Cybersecurity in 2022
2 likes447 views
The document discusses cybersecurity trends and challenges in 2022, covering topics such as remote work, cloud computing, automation, zero-day exploits, ransomware, and the role of nation-state actors. It highlights the vulnerabilities in technology, including the Internet of Things and supply chains, and emphasizes the importance of security measures like network segmentation and zero trust. The discussion includes insights into emerging threats and strategies for defense in the ever-evolving cyber landscape.
Cybersecurity in 2022
- 1. Cybersecurity in 2022 Gabe Schuyler The state of attack & defense Austin Forum on Technology and Society March 1, 2022
- 2. Agenda • Going remote • Cloud computing • Automation • Zero-days • Internet of things • Ransom • Supply chain • Nation-state actors • Armed Con fl ict • Q & A @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 3. Gabe Schuyler • Enterprise Solutions Engineer at Wiz, Inc. • Long time operations person • Medium time cybersecurity professional • Also into wireless hacking, RFID tags, and using technology for positive social change. @gabe_sky @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 4. Going remote • Lock-down • Bring your own device • Borrow your work device • Segment your networks • Protect all endpoints • "I'm not a cat" @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 5. Cloud computing • Cheap and remote • Unsecured resources • Crypto-mining • Cloud security posture management • Inventory and monitoring • Department of transportation @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 6. Automation • Criminals are lazy • Brute force • Large-scale phishing • Password managers and MFA • Automated response • Honeypots @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 7. Zero-day and zero-click exploits • No patch to stop it • Lucrative job, selling • Effective against well-defended • Defense in depth • Incentivize updates and patches • NSO group @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 8. Internet of Things • Valuable data and orchestration • Firmware updates rare/never • Stepping stone inside • Change default passwords • Segment networks • Hacked by a fi sh tank @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 9. Ransomware • Lucrative and automatable • Ransomware as a service • Double-ransom • Backups • Insurance • Colonial pipeline @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 10. Supply Chain • Applications "borrow" code • Enterprises use diverse software • Often opaque to developers • Automate security in development process • Defense in depth & zero trust • SolarWinds @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 11. Nation states • Rare but unstoppable • Disruption and misinformation • Espionage • Listen to CISA (and NSA?) • Insurance ("Acts of War") • Chinese warship on pause @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 12. Armed Con fl ict • Conspicuously quiet • DDoS and defacement • Disinformation • Trusted sources, veri fi ed information • Protect against splash damage • Current insanity @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler
- 13. Q & A Gabe Schuyler @gabe_sky @gabe_sky Austin Forum on Technology and Society -- March 2022 Gabe Schuyler