Major Information Security Challenges Faced by Financial Services Firms
undefined
INFORMATION SECURITY CHALLENGES
FACED BY A LARGE FINANCIAL SERVICES
FIRM
BY: GAURAV GUPTA
FEBRUARY 2013
1
2
What is the significance of http://info.cern.ch?
THE PERFECT STORM
Explosive growth and aggressive use of information
technology.
Proliferation of information systems and networks with
virtually unlimited connectivity.
Increasing sophistication of threat including exponential
growth rate in malware (malicious code).
Resulting in an increasing number of penetrations of information
systems in the public and private sectors…
S
o
u
r
c
e
:
N
I
S
T
–
O
W
A
S
P
A
P
P
S
E
C
D
C
2
0
1
0
3
FOOD FOR THOUGHT - PUBLICLY
KNOWN SECURITY INCIDENTS
4
Latest
to
Previous years
THE NEWYORK TIMES ATTACK
5
Phishing and
zero day attack
Backdoor
Lateral
Movement
Data
Gathering
Exfltrate
1
2
3
4
5
For the last four months, Chinese
hackers have persistently attacked The
New York Times, infiltrating its computer
systems and getting passwords for its
reporters and other employees.
After surreptitiously tracking the intruders
to study their movements and help erect
better defenses to block them, The Times
and computer security experts have
expelled the attackers and kept them
from breaking back in.
S
o
u
r
c
e
:
h
t
t
p
:
/
/
w
w
w
.
n
y
t
i
m
e
s
.
c
o
m
/
2
0
1
3
/
0
1
/
3
1
/
t
e
c
h
n
o
l
o
g
y
/
c
h
i
n
e
s
e
-
h
a
c
k
e
r
s
-
i
n
f
i
l
t
r
a
t
e
-
n
e
w
-
y
o
r
k
-
t
i
m
e
s
-
c
o
m
p
u
t
e
r
s
.
h
t
m
l
The hackers
tried to cloak
the source of
the attacks on
The Times by
first penetrating
computers at
United States
universities and
routing the
attacks through
them
The attackers
first installed
malware —
malicious
software — that
enabled them
to gain entry to
any computer
on The Times’s
network
They broke into
the e-mail
accounts of its
Shanghai bureau
chief, David
Barboza, who
wrote the reports
on Mr. Wen’s
relatives, and Jim
Yardley, The
Times’s South
Asia bureau chief
in India
The hackers
stole the
corporate
passwords for
every Times
employee and
used those to
gain access to
the personal
computers of
53 employees
Experts found ‘no’
evidence that the
intruders used the
passwords to
seek information
that was not
related to the
reporting on the
Wen family.
No customer data
was stolen from
The Times,
security experts
said.
THE STUXNET WORM
T
a
r
g
e
t
i
n
g
c
r
i
t
i
c
a
l
i
n
f
r
a
s
t
r
u
c
t
u
r
e
c
o
m
p
a
n
i
e
s
—
Infected industrial control systems around the world.
Uploads payload to Programmable Logic Controllers.
Gives attacker control of the physical system.
Provides back door to steal data and remotely and secretly control critical plant operations.
Found in Siemens Simatic Win CC software used to control industrial manufacturing and utilities.
S
o
u
r
c
e
:
N
I
S
T
–
O
W
A
S
P
A
P
P
S
E
C
D
C
2
0
1
0
6
THE FLASH DRIVE INCIDENT
T
a
r
g
e
t
i
n
g
U
.
S
.
D
e
p
a
r
t
m
e
n
t
o
f
D
e
f
e
n
s
e
—
Malware on flash drive infected military laptop computer at base in Middle East.
Foreign intelligence agency was source of malware.
Malware uploaded itself to Central Command network.
Code spread undetected to classified and unclassified systems establishing digital beachhead.
Rogue program poised to silently steal military secrets.
S
o
u
r
c
e
:
N
I
S
T
–
O
W
A
S
P
A
P
P
S
E
C
D
C
2
0
1
0
7
OPERATION AURORA
T
a
r
g
e
t
i
n
g
h
i
g
h
t
e
c
h
,
s
e
c
u
r
i
t
y
a
n
d
d
e
f
e
n
s
e
c
o
n
t
r
a
c
t
o
r
c
o
m
p
a
n
i
e
s
–
Primary goal of the attack was to
gain access to and potentially modify
source code repositories at these
companies
Google first publicly reported and
later Adobe systems, Juniper and
Rackspace publicly confirmed they
were attacked
RSA Security publicly confirmed
being attacked in 2
nd
wave
Attackers had exploited
purported
zero-day
vulnerabilities
8
1
2
3
4
5
McAfee
reported that
the attackers
had exploited
purported
zero-
day
vulnerabiliti
es (unfixed and
previously
unknown to the
target system
developers)
in
Internet
Explorer
and
dubbed the
attack
"Operation
Aurora"
A backdoor that
masqueraded
as an SSL
connection
made
connections
to command
and control
servers running
in Illinois,
Texas, and
Taiwan,
including
machines that
were running
under
stolen
Rackspa
ce
customer
accounts
It suggested that
the attackers
were interested in
accessing Gmail
accounts of
Chinese
dissidents.
The victim's
machine then
began
exploring the
protected
corporate
intranet that it
was a part of,
searching for
other
vulnerable
systems as well
as sources of
intellectual
property
Google reported
that some of it’s
intellectual
property was also
stolen
Phishing and
zero day attack
Backdoor
Lateral
Movement
Data
Gathering
Exfltrate
S
o
u
r
c
e
:
h
t
t
p
:
/
/
g
o
o
g
l
e
b
l
o
g
.
b
l
o
g
s
p
o
t
.
i
n
/
2
0
1
0
/
0
1
/
n
e
w
-
a
p
p
r
o
a
c
h
-
t
o
-
c
h
i
n
a
.
h
t
m
l
WE HAVE TO DO BUSINESS IN AN
UNCERTAIN WORLD…
MANAGING RISK AS WE GO...
9
SECURITY CHALLENGES 2013 ->
Advanced persistent threats
Advanced malware
Boundless networks
Return of DDoS
Building security intelligence (Big data, Threat intelligence sharing)
Auditable risk management processes and continuous controls monitoring
10
1
2
3
4
5
6
ADVANCED PERSISTENT THREATS
CAPABILITY AND INTENT
Nation states and threat actors are becoming
more sophisticated Operators behind the threat
& have a full spectrum of intelligence-gathering
techniques at their disposal
.
PERSISTENT
One of the operator's goals is to maintain long-
term access to the target, in contrast to threats
who only need access to execute a specific
task.
WHAT TO DO?
Prevent or Detect intrusion attempts
Put tools and systems in place
Train people to deal with such situations
Look for command and control traffic and block
11
1
A
d
v
e
r
s
a
r
y
C
a
p
a
b
i
l
i
t
i
e
s
a
n
d
I
n
t
e
n
t
i
o
n
s
D
e
f
e
n
d
e
r
S
e
c
u
r
i
t
y
C
a
p
a
b
i
l
i
t
y
AN INCREASINGLY SOPHISTICATED AND MOTIVATED
THREAT REQUIRES INCREASING PREPAREDNESS…
S
o
u
r
c
e
:
N
I
S
T
–
O
W
A
S
P
A
P
P
S
E
C
D
C
2
0
1
0
MALWARE – TRADITIONAL TO ADVANCED
Malware is
software
program written
for malicious
behavior to do
things like
destroying data,
stealing
sensitive
information or
just choke
network to
create other
problems to deal
with
S
o
u
r
c
e
:
F
I
R
E
E
Y
E
M
a
l
w
a
r
e
P
r
e
s
e
n
t
a
t
i
o
n
12
2
ADVANCED MALWARE
Difficult questions to answer?
Which system was infected first?
How did the malware enter the network?
What is the extent of outbreak?
How is it behaving? Do we know full behavior?
What is needed to recover and stop from proliferating?
Organizations need to
Detect and drop malwares at the trusted boundary
Stop malwares proliferation in internal network while managing day to day enterprise functions
13
BOUNDLESS NETWORK
Explosive growth of Cloud, Social and Mobile technologies is outpacing development of proper
security controls in evolution of these technologies
Instinctive model of control over where our data is and how it flows doesn’t work in hyper-connected
world anymore
Social information about individuals allows hackers to launch spear phishing attacks targeted at
individuals and companies. These are more sophisticated and damaging than conventional phishing
attacks
Entry of mobile devices at workplace
Corporate data is being demanded to be served to application on the device
Enforcement of corporate policy on the device is constantly challenging
14
3
MODERN MOBILE DEVICE EVOLUTION
15
S
o
u
r
c
e
:
M
a
r
y
M
e
e
k
e
r
2
0
1
2
I
n
t
e
r
n
e
t
T
r
e
n
d
s
MODERN MOBILE DEVICE EVOLUTION
16
S
o
u
r
c
e
:
M
a
r
y
M
e
e
k
e
r
2
0
1
2
I
n
t
e
r
n
e
t
T
r
e
n
d
s
MODERN MOBILE DEVICE EVOLUTION
17
S
o
u
r
c
e
:
M
a
r
y
M
e
e
k
e
r
2
0
1
2
I
n
t
e
r
n
e
t
T
r
e
n
d
s
MODERN MOBILE DEVICE EVOLUTION
18
S
o
u
r
c
e
:
M
a
r
y
M
e
e
k
e
r
2
0
1
2
I
n
t
e
r
n
e
t
T
r
e
n
d
s
RETURN OF DDOS
‘Anonymous’ hacktivist group launched generation of Gigabit Distributed DoS
attacks on financial services firms
Primary objective was disruption of HTTP, DNS, SMTP Services
19
“
T
h
e
a
n
o
n
y
m
o
u
s
A
t
t
a
c
k
”
-
T
h
e
a
t
t
a
c
k
w
a
s
a
i
m
e
d
a
t
f
e
w
w
e
s
t
e
r
n
f
i
n
a
n
c
i
a
l
i
n
s
t
i
t
u
t
i
o
n
s
,
o
f
w
h
i
c
h
B
a
n
k
o
f
A
m
e
r
i
c
a
,
P
N
C
B
a
n
k
a
n
d
J
P
M
o
r
g
a
n
C
h
a
s
e
h
a
v
e
p
u
b
l
i
c
l
y
c
o
n
f
i
r
m
e
d
t
h
a
t
t
h
e
y
w
e
r
e
t
a
r
g
e
t
e
d
.
A
n
n
o
u
n
c
e
a
n
d
a
t
t
a
c
k
-
A
n
o
n
y
m
o
u
s
h
a
c
k
t
i
v
i
s
t
g
r
o
u
p
a
n
n
o
u
n
c
e
d
i
t
i
n
a
d
v
a
n
c
e
a
n
d
a
t
t
a
c
k
e
d
w
e
b
s
i
t
e
s
o
f
w
e
s
t
e
r
n
f
i
n
a
n
c
i
a
l
i
n
s
t
i
t
u
t
i
o
n
s
D
a
m
a
g
e
:
I
t
d
i
d
n
o
t
c
a
u
s
e
m
u
c
h
d
a
m
a
g
e
i
n
t
h
a
t
r
o
u
n
d
o
f
a
t
t
a
c
k
b
u
t
c
l
e
a
r
l
y
i
n
d
i
c
a
t
e
d
t
h
e
e
x
p
o
n
e
n
t
i
a
l
r
i
s
e
i
n
c
a
p
a
b
i
l
i
t
y
a
n
d
u
n
d
e
r
s
t
a
n
d
i
n
g
o
f
h
a
c
k
t
i
v
i
s
t
s
t
o
t
a
r
g
e
t
i
n
s
t
i
t
u
t
i
o
n
s
a
n
d
b
e
i
n
g
s
u
c
c
e
s
s
f
u
l
a
t
i
t
I
m
a
g
e
S
o
u
r
c
e
:
I
m
p
e
r
v
a
-
H
a
c
k
e
r
I
n
t
e
l
l
i
g
e
n
c
e
I
n
i
t
i
a
t
i
v
e
,
M
o
n
t
h
l
y
T
r
e
n
d
R
e
p
o
r
t
Traditional ---------------------------------------------------------Advanced
4
BUILDING SECURITY INTELLIGENCE
BIG DATA ANALYTICS – IT’S NOT JUST FOR ADVERTISING!
Threats against the enterprise continue to evolve. Sinister,
Sophisticated
and
Subtle
Log everything, ask questions later
Simpler is better
The Ultimate Objective: Data Finds Data!
Triage isn’t about volume – the squeaky wheel does not get the grease
20
5
CHANGING THREAT LANDSCAPE
–
CYBER SECURITY IS A COMPLEX
BUSINESS ISSUE
O
p
e
r
a
t
i
o
n
A
u
r
o
r
a
–
“
T
h
e
G
o
o
g
l
e
A
t
t
a
c
k
”
.
T
h
e
a
t
t
a
c
k
w
a
s
a
i
m
e
d
a
t
d
o
z
e
n
s
o
f
o
t
h
e
r
o
r
g
a
n
i
z
a
t
i
o
n
s
,
o
f
w
h
i
c
h
A
d
o
b
e
S
y
s
t
e
m
s
,
J
u
n
i
p
e
r
N
e
t
w
o
r
k
s
a
n
d
R
a
c
k
s
p
a
c
e
h
a
v
e
p
u
b
l
i
c
l
y
c
o
n
f
i
r
m
e
d
t
h
a
t
t
h
e
y
w
e
r
e
t
a
r
g
e
t
e
d
.
A
c
c
o
r
d
i
n
g
t
o
m
e
d
i
a
r
e
p
o
r
t
s
,
Y
a
h
o
o
,
S
y
m
a
n
t
e
c
,
N
o
r
t
h
r
o
p
G
r
u
m
m
a
n
,
M
o
r
g
a
n
S
t
a
n
l
e
y
a
n
d
D
o
w
C
h
e
m
i
c
a
l
w
e
r
e
a
l
s
o
a
m
o
n
g
t
h
e
t
a
r
g
e
t
s
.
R
S
A
-
R
e
c
e
n
t
l
y
,
o
u
r
s
e
c
u
r
i
t
y
s
y
s
t
e
m
s
i
d
e
n
t
i
f
i
e
d
a
n
e
x
t
r
e
m
e
l
y
s
o
p
h
i
s
t
i
c
a
t
e
d
c
y
b
e
r
a
t
t
a
c
k
i
n
p
r
o
g
r
e
s
s
b
e
i
n
g
m
o
u
n
t
e
d
a
g
a
i
n
s
t
R
S
A
…
.
O
u
r
i
n
v
e
s
t
i
g
a
t
i
o
n
h
a
s
l
e
d
u
s
t
o
b
e
l
i
e
v
e
t
h
a
t
t
h
e
a
t
t
a
c
k
i
s
i
n
t
h
e
c
a
t
e
g
o
r
y
o
f
a
n
A
d
v
a
n
c
e
d
P
e
r
s
i
s
t
e
n
t
T
h
r
e
a
t
(
A
P
T
)
…
T
o
p
m
i
l
i
t
a
r
y
c
o
n
t
r
a
c
t
o
r
N
o
r
t
h
r
o
p
G
r
u
m
m
a
n
C
o
r
p
.
m
a
y
h
a
v
e
b
e
e
n
h
i
t
b
y
a
c
y
b
e
r
a
s
s
a
u
l
t
,
t
h
e
l
a
t
e
s
t
i
n
a
s
t
r
i
n
g
o
f
a
l
a
r
m
i
n
g
a
t
t
a
c
k
s
a
g
a
i
n
s
t
m
i
l
i
t
a
r
y
s
u
p
p
l
i
e
r
s
.
.
L
o
c
k
h
e
e
d
M
a
r
t
i
n
s
a
i
d
i
t
s
n
e
t
w
o
r
k
h
a
d
b
e
e
n
c
o
m
p
r
o
m
i
s
e
d
l
a
s
t
w
e
e
k
,
a
n
d
d
e
f
e
n
s
e
c
o
n
t
r
a
c
t
o
r
L
-
3
C
o
m
m
u
n
i
c
a
t
i
o
n
s
w
a
s
t
a
r
g
e
t
e
d
r
e
c
e
n
t
l
y
,
a
s
w
e
l
l
.
B
o
t
h
i
n
t
r
u
s
i
o
n
s
i
n
v
o
l
v
e
d
t
h
e
u
s
e
o
f
r
e
m
o
t
e
-
a
c
c
e
s
s
s
e
c
u
r
i
t
y
t
o
k
e
n
s
,
e
x
p
e
r
t
s
s
a
y
.
M
I
S
S
I
O
N
:
B
r
o
a
d
e
n
A
c
q
u
i
s
i
t
i
o
n
o
f
D
a
t
a
f
r
o
m
S
e
n
s
o
r
y
A
p
p
a
r
a
t
u
s
A
p
p
l
y
A
n
a
l
y
t
i
c
a
l
M
o
d
e
l
s
t
o
t
h
e
D
a
t
a
t
o
D
e
t
e
c
t
“
D
i
s
t
u
r
b
a
n
c
e
s
i
n
t
h
e
F
o
r
c
e
”
21
SURVEILLANCE ANALYTICS - BIG DATA VISION
New Data, More Data
Demanding Increasing Complex Analytics from
Data Sets
GB -> TB -> PB of Ingest Data
S
t
o
r
e
e
v
e
r
y
t
h
i
n
g
,
a
s
k
q
u
e
s
t
i
o
n
s
l
a
t
e
r
Context
develops as you analyze
E
x
a
b
y
t
e
S
c
a
l
e
A
n
a
l
y
t
i
c
s
a
n
d
D
a
t
a
S
t
o
r
e
R
e
q
u
i
r
e
m
e
n
t
s
Eschew Traditional Vertical Solutions
Take a Layered Approach to the Problem
Data Finds Data
Delivering Actionable Security Insight
22
CHANGING THREAT LANDSCAPE
SECURITY EVENT MONITORING THRESHOLD (THEN)
23
CHANGING THREAT LANDSCAPE
SECURITY EVENT MONITORING THRESHOLD (NOW)
24
CHANGING THREAT LANDSCAPE
SECURITY EVENT MONITORING THRESHOLD (NOW)
25
S
I
P
R
E
F
I
X
P
R
I
M
E
R
My First
Computer
CERN Produces 15
PB/Year
Splunk Consumes
150 GB/Day
Netwitness 460
TB
Big Data
Exabyte Scale
26
Digital Exhaust Data
Signatures
Behaviors
“Sensemaking”
Data Finds Data
- http://jeffjonas.typepad.com/DataFindsDataCreativeCommons.pdf
k
n
o
w
n
k
n
o
w
n
s
k
n
o
w
n
u
n
k
n
o
w
n
s
u
n
k
n
o
w
n
u
n
k
n
o
w
n
s
B
i
g
D
a
t
a
A
n
a
l
y
t
i
c
s
27
REGULATORY AUDIT AND CONTINUOUS
CONTROLS MONITORING
Auditable risk management processes
Demonstrate that you are doing what you are saying you are doing
Obtain evidence while turning the crank
Measure once and report many
Continuous controls monitoring
Monitoring once in a while or random sampling does not help anymore
Automated monitoring has become necessity
Constantly evolving business dynamics and regulatory requirements cause constant changes
to scope, implementation and measurement of controls
28
6
Q
&
A
29
In today's digital age, large financial services firms encounter significant information security challenges such as exponential growth in malware threats, sophisticated cyber attacks, and frequent penetrations of information systems. The perfect storm of technological advancements and connectivity has paved the way for a surge in security incidents, as seen in high-profile cases like the New York Times attack and the Stuxnet worm targeting critical infrastructure companies. These incidents highlight the need for robust cybersecurity measures to protect sensitive data and infrastructure from malicious actors.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
INFORMATION SECURITY CHALLENGES FACED BY A LARGE FINANCIAL SERVICES FIRM BY: GAURAV GUPTA FEBRUARY 2013 1
THE PERFECT STORM Explosive growth and aggressive use of information technology. Proliferation of information systems and networks with virtually unlimited connectivity. Increasing sophistication of threat including exponential growth rate in malware (malicious code). Resulting in an increasing number of penetrations of information systems in the public and private sectors Source: NIST OWASP APPSEC DC 2010 3
FOOD FOR THOUGHT - PUBLICLY KNOWN SECURITY INCIDENTS Latest to Previous years 4
THE NEWYORK TIMES ATTACK 5 1 2 3 4 For the last four months, Chinese hackers have persistently attacked The New York Times, infiltrating its computer systems and getting passwords for its reporters and other employees. Data Gathering Phishing and zero day attack Lateral Movement Exfltrate Backdoor They broke into the e-mail accounts of its Shanghai bureau chief, David Barboza, who wrote the reports on Mr. Wen s relatives, and Jim Yardley, The Times s South Asia bureau chief in India Experts found no evidence that the intruders used the passwords to seek information that was not related to the reporting on the Wen family. No customer data was stolen from The Times, security experts said. The hackers tried to cloak the source of the attacks on The Times by first penetrating computers at United States universities and routing the attacks through them The attackers first installed malware malicious software that enabled them to gain entry to any computer on The Times s network The hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees After surreptitiously tracking the intruders to study their movements and help erect better defenses to block them, The Times and computer security experts have expelled the attackers and kept them from breaking back in. Source: http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html 5
THE STUXNET WORM Targeting critical infrastructure companies Infected industrial control systems around the world. Uploads payload to Programmable Logic Controllers. Gives attacker control of the physical system. Provides back door to steal data and remotely and secretly control critical plant operations. Found in Siemens Simatic Win CC software used to control industrial manufacturing and utilities. Source: NIST OWASP APPSEC DC 2010 6
THE FLASH DRIVE INCIDENT Targeting U.S. Department of Defense Malware on flash drive infected military laptop computer at base in Middle East. Foreign intelligence agency was source of malware. Malware uploaded itself to Central Command network. Code spread undetected to classified and unclassified systems establishing digital beachhead. Rogue program poised to silently steal military secrets. Source: NIST OWASP APPSEC DC 2010 7
OPERATION AURORA 5 1 2 3 4 Targeting high tech, security and defense contractor companies Data Gathering Phishing and zero day attack Lateral Movement Exfltrate Backdoor Primary goal of the attack was to gain access to and potentially modify source code repositories at these companies McAfee reported that the attackers had exploited purportedzero- day vulnerabiliti es (unfixed and previously unknown to the target system developers) in Internet Explorer and dubbed the attack "Operation Aurora" A backdoor that masqueraded as an SSL connection made connections to command and control servers running in Illinois, Texas, and Taiwan, including machines that were running under stolen Rackspa ce customer accounts It suggested that the attackers were interested in accessing Gmail accounts of Chinese dissidents. Google reported that some of it s intellectual property was also stolen The victim's machine then began exploring the protected corporate intranet that it was a part of, searching for other vulnerable systems as well as sources of intellectual property Google first publicly reported and later Adobe systems, Juniper and Rackspace publicly confirmed they were attacked RSA Security publicly confirmed being attacked in 2nd wave Attackers had exploited purported zero-day vulnerabilities Source: http://googleblog.blogspot.in/2010/01/new-approach-to-china.html 8
WE HAVE TO DO BUSINESS IN AN UNCERTAIN WORLD MANAGING RISK AS WE GO... 9
SECURITY CHALLENGES 2013 -> Advanced persistent threats Advanced malware Boundless networks Return of DDoS Building security intelligence (Big data, Threat intelligence sharing) Auditable risk management processes and continuous controls monitoring 1 2 3 4 5 6 10
ADVANCED PERSISTENT THREATS 1 CAPABILITY AND INTENT Nation states and threat actors are becoming more sophisticated Operators behind the threat & have a full spectrum of intelligence-gathering techniques at their disposal. THREAT LEVEL 5 CYBER PREP LEVEL 5 HIGH HIGH THREAT LEVEL 4 CYBER PREP LEVEL 4 PERSISTENT One of the operator's goals is to maintain long- term access to the target, in contrast to threats who only need access to execute a specific task. THREAT LEVEL 3 CYBER PREP LEVEL 3 CYBER PREP LEVEL 2 THREAT LEVEL 2 LOW LOW WHAT TO DO? Prevent or Detect intrusion attempts Put tools and systems in place Train people to deal with such situations Look for command and control traffic and block Adversary Capabilities and Intentions CYBER PREP LEVEL 1 THREAT LEVEL 1 Defender Security Capability AN INCREASINGLY SOPHISTICATED AND MOTIVATED THREAT REQUIRES INCREASING PREPAREDNESS Source: NIST OWASP APPSEC DC 2010 11
MALWARE TRADITIONAL TO ADVANCED 2 Malware is software program written for malicious behavior to do things like destroying data, stealing sensitive information or just choke network to create other problems to deal with Source: FIRE EYE Malware Presentation 12
ADVANCED MALWARE Difficult questions to answer? Which system was infected first? How did the malware enter the network? What is the extent of outbreak? How is it behaving? Do we know full behavior? What is needed to recover and stop from proliferating? Organizations need to Detect and drop malwares at the trusted boundary Stop malwares proliferation in internal network while managing day to day enterprise functions 13
BOUNDLESS NETWORK 3 Explosive growth of Cloud, Social and Mobile technologies is outpacing development of proper security controls in evolution of these technologies Instinctive model of control over where our data is and how it flows doesn t work in hyper-connected world anymore Social information about individuals allows hackers to launch spear phishing attacks targeted at individuals and companies. These are more sophisticated and damaging than conventional phishing attacks Entry of mobile devices at workplace Corporate data is being demanded to be served to application on the device Enforcement of corporate policy on the device is constantly challenging 14
MODERN MOBILE DEVICE EVOLUTION Source: Mary Meeker 2012 Internet Trends 15
MODERN MOBILE DEVICE EVOLUTION Source: Mary Meeker 2012 Internet Trends 16
MODERN MOBILE DEVICE EVOLUTION Source: Mary Meeker 2012 Internet Trends 17
MODERN MOBILE DEVICE EVOLUTION Source: Mary Meeker 2012 Internet Trends 18
RETURN OF DDOS 4 Anonymous hacktivist group launched generation of Gigabit Distributed DoS attacks on financial services firms Primary objective was disruption of HTTP, DNS, SMTP Services The anonymous Attack - The attack was aimed at few western financial institutions, of which Bank of America, PNC Bank and JP Morgan Chase have publicly confirmed that they were targeted. Announce and attack- Anonymous hacktivist group announced it in advance and attacked websites of western financial institutions Traditional ---------------------------------------------------------Advanced Damage: It did not cause much damage in that round of attack but clearly indicated the exponential rise in capability and understanding of hacktivists to target institutions and being successful at it Image Source: Imperva - Hacker Intelligence Initiative, Monthly Trend Report 19
BUILDING SECURITY INTELLIGENCE BIG DATA ANALYTICS IT S NOT JUST FOR ADVERTISING! 5 Threats against the enterprise continue to evolve. Sinister, Sophisticated and Subtle Log everything, ask questions later Simpler is better The Ultimate Objective: Data Finds Data! Triage isn t about volume the squeaky wheel does not get the grease 20
CHANGING THREAT LANDSCAPE CYBER SECURITY IS A COMPLEX BUSINESS ISSUE Operation Aurora The GoogleAttack . The attack was aimed at dozens of other organizations, of which Adobe Systems, Juniper Networks and Rackspace have publicly confirmed that they were targeted. According to media reports, Yahoo, Symantec, Northrop Grumman, Morgan Stanley and Dow Chemical were also among the targets. RSA - Recently, our security systems identified an extremely sophisticated cyber attack in progress being mounted against RSA . Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat (APT) Top military contractor Northrop Grumman Corp. may have been hit by a cyber assault, the latest in a string of alarming attacks against military suppliers.. Lockheed Martin said its network had been compromised last week, and defense contractor L-3 Communications was targeted recently, as well. Both intrusions involved the use of remote-access security tokens, experts say. MISSION: Broaden Acquisition of Data from Sensory Apparatus Apply Analytical Models to the Data to Detect Disturbances in the Force 21
SURVEILLANCE ANALYTICS - BIG DATA VISION Eschew Traditional Vertical Solutions Take a Layered Approach to the Problem Data Finds Data Delivering Actionable Security Insight Visualization Data Analytics Data Store(s) Sensory Apparatus New Data, More Data Demanding Increasing Complex Analytics from Data Sets GB -> TB -> PB of Ingest Data Store everything, ask questions later Context develops as you analyze Exabyte Scale Analytics and Data Store Requirements 22
CHANGING THREAT LANDSCAPE SECURITY EVENT MONITORING THRESHOLD (THEN) 23
CHANGING THREAT LANDSCAPE SECURITY EVENT MONITORING THRESHOLD (NOW) 24
CHANGING THREAT LANDSCAPE SECURITY EVENT MONITORING THRESHOLD (NOW) 25
SI PREFIX PRIMER 1,000,000,000,000,000,000,000,000 yottabyte YB Big Data Exabyte Scale 1,000,000,000,000,000,000,000 zettabyte ZB CERN Produces 15 PB/Year 1,000,000,000,000,000,000 exabyte EB 1,000,000,000,000,000 petabyte PB Netwitness 460 TB 1,000,000,000,000 terabyte TB Splunk Consumes 150 GB/Day 1,000,000,000 gigabyte GB 1,000,000 megabyte MB My First Computer 1,000 kilobyte kB 26
Big Data Analytics known knowns known unknowns unknown unknowns Signatures Behaviors Sensemaking Digital Exhaust Data Data Finds Data - http://jeffjonas.typepad.com/DataFindsDataCreativeCommons.pdf 27
REGULATORY AUDIT AND CONTINUOUS CONTROLS MONITORING 6 Auditable risk management processes Demonstrate that you are doing what you are saying you are doing Obtain evidence while turning the crank Measure once and report many Continuous controls monitoring Monitoring once in a while or random sampling does not help anymore Automated monitoring has become necessity Constantly evolving business dynamics and regulatory requirements cause constant changes to scope, implementation and measurement of controls 28
Q&A 29
