Upload File

sans critical security controls summit london 2013

  • Home
  • Documents
  • SANS Critical Security Controls Summit London 2013
70
Presenting a Hard Target To Attackers Wolfgang Kandek CTO, Qualys Inc SANS Critical Security Controls 2013 London, May 1, 2013

Upload: wolfgang-kandek

Post on 27-Nov-2014

430 views

Category:

Documents


1 download

Report

Tags:

DESCRIPTION

Present a hard Target to Attackers

TRANSCRIPT

Page 1: SANS Critical Security Controls Summit London 2013

Presenting a Hard Target To Attackers

Wolfgang KandekCTO, Qualys Inc

SANS Critical Security Controls 2013

London, May 1, 2013

Page 2: SANS Critical Security Controls Summit London 2013
Page 3: SANS Critical Security Controls Summit London 2013
Page 4: SANS Critical Security Controls Summit London 2013

Defense

Page 5: SANS Critical Security Controls Summit London 2013

Threat Intelligence

Page 6: SANS Critical Security Controls Summit London 2013

Public Threat Intelligence

Page 7: SANS Critical Security Controls Summit London 2013

2012 – Data breaches in the news

Page 8: SANS Critical Security Controls Summit London 2013

2012 – Data breaches in the news

Page 9: SANS Critical Security Controls Summit London 2013

2012 – Data breaches in the news

Page 10: SANS Critical Security Controls Summit London 2013

2013 – started in a similar way

Page 11: SANS Critical Security Controls Summit London 2013

2013 – started in a similar way

Page 12: SANS Critical Security Controls Summit London 2013

2013 – started in a similar way

Page 13: SANS Critical Security Controls Summit London 2013

2013 – started in a similar way

Page 14: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 15: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 16: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 17: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 18: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 19: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 20: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 21: SANS Critical Security Controls Summit London 2013

Industry Reports

Page 22: SANS Critical Security Controls Summit London 2013

Traditional Tools Are Failing

Page 23: SANS Critical Security Controls Summit London 2013

Attacker CompetenceIs Rising

Page 24: SANS Critical Security Controls Summit London 2013

Attacker CompetenceIs Rising

Page 25: SANS Critical Security Controls Summit London 2013
Page 26: SANS Critical Security Controls Summit London 2013
Page 27: SANS Critical Security Controls Summit London 2013
Page 28: SANS Critical Security Controls Summit London 2013

78 %

Page 29: SANS Critical Security Controls Summit London 2013

• Open System Administration Channels

• Default and Weak Passwords

• End-user has Administrator Privileges

• Outdated Software Versions

• Non-hardened Configurations

=> Flaws in System Administration

VZ DBIR Background Info

Page 30: SANS Critical Security Controls Summit London 2013

“We were getting owned through our users that were running IE with

admin privileges”

Page 31: SANS Critical Security Controls Summit London 2013
Page 32: SANS Critical Security Controls Summit London 2013
Page 33: SANS Critical Security Controls Summit London 2013
Page 34: SANS Critical Security Controls Summit London 2013
Page 35: SANS Critical Security Controls Summit London 2013
Page 36: SANS Critical Security Controls Summit London 2013
Page 37: SANS Critical Security Controls Summit London 2013

90 %

Page 38: SANS Critical Security Controls Summit London 2013
Page 39: SANS Critical Security Controls Summit London 2013

39

Page 40: SANS Critical Security Controls Summit London 2013
Page 41: SANS Critical Security Controls Summit London 2013
Page 42: SANS Critical Security Controls Summit London 2013
Page 43: SANS Critical Security Controls Summit London 2013
Page 44: SANS Critical Security Controls Summit London 2013
Page 45: SANS Critical Security Controls Summit London 2013
Page 46: SANS Critical Security Controls Summit London 2013

85 %

Page 47: SANS Critical Security Controls Summit London 2013

85 %of past incidents prevented

Page 48: SANS Critical Security Controls Summit London 2013

• About 5000 seats

• Data Breach

• 6 month security project

• Fully Patched in 2 weeks

• Admin rights controlled

• Whitelisting

• No Additional Software purchased

• No Enduser Impact

DIISRTEDepartment of Industry, Innovation, Science, Research and Tertiary Education

Page 49: SANS Critical Security Controls Summit London 2013

20 %

Page 50: SANS Critical Security Controls Summit London 2013

20 %327 malwares

Page 51: SANS Critical Security Controls Summit London 2013

20 %327 malwares

262 bypassed AV

Page 52: SANS Critical Security Controls Summit London 2013

20 %327 malwares

262 bypassed AV

Page 53: SANS Critical Security Controls Summit London 2013

Implementation

Page 54: SANS Critical Security Controls Summit London 2013

Implementation

Page 55: SANS Critical Security Controls Summit London 2013

Score: Use a letter grade system

Page 56: SANS Critical Security Controls Summit London 2013

Score: Use a letter grade system

Page 57: SANS Critical Security Controls Summit London 2013

Score: Use a letter grade systemor other mechanisms

Page 58: SANS Critical Security Controls Summit London 2013

Score: Use a letter grade system

Page 59: SANS Critical Security Controls Summit London 2013

Results

Page 60: SANS Critical Security Controls Summit London 2013

Opportunistic Attackers

Page 61: SANS Critical Security Controls Summit London 2013

Opportunistic Attackers

✔

Page 62: SANS Critical Security Controls Summit London 2013

Targeted Attackers

Page 63: SANS Critical Security Controls Summit London 2013

Targeted AttackersDisrupt, Slow Down

Page 64: SANS Critical Security Controls Summit London 2013

Targeted AttackersDisrupt, Slow Down,

Raise Cost, Force Mistakes

Page 65: SANS Critical Security Controls Summit London 2013

Information

Page 66: SANS Critical Security Controls Summit London 2013

US DoS, DIISIRTE,NASA, DHHS-CMS,GS, OfficeMax…

Page 67: SANS Critical Security Controls Summit London 2013
Page 68: SANS Critical Security Controls Summit London 2013
Page 69: SANS Critical Security Controls Summit London 2013

• Microsoft Security Intelligence Report v14

• Verizon Data Breach Investigation Report

• Kaspersky Lab – Evaluating the Threat Level of Software Vulnerabilities

• Symantec – Empirical Study of Zero-day attacks

• Mandiant Intelligence Center APT1

• South Carolina Data Breach Incident Report

• FireEye Advanced Threat Report

References

Page 70: SANS Critical Security Controls Summit London 2013

Thank You

Wolfgang [email protected]

@wkandekhttp://laws.qualys.com


Summit - SANS

02- It3D Summit 2016 - "pas d'immersion sans design" - D. Sciamma - Strate Ecole de design

Aquaknights 2011-2020 Coaches Summit 2011 He who controls the present, controls the past, He who controls the past, controls the future

Implementing the SANS 20 Critical Security Controls

Guide AppSec 2013 - SANS · SANS AppSec Summit & trAiNiNg ... and the need to customize solutions for users of all types? ... Hp HP Fortify, an HP Company,

Reverse Engineering Mac Malware - SANS · PDF fileReverse Engineering Mac Malware SANS DFIR Summit ... Mobile, Malware, ... General Forensics Nerd & Mac Fan Girl

10th SANS ICS Security Summit Project SHINE Presentation

SANS Top 20 Critical Controls Report

SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Critical Controls for Effective Cyber Defense - SANS Institute

SANS 20 Security Controls

Support for the SANS Top 20 Critical Security Controls · SANS Top 20 Critical Security Controls ... program, the SANS Top 20 list ... location of the critical data within a DLP system

Ten Tenets of Security Success - SANS · • 27002 –Code of practice ... •Attributed to Q4 BYOD pilot. SANS Security Leadership Summit #9 Master Your Message. SANS Security Leadership

Secure DevOps: A Puma’s Tail - SANS DevOps: A Puma’s Tail SANS Secure DevOps Summit Tuesday, October 10th 2017 Eric Johnson (@emjohn20)

Lance Mueller - SANS Forensic & IR Summit

SANS 2013 Critical Security Controls Survey: Moving From Awareness

Registry and Timeline Analysis SANS Forensic Summit 2010

CCS - SANS 20 Critical Security Controls Asegure su empresa en 20 controles - Segurinfo 2014 - Javier Antunez

Using a Network Model to Address SANS Critical Controls 10 and 11

Summit.com/MEA2013 - MetricStream GRC Summit€¦ · Mgmt – InfoSec, IT-Ops, Compliance • Controls Monitoring & Testing • Risk Analytics • Harmonized Controls • Regulations:

7 Ways to Scale Web Security (SANS AppSec Summit 2012)

Implementing the CIS critical security controls: Using ...€¦ · SANS / CIS Top 20 Security Controls • Established in 2008 • Current version is 6.1 • Designed to give you

Improve your revenue agency information systems security ... · SANS Top 20 Security Critical Security Controls Description of Controls Critical Controls continued: 11.Limitation

Lighting Controls Summit

Open Source Tools for Mobile Forensics - SANS source tools for mobile forensics mattia epifani sans european digital forensics summit prague, 6 october 2013 . summary ... whatsapp

Mastering the Super Timeline - sans.org · • Blog author at the SANS forensics blog • Author of the blog: blog.kiddaland.net . SANS EU Forensics and Incident Response Summit Why

New Public Procurement Rules for the Construction Sector Seminar.pdfRisk management and internal controls SANS 10845-1 SANS 10845-2 SANS 10845-3 SANS 10845-4 Forms of contract.

Windows 8 Recovery Forensics - Digital Forensics - SANS · WINDOWS 8 RECOVERY FORENSICS Understanding the Three R’s W. Kenneth Johnson (@patories) SANS DFIR SUMMIT 2012

Implementing SANS Security Controls to Improve Information Security

SANS SCADA SUMMIT 2008 Control Systems Security in · PDF fileEnhancing control systems security in the energy sector. NSTB. SANS SCADA SUMMIT 2008. Control Systems Security in the

SANS European Security Awareness Summit 2017 @SecureTheHuman securingthehuman.sans.org [email protected] SECURING THE HUMAN ENDPOINT 6˜7 DEC SANS European Security Awareness

SANS Pentest Summit Getting Creative Creative - A... · SANS Pentest Summit Getting Creative A story of thinking outside of the box… Dave Kennedy Founder, Principal Security Consultant

SANS Summit Solutions Expo Sponsorship · SANS 2018 Summit & Training . tails. Visit Our Website | Email Us • 10’ x 10’ Space on Solutions Expo Day Includes: 6’ draped table,

Support for the SANS Top 20 Critical Security Controls · 2019-03-07 · SANS Top 20 Critical Security Controls In response to the increasing number of cyber-attacks globally, the

2017 Project Controls SUMMIT T24 Commissioning, … Commissioning, Sustainability & Acceptance Testing RECENT CODE CHANGES & REQUIREMENTS 2017 Project Controls SUMMIT