps organizations can take to improve security including adopting the SANS Top 20 Critical Controls and implementing practices for secure software development environments.
More Related Content
Viewers also liked
Viewers also liked (13)
Similar to There is no security (and it feels just fine)
Similar to There is no security (and it feels just fine) (20)
Recently uploaded
Recently uploaded (20)
There is no security (and it feels just fine)
- 1. There is no security (and it feels just fine) Jonathan Care @arashiyama http://uk.linkedin.com/in/computercrime/
- 2. @arashiyama No Security: wtf?
- 3. @arashiyama kill off misconceptions
- 4. @arashiyama get past the sales talk
- 5. @arashiyama expose the cyber
- 6. We really do care about security and @arashiyama privacy…
- 7. @arashiyama
- 9. @arashiyama
- 10. What do IT guys actually care about? @arashiyama
- 11. @arashiyama Credit: 451 Research
- 12. three faces of information security @arashiyama
- 16. @arashiyama Security fail #1 : PCI DSS
- 17. Most breaches web-commerce based @arashiyama
- 18. Although compromised PEDs are fun @arashiyama too
- 19. Security fail #2 : ICS/SCADA @arashiyama
- 20. Note: I will not visit you in prison if you get into trouble trying out this stuff. Also, SCADA systems control things that are IMPORTANT and should not be fscked with lightly @arashiyama
- 21. @arashiyama http://bit.ly/lyMi35 Siemens, SIMATIC HMI, XP277, 6AV6 643-0CD01-1AX0, HW: 0, SW: V 1 1 2
- 22. @arashiyama http://bit.ly/jTlKsL (What temperature would you like your HVAC today?)
- 23. @arashiyama Wide open webcams?
- 25. Security fail #3 : Consumers @arashiyama
- 27. @arashiyama SaaS
- 28. @arashiyama (we are all consumers)
- 29. Security fail #4 – Software (!) @arashiyama
- 32. @arashiyama
- 33. @arashiyama
- 34. So, how’s YOUR software dev doing? @arashiyama
- 35. @arashiyama
- 37. @arashiyama 1.All software has bugs.
- 38. 2. Bugs will be discovered @arashiyama
- 39. 3. Some bugs will have a security @arashiyama impact
- 40. 4. Product owners continue to value @arashiyama functionality over security
- 41. 5. Investors place little value on @arashiyama security and privacy
- 42. 6. End users trust vendors @arashiyama
- 43. @arashiyama What can we do?
- 44. @arashiyama PROTECT RESPOND DETECT
- 45. SANS Top 20 Critical Controls @arashiyama
- 46. Policy, processes & guidelines InfoSec checkpoints in project lifecycle Threat Model Risk Appetite / Risk Tolerance @arashiyama Secure Software Environment Operational Security Controls Continuous Vulnerability Scan – Fix Penetration Testing / Red teaming Malware IDS / IPS Firewalls Centralised Logging (SIEM) Threat Intelligence PROTECT RESPOND DETECT Incident Response (Threat Model) Incident Response (“Bluebird”) Exec-level(press, clients) “Forensic Readiness” Update PROTECT model
- 47. Secure Software Environment - BSIMM @arashiyama
- 48. Secure Software Environment @arashiyama Governance Intelligence SSDL Touchpoints Deployment Strategy and Metrics Compliance and Policy Training Attack Models Security Features and Design Standards and Requirements Architecture Analysis Code Review Security Testing Penetration Testing Software Environment Configuration Mgmt / Vulnerability Mgmt
- 49. @arashiyama
Editor's Notes
- There is a part of me that wonders why I am talking to hackers and pentesters (and possibly a couple of you are corporate types with your suits off) about this. Our industry is full of snake oil, from sales guys desperate to make their number, to consultants on a mission for fame and glory, and a boatload of products that frankly, don’t actually work. I want to give you guys a view from the other side of the mirror, so that if you encounter this stuff in your day jobs, you’ll be forearmed.
- People (sort of) care about it Lots of misconceptions Those of us in day jobs need to know about this stuff (if only in order to kill off misconceptions, sales talk, and outright lies)
- Expose the outright lies … oops
- A friend of mine David Lacey coined the phrase “three faces” which goes as follows
- Where most of the action lies Dominates the work of your internal security team Justifies the budget, produces large documentation trees, makes audit happy Based on ancient practices (not current threats)
- The board love it (“This guy understands the business!”) Enhance reputation, gain sales, innovate new products, new ways of working Sounds great, but its wishful thinking Rarely passes an investment appraisal board Even if it does, first year results do not justify further investment
- Expensive, difficult and disruptive * Manage current risks and threats, not last years audit actions Tackle advanced persistent threats (PEOPLE) * Speak up (those SCADA systems are still insecure) Take critical intellectual assets off the network * Tell project managers to go back to the drawing board Be prepared to be unpopular, and potentially unemployable
- DISCLAIMER: …. Or for that matter CONNECTED TO THE INTERNET
- Why on earth would you put an SNMP interface on the internet for a SCADA system? Why would you leave it with a default read string?
- If you remember the Dilbert voice controlled shower, having an environmental system open to the internet seems to invite a similar level of chaos. Nice toasty machine room, chilly office space… a complete recipe for chaos