Cyber Security Threats

Transcription

1 Cyber Security Threats What keeps us up at night? Doug Jacobson Information Assurance Center Information Assurance Center Iowa State University 1

2 Outline Who are the players The good, the bad, and the innocent What are the threats What is the state of the art in defense Where should we focus our efforts Information Assurance Center Iowa State University 2

3 The Good: the people who protect us We can all name the key people that are tasked with protecting our resources Security staff Auditors Guards Etc. Security is in their job description and is part of their performance evaluations. Information Assurance Center Iowa State University 3

4 The Bad: Who are they? Script kiddies Hackers Professionals Nation states Information Assurance Center Iowa State University 4

5 The innocent: Who are they? These are everyone else We will talk more about these people later. What role to they play in security What role should they play Information Assurance Center Iowa State University 5

6 Core Problems Interoperability is more important than security Poorly designed or tested software No accountability If this was a technology issue only we could win. Cyber security is a social/human issue The information war cannot be won on technology alone Information Assurance Center Iowa State University 6

7 How do they do it Attacks of opportunity Vulnerable systems Misconfigured systems Human error Advanced Persistent Threat (APT) Insider Accidental Malicious Information Assurance Center Iowa State University 7

8 Advanced Persistent Threat Attackers will pick a target or targets and wait until you make a mistake. Misconfiguration Not patching a system Or they will target your employees with phishing s Get them to disclose passwords Go to web sites to get malware Send attachments with malware Zero day attacks Information Assurance Center Iowa State University 8

9 Insider threats Intentional Think of the number of egress points and the number of protocols involved. Accidental As applications become more integrated and seamless it becomes easier to send data ( , IM, P to P) Intentionally Accidental As we have harden our defenses the attackers are using more social based attacks to get the users to leak information. Information Assurance Center Iowa State University 9

10 Now lets talk about defense First cyber security is an unfair war Defenders must be perfect Attackers only need to get it right once. Lets look at where we at Information Assurance Center Iowa State University 10

11 State of the art in defense Most organizations practice defense in depth However we are still often just reacting to events. Some times we don t even know they are attacking Information Assurance Center Iowa State University 11

12 How do people handle attacks Everything they see is an attack Everything is just fine and I m safe. Information Assurance Center Iowa State University 12

13 How management sometimes handles security? We don t want to hear there is a problem We don t want to see the problem We don t want to talk about the problem Information Assurance Center Iowa State University 13

14 State of the art in protection We know how to build forts and protect ourselves from the outside Information Assurance Center Iowa State University 14

15 Let s talk about technology We build lots of technology based walls around everything. based walls Information Assurance Center Iowa State University 15

16 Let s talk about people walls What people based walls do we have? Policy based (policies don t really protect) Education based Information Assurance Center Iowa State University 16

17 Threats to the people Phishing attachments Trojans Viruses Peer-to-Peer Web Sites Wireless Social Networking Information Assurance Center Iowa State University 17

18 Where should we focus our efforts? Technology People Training / Literacy Information Assurance Center Iowa State University 18

19 Keep it current Keep it patched Remember defense in depth No one product can do it all Technology Information Assurance Center Iowa State University 19

20 People We need highly trained security professionals to build both the technical walls and the people walls We need an IT staff that is security literate We need an overall staff that is security literate Information Assurance Center Iowa State University 20

21 Training / Literacy Don t forget the training Not just for the security elite, but for everyone Everyone should be security literate. Information Assurance Center Iowa State University 21

22 Questions Information Assurance Center Iowa State University 22