The Most Common Failure With Today's Defences
2 likes744 views
The document discusses common failures in current security defenses and highlights the increasing frequency and impact of data breaches. It emphasizes the need for organizations to improve monitoring of user behavior, implement dynamic trust levels, and expand existing security controls to prevent unauthorized access and data exfiltration. Key recommendations include enhancing authentication methods and analyzing behavioral patterns to detect malicious activities.
![450 000 000
“Client record” is typically at least [username+password]](https://image.slidesharecdn.com/themostcommonfailurewithtodaysdefences-140908114109-phpapp01/85/The-Most-Common-Failure-With-Today-s-Defences-5-320.jpg)
The Most Common Failure With Today's Defences
- 1. The Most Common Failure With Today's Defences Mark Nunnikhoven Vice President, Cloud & Emerging Technologies @marknca Just like you probably can’t see this, I can’t see the backchannel Tweet me now @marknca, I’ll reply after the talk…
- 2. Recent attacks The problem What you can do?
- 3. Recently…
- 5. 450 000 000 “Client record” is typically at least [username+password]
- 6. 27-Nov-2013—15-Dec-2013 First real CEO “resignation” due primarily to information security incident
- 7. Early May-2014—Late Aug-2014 a/k/a “Target 2” …but worse
- 8. Late Feb-2014—Mid May-2014 Nominated for “Worst Communications During An Incident”
- 9. 17-Jun-2013—17-Oct-2014 Real reputation risk & impact on ability to conduct business
- 10. 17-Sep-2013—Early Oct-2013 Should have received more attention More on this one later…
- 11. Amazing visualization from Information Is Beautiful “World’s Biggest Data Breaches & Hacks”
- 13. Breaches: more frequent, lasting longer, bigger impact on businesses
- 14. The Problem
- 15. Data Restrict inbound Restrict outbound Heavily monitor access Data space: servers, applications, infrastructure, etc.
- 16. User Restrict inbound Allow outbound Little to no monitoring User space: Where the users are ;-) Endpoints like laptops, desktops, tablets, etc.
- 18. Authentication Authorization Yes, we typically only use 2 controls here
- 19. 152 million records 40 GB of source code ~44 GB of data exfiltrated
- 20. What can you do?
- 22. Authentication Authorization Behaviour analysis 3 is more than 2. That’s an immediate win when reporting up to your boss(es)
- 23. What to look at All traffic leaving user space Most organizations have some controls between the user and the world Need to start to address internal data flow & expand existing controls
- 24. What to look for Malicious patterns A service or appliance can help here
- 25. What to look for Odd access patterns Most breaches are access data through authorized channels BUT using odd behavioural patterns
- 26. What to do about it Vary the level of trust in the user * Dynamically vary the level depending on specific criteria and indicators of trust
- 27. You may trust me to deliver a talk on security…
- 28. But would you trust me to look after your kids?
- 29. Trust is a spectrum
- 30. Varying trust A quick example
- 31. Normal access
- 32. Have a confirmed finding (or high enough confidence)
- 33. Not sure what we’ve found
- 34. Not sure what we’ve found
- 35. Take a deeper look
- 36. Not sure what we’ve found? Increase monitoring, block high value access temporarily
- 37. Add behavioural analysis Look for odd/malicious patterns Vary the level of trust